March 9, 2024
March 9, 2024
Classy move by Microsoft, waiting til Friday to announce that APT29 completely owned them
https://msrc.microsoft.com/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/
Microsoft says Kremlin-backed hackers accessed its source and internal systems | Ars Technica
Midnight Blizzard is now using stolen secrets in follow-on attacks against customers.
This is novel. There is a fundamental rule of cyber security which states that if a legitimate user can access a system, then a hacker can access that system by impersonating them.
New from 404 Media: hackers are doxing doctors, gaining access to drug ordering platforms then buying (and selling) massive quantities of oxy, Adderall, more. Not just series of breaches across industry, but fundamental undermining of prescription system https://t.co/BYSCADmNRV pic.twitter.com/wwwG6Pe1sO
— Joseph Cox (@josephfcox) March 7, 2024
1. Lots of unsurprising findings in the Kenova report. I will leave it others better qualified to judge how recommendations meet victims/families demands. But a few interesting segments on relations between MI5, the RUC / PSNI and military intelligence that, so far, stand out..🧵
— Edward Burke (@Edward__Burke) March 8, 2024
Thread by @Edward__Burke on Thread Reader App – Thread Reader App
@Edward__Burke: 1. Lots of unsurprising findings in the Kenova report. I will leave it others better qualified to judge how recommendations meet victims/families demands. But a few interesting segments on relations ...…
Fully automated vulnerability research is changing the cybersecurity landscape
— Jason D. Clinton (@JasonDClinton) March 8, 2024
Claude 3 Opus is capable of reading source code and identifying complex security vulnerabilities used by APTs. But scaling is still a challenge.
Demo: https://t.co/UfLNGdkLp8
This is beginner-level… pic.twitter.com/mMQb2vYln1
So inspired by this, I wanted to see how Claude would fare against a totally unknown format. In 2016 when I was teaching SWEN90006 for the first time, I gave students an assignment where I invented an input format, wrote a buggy interpreter for that format, and got students to 1/ https://t.co/ZQGHsSCKYv
— Toby Murray (@tobycmurray) March 9, 2024
Copy of the Operation Kenova Interim Report 2024:https://t.co/5YJv7qS3C4 https://t.co/XJC3qxBdHo
— Dr. Dan Lomas (@Sandbagger_01) March 8, 2024
CISA forced to take two systems offline last month after Ivanti compromise
Hackers breached the systems of the Cybersecurity and Infrastructure Security Agency (CISA) in February through vulnerabilities in Ivanti products, officials said.
This was so much fun. Thank you Adam! Love the pioneering work you're doing around identity and security at @NyedisIAM #l0pht #hackers #cDc https://t.co/k7tnEd7Sgr
— Pathfinder (@Pathfinder) March 8, 2024
Read about two seemingly unrelated vulnerabilities, a DoS hidden in JWTs and an oversight within the Linux kernel, that we found in open-source software. Tl;dr security assessments are more important than ever in 2024. https://t.co/QjM5jl5a32
— Trail of Bits (@trailofbits) March 8, 2024
Want to reverse engineer some shellcode doing dynamic API resolution through the PEB/TEB? Just use the _TEB type included in the Binary Ninja 4.0 windows platform types!https://t.co/a41UyRwNKA pic.twitter.com/jfEqx4dYS6
— Vector 35 (@vector35) March 8, 2024
In 1985, #KGB tasked its officers to collect info on the "studies of the potential use of arthropod & other insects for the artificial spread of infectious diseases for military purposes."
— Filip Kovacevic (@ChekistMonitor) March 8, 2024
For other KGB requirements regarding biological weapons, see https://t.co/dFjdl6IYLa. pic.twitter.com/tNo2V66Hh2
Scripting with IDA pro - IDA Pro and Hex-Rays Giveaway! https://t.co/u368dZVaRY
— Stephen Sims (@Steph3nSims) March 8, 2024
New by me @Forbes: Messages are either end-to-end encrypted or they’re not. And DMA interoperability means they’re not. WhatsApp has just warned as much—“we cannot make the same [e2ee] promise.” Thanks to @JakeMooreUK for thoughts. https://t.co/9SVj9eWDDG
— Zak Doffman (@UKZak) March 8, 2024