February 7, 2024
February 7, 2024
Exclusive: Andrey Kharchenko, one of the Russian attendees of a much-scrutinized 2018 meeting in a Moscow hotel with Lega leader Matteo Salvini's right-hand, is an FSB Fifth Service officer, @the_ins_ru today reveals. The meeting was to negotiate Russian funding of Lega.
β Michael Weiss (@michaeldweiss) February 6, 2024
Thread by @michaeldweiss on Thread Reader App β Thread Reader App
@michaeldweiss: Exclusive: Andrey Kharchenko, one of the Russian attendees of a much-scrutinized 2018 meeting in a Moscow hotel with Lega leader Matteo Salvini's right-hand, is an FSB Fifth Service officer, @the_ins...β¦
We're naming names π₯ because the harm is not hypothetical.
β Maddie Stone (@maddiestone) February 6, 2024
Today we share "Buying Spying", our new report diving into the commercial surveillance/spyware industry. We dive into the players, the campaigns, the spyware, & the harm it perpetuates.https://t.co/D8Lx4wRrw6 pic.twitter.com/QhAzm4BPLl
Thread by @maddiestone on Thread Reader App β Thread Reader App
@maddiestone: We're naming names π₯ because the harm is not hypothetical. Today we share "Buying Spying", our new report diving into the commercial surveillance/spyware industry. We dive into the players, the campaig...β¦
Everyone's been sending me the deepfake CFO article. I'm not sure if it's real, so waiting for facts to emerge. But, here's what I'd do if it's accurately reported π§΅https://t.co/iUOkexZ5Mp
β Dan Guido (@dguido) February 5, 2024
Thread by @dguido on Thread Reader App Γ’ΒΒ Thread Reader App
@dguido: Everyone's been sending me the deepfake CFO article. I'm not sure if it's real, so waiting for facts to emerge. But, here's what I'd do if it's accurately reported 𧡠amp.cnn.com/cnn/2024/02/04Γ’ΒΒ¦ Make sure you...Γ’ΒΒ¦
One can only imagine how painful the waiver process that will inevitably be required for visa restricted designation of exploit devs that suddenly become interesting for national security purposes.
β JD Work (@HostileSpectrum) February 6, 2024
I'm hoping this is used more against the users of the tech and not the exploit devs who we really do want coming to get a job at a FAANG?
β Dave Aitel (@daveaitel) February 6, 2024
Two key points here
- The abusers of commercial surveillance systems should be punished, not the developers of dual use technology that is critical for national security and law enforcement.
- Developers doing a thing you donβt like should be diverted with soft power into non problematic roles. Get them jobs and bring over their families.
Stakeknife: Soldiers who handled agent in IRA will not be prosecutedhttps://t.co/6UcdDwQjdp
β Jennifer O'Leary (@Jen_O_Leary) February 6, 2024
Last week, Finnish authorities claimed to have successfully traced Monero transactions linked to the Vastaamo hack. Just moments ago, Binance announced the delisting of Monero ($XMR).
β Snoops (@Snoops0x) February 6, 2024
Is this merely a coincidence? I think not.
π§΅π pic.twitter.com/sqEjFwmqsA
Wow! ICYMI Friday: The list of amici on this @PaulWeissLLP Amicus Brief calling out the @SECGov enforcement action vs. @solarwinds is a who's who of #CyberSecurity luminaries, experts and Pioneers, from @ncdinglis and @stewartbaker to @SpauldingSezhttps://t.co/FjmAnk3nJr
β Shaun Waterman (@WatermanReports) February 5, 2024
Taylor Swift attorneys have threatened legal action against Florida college student whose social media accounts track takeoffs/landings of aircraft owned by billionaires, politicians, Russian oligarchs and celebs using public FAA data. https://t.co/nImdgsm1qf
β Kim Zetter (@KimZetter) February 6, 2024
New from 404 Media: Patternz, a global phone spy tool which is built on advertising data, was specifically marketed as a "riot detection" tool, with maps pointing to New York City. Shows the aspirations of what companies selling this tech envision it for https://t.co/l5S1XxhalG
β Joseph Cox (@josephfcox) February 6, 2024
Excellent introduction to Linux kernel heap exploitation concepts and Random kmalloc caches (RANDOM_KMALLOC_CACHES) mitigation
β 0xor0ne (@0xor0ne) February 6, 2024
Credits @sam4k1https://t.co/K1xeX3BqPw#Linux #infosec pic.twitter.com/RYY3nvoToQ
Ministry of Defence (MoD) of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT.
β Matthijs R. Koot (@mrkoot) February 6, 2024
Intrusion affected segmented 50-user MoD R&D network.
10-pager by MIVD & @AIVD w/tech details (0.5MB .pdf, Feb 2024) https://t.co/zPNOTQtnKP
Initial access via CVE-2022-42475. pic.twitter.com/EyJIFGsx8z
shazam, but for scary noises I hear at night
β Grace Jarvis (@gracejarvisohno) February 6, 2024
Some roses are red
β pourmecoffee (@pourmecoffee) February 6, 2024
Some roses are black
"3 million smart toothbrushes were just used in a DDoS attack"https://t.co/YEKDUFiq8M
I mean, they never did ? https://t.co/F8SCPTb37X
β Dave Aitel (@daveaitel) February 6, 2024
WOW: ~ 50% of 0day exploits against Google/Android products now come from commercial vendors.
β John Scott-Railton (@jsrailton) February 6, 2024
"if governments ever had a monopoly on the most sophisticated capabilities, that era is certainly over"
Timely NEW REPORT by @Google TAG
Some takeaways𧡠1/ https://t.co/YdqufVoDYi pic.twitter.com/CjrJwZywmL
I think Dave is correct here. The old hacking crews had exploit dominance.
Art Nouveau doors from c. 1900 in Brussels, Belgium. pic.twitter.com/5KTucKhzpK
β ArtNouveauDeco (@NouveauDeco) February 6, 2024
My buzzword bingo sheet was not prepared for this headline:
β stacksmashing (@ghidraninja) February 6, 2024
"a Cyber Resilient Hybrid Cloud and AI Platform" pic.twitter.com/zYCCMhUsm5
Well, this is foolproof. Problem solved.
Images generated in ChatGPT and our API now include metadata using C2PA specifications.
β OpenAI (@OpenAI) February 6, 2024
This allows anyone (including social platforms and content distributors) to see that an image was generated by our products. https://t.co/kRv3mFnQFI pic.twitter.com/ftHqECS8SB
Interesting international initiative on commercial spyware https://t.co/eaADuQLEP4
β Ciaran Martin (@ciaranmartinoxf) February 6, 2024
iPhone apps are collecting quite some A LOT OF user private data. Extremely verbose, allowing to fingerprint, perhaps even track users.
β Lukasz Olejnik, βοΈπ₯ (@lukOlejnik) February 7, 2024
Context from my works. About privacy risks of light data: https://t.co/eb93tHS83a
Risks of battery information: https://t.co/qrWc0Cwow8 https://t.co/uhhXJ09T6J pic.twitter.com/mg8FXEiz1x
This screenshot shows the app analytics data sent by two different iOS apps: @duolingo and @Tinder. What's the likelihood that both apps are installed on the same device? π―? π€―
β Mysk π¨π¦π©πͺ (@mysk_co) February 4, 2024
Both apps use @unity Ads. The data in the screenshot is collected by the Unity Ads framework included⦠pic.twitter.com/h8SwasjYkG
The volume being sent is also accurate.
β Mysk π¨π¦π©πͺ (@mysk_co) February 4, 2024
Testing with different volume levels resulted in including such values in the requests. (One can still argue that Unity Ads uses this so that it sends silent ads if the device's volume is too high, no fingerprinting here π) pic.twitter.com/w3iTpAQw0m