June 30, 2022
Landmark psychology experiment that indicated how easy it is to plant false memories in people's minds about getting lost in a shopping mall as a child passes the replication test with flying colors. psyarxiv.com/nh3zq/
Jun 28, 2022
-
CVE-2022-23277 Can't believe it works on Exchange Server (was patch in March)! Just use the same PoC of Tianfu patch with different gadgetchain to make it work! p/s: also saw the patch in Sharepoint May patch but can't find any related document yetš¤
Jun 29, 2022
-
https://consilienceproject.org/technology-is-not-values-neutral/-
-
TikTok is not just another video app. Thatās the sheepās clothing. It harvests swaths of sensitive data that new reports show are being accessed in Beijing. Iāve called on @Apple & @Google to remove TikTok from their app stores for its pattern of surreptitious data practices.
Jun 28, 2022
-
Check out a recent finding by one of our own, Naveen Sunkavally. CVE-2022-28219 is an unauth RCE for ManageEngine ADAudit Plus. This XXE -> Deserialization chain often leads to host compromise as well as priv'd AD creds. Check out the blog post and POC:
Jun 29, 2022
CVE-2022-28219: Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit Plus
CVE-2022-28219 is a unauthenticated remote code execution vulnerability affecting Zoho ManageEngine ADAudit Plus, a compliance tool used by enterprises to monitor changes to Active Directory. The vulnerability comprises several issues: untrusted Java deserialization, path traversal, and a blind XMLā¦
-
More attribution from Global Times and private security firm: Exclusive: US plants Trojan horse programs in hundreds of important Chinese information systems; new cyber weapon targets China, Russia
Jun 29, 2022
Exclusive: US plants Trojan horse programs in hundreds of important Chinese information systems; new cyber weapon targets China, Russia
On Wednesday Chinaās official virus emergency response office and leading cybersecurity company disclosed a new vulnerability attack weapon platform deployed by the US National Security Agency (NSA), which cybersecurity experts believe is the main equipment of the NSAās computer network hacking operā¦
Technical write up (Chinese):
https://www.cverc.org.cn/head/zhaiyao/news20220629-FoxAcid.htmEnglish here
https://www.cverc.org.cn/head/zhaiyao/FOXACID.pdf
-
āMinions: The Rise of GRUā sounds very much like a book Iād like to read on a subject quite different than the movie
Jun 29, 2022
-
-
New: police arrested a man called "Paul K" in the Caribbean, suspected of being behind the encrypted phone firm Encrochat. Police previously hacked and arrested thousands of Encrochat users We can now add that Paul K is Paul Krusky, based on emails, more
Jun 29, 2022
Cops Investigating āWhatsApp for Gangstersā Arrest Key Suspect in Caribbean
Paul Krusky played a crucial role in the development of encrypted phone firm EncroChat. Now he has been arrested in the Dominican Republic.
-
Cryptographic failures in RF encryption allow stealing robotic devices | Cossack Labs
Stunned by losing their robotic devices, [REDACTED] learnt that they were hijacked by attackers even with communication being encrypted. Having researched its firmware and found numerous cryptographic failures, we've crafted a few demos on how cryptography goes wrong in real life.
-
FBI warning about deepfakes being used to mask ppl applying for jobs.
FBI warns crooks are using deepfake videos in job interviews
Yes. Of course I human. Why asking? Also, when you give passwords to database?
-
Cryptocurrency titan Coinbase providing āgeo tracking dataā to ICE interc.pt/3byTLlg by @samfbiddle
Jun 29, 2022
Cryptocurrency Titan Coinbase Providing āGeo Tracking Dataā to ICE
ICE is now able to track transactions made through nearly a dozen different digital currencies, including Bitcoin, Ether, and Tether.
-
šØš³ PLA is placing orders for AI chips designed by US companies and manufactured in Taiwan and South Korea. Of the 97 individual AI chips identified in public PLA purchase records, nearly all were designed by Nvidia, Xilinx (now AMD), Intel, or Microsemi. cset.georgetown.edu/publication/siā¦
Jun 29, 2022
Silicon Twist - Center for Security and Emerging Technology
The Chinese militaryās progress in artificial intelligence largely depends on continued access to high-end semiconductors. By analyzing thousands of purchasing records, this policy brief offers a detailed look at how Chinaās military comes to access these devices. The authors find that most computerā¦
-
The Kaliningrad trouble, that is a European country blocking Russiaās access because of sanctions, is also an issue in Scandinavia. Yay!
Russia is a signatory of the Spitsbergen treaty from 1920 that makes Svalbard part of Norway, but guarantees some rights for residents of the Svalbard archipelago (way up in the arctic.) Now the Russians are upset about the way that Norway is apply sanctions.
š·šŗš„š³š“ Svalbard (Spitsbergen is the old name before the 1920 treaty) š„ point 1/ ā¬ļø
Jun 30, 2022
-
A pair of killer whales who have developed a taste for the livers of great white sharks appear to have transformed an ocean ecosystem in South Africa
Jun 29, 2022
Great fright: sharks fleeing hungry orcas
A pair of killer whales who have developed a taste for the livers of great white sharks appear to have transformed an ocean ecosystem in South Africa, scientis
-
Click meā¦! The influence of clickbait on user engagement in social media and the role of digital nudging
Click meā¦! The influence of clickbait on user engagement in social media and the role of digital nudging | PLOS One
Clickbait to make people click on a linked article is commonly used on social media. We analyze the impact of clickbait on user interaction on Facebook in the form of liking, sharing and commenting. For this, we use a data set of more than 4,400 Facebook posts from 10 different news sources to analyze how clickbait in post headlines and in post text influences user engagement. The results of our study revealed that certain features (e.g., unusual punctuation and common clickbait phrases) increas...
-
This morning weāre releasing our latest research today on an router campaign weāre calling ZuoRat.
Jun 28, 2022
ZuoRAT Hijacks SOHO Routers to Silently Stalk Networks - Lumen
Black Lotus Labs, is currently tracking elements of what appears to be a sophisticated campaign leveraging infected SOHO routers to target predominantly NA and European networks of interest.
-
-
Golang code review notes: Quick summary of some of the bug classes in Go
Jun 30, 2022
Golang code review notes
elttam is an independent security company providing research-driven security assessment services. We combine pragmatism and deep technical insight to help our customers secure their most important assets.
-
The American version of finding a Roman bath while digging up a Tesco car park. https://t.co/JOvAMOaMXN
Jun 28, 2022
-
-
-
-
First time an officer of 8200 has spoken to the public that was not an announcement for a startup!
VIDEO ā it was here but has been made private.
Iām wondering what it means to have 70% of your force under 23yr old. Firstly, it means that theyāre all 22.95. But what does it mean to have cyber without deep experience? Maybe thatās good for a high friction environment where new techniques are needed constantly. Idk, Iām biased towards old age and treachery.
-
Add a comment: