July 6, 2022

how our team understood information advantage at the time.

                July 6, 2022

            July 6, 2022

            Important analysis of the lessons learned so far on cyber in Ukraine.
European Cyber Conflict Research Initiative @EuropeanCyberWhat lessons can we draw from the  Russian invasion of Ukraine about the role of cyber operations in military conflict? 

On 30 May, ECCRI held a closed-door roundtable in Tallinn discussing this question.

The roundtable report is now available online: eccri.euTallinn Workshop Report7:52 AM ∙ Jul 6, 2022
28Likes20Retweets-
Lucian Kim @Lucian_Kim
Putin thought he could buy anybody, and many Austrian officials were for sale. Deep dive into a swamp: washingtonpost.comAfter invasion of Ukraine, a reckoning on Russian influence in AustriaThe invasion of Ukraine has accelerated a reckoning in Austria on the risks for countries that fall under Moscow’s sway.5:30 PM ∙ Jul 5, 2022
620Likes292Retweets
-
The Info Op is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.
-
Tim Brown @timb_machine
Another reminder, eBPF is an attack surface not just a source of security telemetry: github.comGitHub - citronneur/pamspy: Credentials Dumper for Linux using eBPFCredentials Dumper for Linux using eBPF. Contribute to citronneur/pamspy development by creating an account on GitHub.6:05 PM ∙ Jul 5, 2022
165Likes66Retweets
-

https://www.theregister.com/2022/07/05/shanghai_police_database_for_sell/

-
Cool experimental archeology project.

https://gregorysaldrete.com/hompage/linothorax-project/

-
OpenSSL RCE (allegedly). A heap memory corruption vulnerability.

https://www.openssl.org/news/secadv/20220705.txt

Kevin Beaumont @GossiTheDog
The OpenSSL security issue will get a lot of press attention.. but the scope is extremely small.

It only impacts one (newer) version, and needs a specific configuration and a specific CPU.. and also the code didn't compile properly.  
github.comAVX512-specific heap buffer overflow with 3.0.4 release · Issue #18625 · openssl/opensslBuild OpenSSL-3.0.4 on a CPU with AVX512 (my CPU is a Core i7-1065G7) with: CFLAGS=&quot;-O3 -g -fsanitize=address&quot; ./config make Run a test: make V=1 TESTS=test_exp test The sanitizer complai...9:44 PM ∙ Jul 5, 2022
91Likes24Retweets
Barry Dorrans @blowdartThe worst thing about the new OpenSSL vulnerability is I know I’m going to get a bunch of MSRC cases asking why we haven’t updated our docker images despite 

1) No distro we build on uses OpenSSL 3.x
2) .net doesn’t use or expose that AES combination
3) Distros manage OpenSSL12:12 PM ∙ Jul 6, 2022
13Likes4Retweets-
NIST is so over quantum. They’re practically post quantum, really.

https://www.nist.gov/news-events/news/2022/07/nist-announces-first-four-quantum-resistant-cryptographic-algorithms

-
Enjoy the dark ages.

https://deprogrammaticaipsum.com/the-digital-dark-ages/

-
Adam Segal @adschina
US expands efforts to hamstring China’s chipmaking mojo theregister.comUS wants to ban China from buying ASML DUV chipmaking kitBeijing can’t get next-gen lithography gear, America now trying to block sales of older machines9:32 PM ∙ Jul 5, 2022
3Likes2Retweets
-
Revisiting Pegasus on iOS 9.3. Nice deep dive analysis on some older exploits, always good to learn more.

https://shadowfile.inode.link/blog/2022/07/revisiting-pegasus-on-ios9/

-
winterknife @_winterknife_
Meet PINKPANTHER - Windows x64 handcrafted token stealing kernel-mode shellcode that works on all Windows versions from 7 to 10.
It was created while playing around with HEVD, nothing crazy here but code is commented well and it might help someone.
Link: github.comGitHub - winterknife/PINKPANTHER: Windows x64 handcrafted token stealing kernel-mode shellcodeWindows x64 handcrafted token stealing kernel-mode shellcode - GitHub - winterknife/PINKPANTHER: Windows x64 handcrafted token stealing kernel-mode shellcode4:39 PM ∙ Jul 4, 2022
1,241Likes376Retweets
-
Arbitrary code execution in Super Mario. 
-
NASA Exoplanets @NASAExoplanetsWe've discovered more than 5,000 planets beyond our solar system. Each exoplanet is a whole new world to explore and now we have guided tours of some of the most exotic destinations in our galaxy! Each one is based on real science. exoplanets.nasa.gov/travel 
6:30 PM ∙ Jul 5, 2022
3,907Likes671Retweets
-
PsyWar.Org @psywarorg
Mitigating against potential hostile InfoWar in 1943 @BBCMonitoring 
2:17 PM ∙ Jul 15, 2017
15Likes5Retweets
-
pfriedma @pfriedma
The Voyager spacecraft includes the location of our sun (in relation to 14 pulsars of known direction and frequency) so that any advanced civilization that finds it knows what part of the universe to avoid.8:59 PM ∙ Jul 5, 2022
55Likes16Retweets
-
KJ @IDontSpeakWhine
What I said: Please bring your laundry downstairs.

What my son heard: Please drop your laundry from the second floor down into the foyer as I stand at the front door talking to our neighbor so  a dirty balled up sock can bounce off my head and into her face.12:34 PM ∙ Jul 5, 2022
1,873Likes280Retweets-
Thomas H. Ptacek @tqbf
So @Mark_Schultz wrote a whole series of posts explaining LWE (the PQC crypto constructions) from the ground up, with simplified but sane models in Python, and it’s great. mark-schultz.github.ioNIST-PQC Choices OutToday, NIST put out its preliminary choice of PQC algorithms to standardize.
I wrote an introduction to lattice-based KEMs (for non-cryptographers) this last weekend in preparation for the report, where one implements an (aggressively unoptimized) variant of FrodoKEM.
FrodoKEM ended up not being sta…3:31 AM ∙ Jul 6, 2022
39Likes8Retweets
-
Great article on how the US military doesn’t quite understand how information technology and conflict really work.
how our team understood information advantage at the time. In contrast to previous technology-focused thinking, information was defined broadly and included technical systems, cognitive processes, and perceptual/psychological effects. The term “advantage” was meant to convey how contested the information environment would be in competition or conflict with an opponent like China or Russia. Unlike “superiority” or “dominance,” with their connotations of decisive or lasting ascendancy, advantage was meant to be marginal, ephemeral, contingent, and constantly fought over.
Emphasis added.

https://warontherocks.com/2021/09/confronting-chaos-a-new-concept-for-information-advantage/

                Don't miss what's next. Subscribe to the grugq's newsletter: