June 9, 2022
A userland rootkit is pretty weak. There are some easy ways to detect it. The simplest is to just use a staticky linked binary, like busybox, rather than the utilities on the compromised box. Honestly, I thought this was standard practise, so I’m a bit surprised that a userland rootkit can defeat live forensics.
Alongside @BlackBerry we just released joint research detailing a new, undetected Linux threat called #Symbiote Different from other Linux malware, the threat infects running processes rather than using a standalone executable file to inflict damage
Jun 9, 2022
Symbiote: A New, Nearly-Impossible-to-Detect Linux Threat
Symbiote is a new Linux® malware we discovered that acts in a parasitic nature, infecting other running processes to inflict damage on machines.
-
Big SIGINT energy.
https://www.scmagazine.com/analysis/rsac/nsa-cyber-chief-says-there-has-been-enormous-amount-of-hacking-in-ukraine-war“People were asking ‘Well you know, I’m not sure we’re seeing a dip in ransomware, how do you know this; can you show me?' I would just say: how did we know? Really? We’re NSA,” said Joyce, alluding to the agency’s core mission of collecting signals intelligence. “We heard them say they can’t get their money out. We heard them say that they can’t buy infrastructure.
-
If you don't have "attackers physically targeting your employees home networks/hardware in order to gain access to their employer" in your game plan, let me tell you: You should.
Jun 8, 2022
-
-
Dueling over Dual_EC_DRBG: The Consequences of Corrupting a Cryptographic Standardization Process (0.6MB .pdf, 8 June 2022, 61 pages) harvardnsj.org/wp-content/upl… re: NIST By @NadiyaKostyuk & Susan Landau, published in Harvard Law School's NatSec Journal (@harvardnsj). /c @thegrugq
https://harvardnsj.org/wp-content/uploads/sites/13/2022/06/Vol13Iss2_Kostyuk-Landau_Dual-EC-DRGB.pdf Jun 8, 2022
-
“combatant who conducts defensive cyber operations may be the object of a lethal attack (e.g., an airstrike)”. Defending systems during wartime may have some curious implications. Yes: defending … lieber.westpoint.edu/private-compan…
Jun 8, 2022
-
-
In 1572, "making his Low Obeisance to Queen Elizabeth [the Earl of Oxford] happened to let a Fart, at which he was so abashed and ashamed that he went to Travell, 7 yeares. On his return, the Queene welcomed him home and says, My Lord, I had forgott the Fart."
Jun 8, 2022
-
Do yourself a favour and read this thread. It is a wonderful journey.
Today I am going to tell you about a legal term from real estate transactions in the Middle East dating back 2,800 or more years. The term is bētu epšu adi gušūrīšu. “A built house along with its beams.” Legal conventions have a way of sticking around over time.
Jul 8, 2020
-
Sure, you could post on Stack Overflow, OR pay 10% of your salary for a 20 person off-broadway production of "cryptodaddy47, You Are Wrong About C Pointers (and Everything Else)"
Jun 8, 2022
-
“The program continues to track a cybersecurity vulnerability risk stemming from the F-15EX design, derived from FMS aircraft and, according to the program, not designed to U.S. Air Force cybersecurity requirements”
Jun 9, 2022
GAO finds delays in major weapons programs, broad cybersecurity worries - Breaking Defense
GAO found delays in more than half of the programs it studied. Also, 4-pound birds are a problem.
-
-
Awesome writeup by @SonarSource 👍 Horde Webmail - Remote Code Execution via Email blog.sonarsource.com/horde-webmail-…
Jun 9, 2022
Horde Webmail - Remote Code Execution via Email
We discovered vulnerabilities in Horde Webmail that allow an attacker to execute arbitrary code on Horde instances by having a victim open an email
-
Disclosing an unfixed Google Cloud Platform (GCP) vulnerability as the 90-day remediation deadline has passed: Cloud Functions or Cloud Run launched from any GCP organization can bypass Google Kubernetes Engine (GKE) Authorized Networks (aka Kubernetes control plane firewalls) 🧵
Jun 7, 2022
-
Highly recommend reading Seriously Risky Business today.
-
Starlink Ukraine received an operator license. Actually it’s #1 in Ukrainian Register of providers of electronic communication networks and services. The representative office of @SpaceX is about to start working in Ukraine!
Jun 9, 2022
-
I wouldn’t bet on it.
Scoop: Israel presses U.S. to remove cyber spying company NSO from blacklist. My story on @axios
Jun 9, 2022
Israeli officials push U.S. to remove NSO from blacklist
Reports emerged last year that found NSO’s Pegasus software had become a tool for governments to spy on journalists and critics.
-
In 2011, FB renamed its 'privacy policy' to 'data policy'. While the extreme depth+scale of its global surveillance machine doesn't change, FB/Meta now announced to rename it back to 'privacy policy'. The new policy (effective July) is a complete rewrite:
May 27, 2022
Here’s What You Need to Know About Our Updated Privacy Policy and Terms of Service | Meta
We’ve rewritten and re-designed our Privacy Policy to make it easier to understand and clearer about how we use your information.
-
This is evil and incompetent. \o/
Got a email from my job saying all employees get a $30 gas card to alleviate high gas prices (we are required to drive clients around). Why when I went to sign up it sent me another email saying I was phished by my tech department as a tester and then got assigned training???🥲💔
Jun 8, 2022
-
Great stuff in here.
My series on reconnaissance-strike tactics and maneuver warfare for the Marine Corps Gazette is available in its entirety online. (Not paywalled) Links in thread. @MCA_Marines
Jun 9, 2022
Add a comment: