April 23, 2022

Apr 23, 2022

Some cool retro computing

https://oldvcr.blogspot.com/2022/04/tonight-were-gonna-log-on-like-its-1979.html

That wild story about the guys impersonating secret service, or police, or something… and bribing various federal agents and such? It’s looking very scammy. They should probably get into crypto.

Brad Heath @bradheath

Fascinating story from @SarahNLynch -> One of the men who posed as a federal agent appears more swindler than spy, with a long trail of flashy living and unpaid bills. "Essentially I'm admitting I'm committing fraud to you... Delete this text please."

reuters.comEXCLUSIVE Washington man arrested for impersonating agent left trail of defaults and debtBefore Arian Taherzadeh was arrested for impersonating a U.S. law enforcement agent, he portrayed himself as a wealthy playboy who wore flashy watches, drove luxury cars and could afford sponsorships and VIP seats at Washington professional sports games.

Good RUSI report

RUSI @RUSI_org

🚨New RUSI report, 'Operation Z: The Death Throes of an Imperial Delusion' by @Jack_Watling and Nick Reynolds is out now! rusi.org/explore-our-re…

rusi.orgOperation Z: The Death Throes of an Imperial DelusionRussia’s military setbacks in Ukraine pose a new set of security challenges in Europe and beyond.

A philosophical discussion on threat actors and intelligence

Emiel Haeghebaert @EHaeghebaert

A colleague recently raised “the Ship of Theseus” as an apt analogy for attribution of cyber operations over time. The thought experiment asks: if a ship in a harbor has all its parts replaced one by one, can we still consider it the same ship? On this paradox, a brief 🧵 1/8

Crypto and lost money, except this time it’s not a scam!

foobar @0xfoobar

$34 million, or 11,539 eth, is permanently locked into the AkuDreams contract forever. It cannot be retrieved by individual users or by the dev team. The refund processing, which is complete, sets each bid status to 1.

Cannibal @Cannibal

Welcome to DFIR

Propaganda is bad, but telling your side of the story is good.

Karla Adam @karlaadam

Here’s a story about how U.K. intelligence came to tweet the lowdown on the war in Ukraine. With insights from @KeirGiles @PhillipsPOBrien @RoryCormac @JEyal_RUSI

washingtonpost.comHow U.K. intelligence came to tweet the lowdown on the war in UkraineUsually twice a day, the ministry tweets out a colorful blue graphic that summarizes its latest assessments about the state of play on the Ukrainian battlefield — where Russian troops are, what moves they’re making, which regions are most under threat.

The NYT looks at the other half of the cyberwar around Ukraine. The part where Russia is being ravaged.

https://www.nytimes.com/2022/04/22/us/politics/hackers-russia-cyberattacks.html

DJI drones are glitching out for Ukrainians but not, apparently, for Russians. The Ukrainians are replacing theirs with American drones. On the plus side, this means that blasting out DJI attacks will only impact Russia forces.

Martin SFP Bryant @MartinSFP

“Ukrainian officials have called for limiting the use of DJI drones, saying technical glitches in the company’s products may have been intentional by DJI to sabotage the country’s defense. They have also raised concerns about Russia’s successful use of DJI equipment.”

Techmeme @Techmeme

BRINC, Skydio, and other US startups are replacing DJI drones in Ukraine, following unexplained failures in the Chinese company's equipment during the war (@heathersomervil / Wall Street Journal) https://t.co/r6LBSIdnHN https://t.co/lzZjfbqjOZ

Just say no to user mode hooks.

Ptrace Security GmbH @ptracesecurity

RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. github.com/hlldz/RefleXXi… #Pentesting #CyberSecurity #Infosec

Just some windows hackery.

Florian Hansemann @CyberWarship

MultiPotato 'This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of...' #infosec #pentest #redteam github.com/S3cur3Th1sSh1t…

A good analysis of the state of the Russia Ukraine cyber war.

https://eclypsium.com/2022/04/06/march-firmware-threat-report-2022/

This is a cool film about how London is used for money laundering.

https://www.ft.com/video/d3bafb94-9dbd-4c1e-8016-8cd8331960f1

Contextually within the framework of “where’s the cyber war?” this observation about food supply chain logistics is a very relevant data point.

Kevin Beaumont @GossiTheDog

I helped install their IT systems, and managed their cybersecurity. Things I learnt - they were our most attacked business unit. Threat actors loved sunflower oil, as it had big single points of failure in supply chain. I wrote about one attempt here:

medium.comThe great Olive Oil hackOn Tuesday 23rd February 2015, an employee at a food company who handles olive oil received an email about olive oil:

The cyberwar apparently features a lot of successful defence operations. The Russian attacks fail, nothing makes the news, and so the pundits continue to downplay cyber.