Lukasz Olejnik (@[email protected])

@lukOlejnik

Seized cameras, electronic equipment and GPS transmitters, which the suspects planned to PLACE ON transports with the equipment. To aid in its localisation….?

Mar 16, 2023

-

Exchange bug is apparently pretty sweet. RCE with invisible emails.

GitHub - sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY: Exploit for the CVE-2023-23397 · GitHub

Exploit for the CVE-2023-23397. Contribute to sqrtZeroKnowledge/CVE-2023-23397_EXPLOIT_0DAY development by creating an account on GitHub.

-

This ICMP bug raised quite a bit of interest in certain circles, but exploitation seems to be in the theoretical stage for now.

-

Tufail Ahmed

@7ufail

🚨 NEW Blog from @Mandiant 🚨  Suspected Chinese Threat Actor (#UNC3886) involved in Espionage Operations. mandiant.com/resources/blog… 🧵

Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation | Mandiant

A suspected Chinese actor used a zero-day vulnerability in FortiOS and custom malware for espionage.

Mar 16, 2023

-

Runa Sandvik

@runasand

Latest post for my Journalist and Spy newsletter is about Peruvian journalist Vicky Peláez. In 2010, Peláez, her husband and eight others were arrested by the FBI for carrying out long-term, deep-cover assignments in the U.S. on behalf of Russia.

Vicky Peláez

Vicky Peláez is a Peruvian journalist and columnist, currently writing for The Moscow News and Sputnik. In June 2010, Peláez, her husband Mikhail Vasenkov, and eight others were arrested by the FBI for allegedly carrying out long-term, deep-cover assignments in the U.S. on behalf of Russia. All ten…

Mar 16, 2023

-

Joseph Cox

@josephfcox

New: hacker who allegedly breached a U.S. federal law enforcement tool that let them look up info on "anyone in the US" was on-the-run. Now found he's been arrested in Florida

On-the-Run Hacker Who Allegedly Breached Federal Cop Database Arrested in Florida

Nicholas Ceraolo, who faces years in prison for allegedly accessing a U.S. federal law enforcement database and other crimes, was still at large when authorities announced the charges against him.

Mar 16, 2023

-

Marcel Böhme👨‍🔬

@mboehme_

Fuzzing a formally verified compiler for six CPU years: Found unbreakable. From [PLDI'11] "Finding and Understanding Bugs in C Compilers" by Yang, Chen, Eide, and Regehr: users.cs.utah.edu/~regehr/papers…

Mar 15, 2023

Manuel Rigger

@RiggerManuel

@mboehme_ CompCert contains/contained unverified parts for builtin handling, in which we have found bugs.

Support of GCC Builtins · Issue #243 · AbsInt/CompCert

We are currently studying the usage of GCC builtins by GitHub projects and how well various tools support them. To that end, we are also developing a test suite for the most frequently used machine...

Mar 16, 2023

Paper:

https://www.manuelrigger.at/papers/GCCBuiltins-ESECFSE19-preprint.pdf

-

Brad Heath

@bradheath

Amazing work by @Reuters: An insider account of Wagner Group, the convict army feeding men into the "meat grinder" of Russia's war in Ukraine. reuters.com/investigates/s…

Mar 16, 2023

-

Giorgi Revishvili

@revishvilig

Father of 39-year-old Russian Igor Nebivaev, the executive director of the Council of Europe's anti-money laundering programme Moneyval, is believed to be a general in Russia's Foreign Intelligence Service - 68-year-old Vladimir Nebivaev

Mar 16, 2023

-

Silvija Krebs(a)🇱🇻🇪🇪🇱🇹💙💛🌻🇪🇺

@SilvijaKrebs

“Drone crashed in 4,000 to 5,000 ft of water. Before it was downed, operators took steps to wipe its electronics in hopes of rendering the wreckage useless for intelligence collection.” ~ NSC spokesman

Pentagon rejects Russian airspace claims after downing of U.S. drone

Both sides warned that the Black Sea encounter had a potential to escalate into direct conflict.

Mar 16, 2023

-

After the Exchange bug what are the odds that we’d get a second awesome bug in the same week? Turns out pretty good. This one is really juicy. RCE via VoLTE. Since P0 found this bug in this attack surface, my suspicion is that there are more of these out there.

Word to the wise — disable VoLTE

SecurityWeek

@SecurityWeek

Critical flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs the victim’s phone number. @ryanaraine reports: -

Project Zero: Samsung Mobile Chipsets Vulnerable to Baseband Code Execution Exploits

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction.

Mar 16, 2023

-

pixelatedboat aka “mr tweets”

@pixelatedboat

Wow it’s popping off in France 😧

Mar 17, 2023

-

STÖK ✌️

@stokfredrik

The original find by Metabaseq is 🔥 gonna deep dive into tEXt and other png chunks for a few days. Poc here : github.com/duc-nt/CVE-202…

Mar 16, 2023

-

Alex

@alexalbert__

Well, that was fast… I just helped create the first jailbreak for ChatGPT-4 that gets around the content filters every time credit to @vaibhavk97 for the idea, I just generalized it to make it work on ChatGPT here's GPT-4 writing instructions on how to hack someone's computer

Mar 16, 2023

-