August 4, 2022

Cyber Intelligence: Strategic Warning Is Possible

https://www.tandfonline.com/doi/full/10.1080/08850607.2022.2095544

Here’s my problem with this, right off the bat before reading the paper — the assumption that there are strategic cyber attacks in the same sense as “Pearl Harbor.” That is, “cyber Pearl Harbor by any other name…”

I just don’t believe the threats within the cyber strategic environment are fundamentally cyber Pearl Harbor type threats. In the cyber domain rewards accrue from constant operations. Big spectacular cyber effects operations aren’t impossible (see Predatory Sparrows, for example), but they’re probably not as important as the daily grind.

As a State on the defense, it would be embarrassing to be Pearl Harbored, but it’s constant drumroll of Conti and their ilk that is the real strategic cyber threat being ignored. It is the daily ransomware raids that inflict damage.

And the idea of a warning, what would it accomplish? When, exactly, are we supposed to lower our shields? If we dial up security when do we dial it down? What exactly is this dialing up, anyway?

What exactly is a cyber attack warning supposed to do? Of course Anthem, OPM, United, Exquifax, SolarWinds, etc etc are strategic (in different ways), but what good could a warning have done? SolarWinds was the chosen access vector, but they’re not the only option. Could the OPM data have been secured in any meaningful way given that it was held on an unclassified network?

What’s the fear of an attack against the electrical grid compared to the reality of increased mortality rates due to ransomware attacks against hospitals? [1][2]

You don’t need strategic warnings about possible cyber attacks, you need hospitals to be resilient against the existing level of attacks. The ones that, apparently, aren’t a strategic threat!

[1]https://www.cisa.gov/sites/default/files/publications/CISA_Insight_Provide_Medical_Care_Sep2021.pdf

[2]https://www.beckershospitalreview.com/cybersecurity/ransomware-attacks-and-patient-mortality-8-things-to-know.html

-

I’ve yet to read it, but here’s another post in the ongoing discussions on the theory of cyber

Lennart Maschmeyer @LenMaschmeyer

New post out in @lawfareblog in response to @Jason_Healey 's recent piece where I clarify why the strategic limitations of cyber operations apply across different strategic contexts and uses. (1/2)

lawfareblog.comThe Subversive Trilemma in Cyber Conflict and BeyondCyber Operations can be used in many strategic contexts, yet because they rely on secret exploitation they are invariably subject to the trilemma. Consequently, cyber operations tend to become less effective—and thus less attractive options—the more important and urgent the strategic goals are that…

-

Faig Ahmed @FaigAhmed

Wave Function A wave function in quantum mechanics is a description of the quantum state of a system.

-

Correction on the GitHub “hack” incident in yesterday’s August 3rd newsletter.

GitHub Security @GitHubSecurity

GitHub is investigating the Tweet published Wed, Aug. 3, 2022: * No repositories were compromised * Malicious code was posted to cloned repositories, not the repositories themselves * The clones were quarantined and there was no evident compromise of GitHub or maintainer accounts

-

Technology and the transformation of reality.

https://stratechery.com/2021/internet-3-0-and-the-beginning-of-tech-history/

-

CyberScoop @CyberScoopNews

A #hacktivist collective posted more than 2 terabytes of hacked emails and files from a host of #mining companies in Central and South America Wednesday, in move to apparently expose #environmental damage in the region, reports @AJVicens.

cyberscoop.comEnvironmental hacktivists publish 2 terabytes of mining company emailsThe group called Guacamaya posted files from public and private mining companies and public agencies responsible for environmental oversight.

-

Johnny McNulty @JohnnyMcNulty

I have transferred the data that was on your cell phone and which you were probably hiding from prosecution Forgive me they were incriminating so guilty and so many

Grant Brisbee @GrantBrisbee

Alex Jones' lawyer

brendle @brendlewhat

Hello sir, I-*briefcase full of jellybeans falls open*

Context: Alex Jones’ lawyer sends a copy of his phone to the opposition lawyer. https://www.theguardian.com/us-news/2022/aug/03/alex-jones-sandy-hook-shooting-defamation-trial

-

Have I Got News For You @haveigotnews

New series of Big Brother receives 50 million applications after producers confirm that the house will have food and central heating.

John Carroll |  @YoSignals

-

Marcus Hutchins @MalwareTechBlog

Apparently a crypto wallet provider was inadvertently logging seed phrases to their event logging server, which lead to someone being able to hack and drain over 8,000 wallets 😬

Zellic @Zellic_io

4/ The Slope Wallet for iOS and Android uses Sentry for event logging. Any interaction in the app would trigger an event log. Unfortunately, Slope didn't configure Sentry to scrub sensitive info. Thus, mnemonics were leaked to Sentry s/o to @sniko_ for this screenshot: https://t.co/Rs7pEvVGsJ

foobar @0xfoobar

Solana hack - looks like the Slope wallet sent plaintext seed phrases to external integration partners. Compromised Phantom wallets came from seed phrase imports used in Slope. Compromised ETH wallets were also from seed phrase reuse. Not a blockchain or randomness issue.

The rule for crypto hacks is: ‘Who did this, and why is it the devs?’ — Laurence Day

taha | 🦇 @lordx64

So the #slope #wallet is more like an insider threat, rather than supply chain hack, or else. I saw this traffic yesterday (see timestamp) going SSL encrypted to slope servers o7e.slope.finance but I was like nah that can't be malicious but indeed it have the seed phrase..

-

Mick Ryan, AM @WarintheFuture

The aggressive behaviour of China, the PLA and the Eastern Theatre Command, as shown in this graphic, will provide valuable insights into Chinese military thinking and capacity in the days ahead. 1/14 🧵

-

g a b y @gabydvj

last July, I traveled to southern Arizona during the deadliest time of year for migrants to figure out what was causing a rise in fatalities at the border. it’s not just the desert; it’s surveillance.

theverge.comThe Most Surveilled Place in America“The idea is that if enough people get hurt, they’ll stop coming.”

-

China has an offensive cyber tool framework as well!

https://blog.talosintelligence.com/2022/08/manjusaka-offensive-framework.html?m=1

-

Matt Suiche @msuiche

When people ask me why I find crypto scams so interesting…

khaleejtimes.comTinder swindler: UAE resident looking for second wife loses life’s savings to crypto scamDad-of-five Sajjad Khan had set aside the money to buy his dream house

-

MalwareHunterTeam @malwrhunterteam

😂

-

OmnesViae: Roman Routeplanner

a reconstruction of an antique Roman map with internet technology

https://omnesviae.org

-

anton lestrange @huge_mclarge

22 yrs old: falls down stairs on way to work. gets up and is fine. 42 yrs old: sleeps on the wrong pillow, neck hurts for 3 weeks.