February 25, 2023

Sanctions against Russian entities

https://home.treasury.gov/news/press-releases/jy1296

Here are the ones which seem interesting (to me, anyway). Emphasis added.

0Day Technologies, a Moscow-based cybersecurity consulting firm, has provided databases of western nation citizens’ personally identifiable information to Russian intelligence.

Novilab Mobile, LLC, a Moscow-based software developer, has worked with U.S.-designated Russia-based company Advanced System Technology, AO (AST) on a project to enable mobile device monitoring. In April 2021, OFAC designated AST pursuant to E.O. 14024, E.O. 13694, E.O. 13382, and Section 224 of CAATSA for providing support to the FSB.

AO Russian High Technologies, a Russia-based information technology company, has worked on behalf of Russian intelligence services.

Forward Systems, R&DC, a Moscow-based computer programming and information technology company, has developed specialized software and algorithms in support of contracts with the Russian Federal State Unitary Enterprise (FGUP) 18th Central Scientific Research Institute (TsNII), which is part of the Russian Main Intelligence Directorate’s (GRU) efforts in offensive cyber operations.

ZAO Akuta, a St. Petersburg-based computer programming company, provided programming services for a telecommunications system for a new GRU facility in Russia.

OOO Lavina Puls (Lavina Puls) and AO Inforus (Inforus) have provided technical support to malign influence operations conducted by the GRU, including the management of false social media personas. The Kremlin has used these tools of malign covert influence to attack democracy in the United States, Ukraine, and around the world. Andrey Igorevich Masalovich (Masalovich), the head of Lavina Puls and Inforus, has worked to sell the internet monitoring and influence technology he designed for the GRU internationally.

This one seems particularly relevant following the reporting on “Team Jorge” and their AIMS tool.

-

Great thread

c0nc0rdance @c0nc0rdance

In 2018, "Parachute use to prevent death and major trauma when jumping from aircraft: randomized controlled trial" was published in the British Medical Journal. It sought to determine if wearing a parachute when jumping from a plane had any impact on survivability. It did not.

-

One of no doubt many retrospectives on the Year In Cyber War

https://cyberscoop.com/ukraine-russia-cyberwar-anniversary/

-

Jono @whoinvitedjon

Just found out that the same ball actor from Castaway also played the volleyball in the original Top Gun

https://www.wired.com/story/ukraine-war-autonomous-weapons-frontlines/

WIRED’s article on how having drones means that autonomous AI attack systems are next seems to skip a step or two. Autonomous attack systems are their own thing, their own development track. Drones are a platform that could be used for such systems, but vehicles and other systems are just as likely. Indeed, Russia claims they will be deploying tank killing robots. They’ve sent some prototypes to Ukraine already (according to Russian reporting.)

laundered1 @laundered11

The first four Marker robots have arrived in the region strictly on schedule. We begin downloading target images and testing algorithms of warfare within a unit of combat robots and installing powerful anti-tank armament,” Rogozin said.

eurasiantimes.com1st Batch Of Russia’s ‘Killer Robots’ Marker Arrives In Donbas To ‘Strike’ Ukraine’s Abrams & Leopard-2 TanksFirst batch of Marker combat robots arrived in Ukraine, days after Russia’s ex-space boss said that the combat robot would undergo a “baptism of fire”.

-

Kim Zetter @KimZetter

Russian spies posing as diplomats uncovered in Australia as part of counter-intel probe. Job of fake Russian embassy/consular staff was to recruit Australians with access to classified info and use SIGINT capabilities to steal data

smh.com.auFake Russian diplomats revealed as heart of ‘hive’ spy ringASIO would not name the country behind the spy operation but sources confirm it was run out of Russia’s embassy.

-

UK Proposes Even More Stupid Ideas For Directly Regulating The Internet, Service Providers

https://www.techdirt.com/2023/02/23/uk-proposes-even-more-stupid-ideas-for-directly-regulating-the-internet-service-providers/

-

Cornelius Aschermann @is_eqv

And a cursory glance seems to indicate between most (early days) and half-ish (now) of them are due to memory unsafety & integer overflows. Very interesting dataset from the "a large org tries everything to make C/C++/objC safe, what chance do I stand to get it right"-department.

Marcel Böhme👨‍🔬 @mboehme_

Software Security in Practice: It blows my mind that *despite* all mitigations, it usually takes less than 3 months from the release of a new iPhone to the first jailbreak. Makes me wonder how secure less well-known software systems really are and what we can do about it? https://t.co/l35dJyUUc0

tihmstar @tihmstar

@is_eqv Honestly, in practice “memory safety” isn’t what killed jailbreaks. You still have plenty of those bugs around and many are still exploitable.

tihmstar @tihmstar

@is_eqv The post-exploit protections are the real deal. 1) Harden kernel - immuteable kernel - kexec prevention (PAC/CFI) - Pagetable Protection Layer 2) Kernel enforced restrictions - sandbox - entitlements - process permission levels/layers

tihmstar @tihmstar

@is_eqv Because now an arbitrary kernel read/write (which you still can get) doesn’t give you much anymore. That’s the real deal, not some “memory safety” lol

-

Aaron Schaffer @aaronjschaffer

A CIA official was gifted two iPad Minis in Nov. 2021, and they were "destroyed," according to the latest disclosure of foreign gifts received by US officials govinfo.gov/content/pkg/FR…

Kim Zetter @KimZetter

In my Q&A today w/ former NSA hacker I describe how he gave UAE sheik laptops implanted with spyware to gift to foreign dignitaries. @aaronjschaffer recalls that U.S. Navy Vice Admiral John Miller once received an iPad Mini as a gift - which he retained for "official use only" 😲 https://t.co/EqZtQbD2k9

-

Sean Gallagher ⚡️🐀 @thepacketrat

Infosec advice often sounds like:

-

Joseph Cox @josephfcox

New: we proved it could be done. I used an AI replica of my voice to break into my bank account. The AI tricked the bank into thinking it was talking to me. Could access my balances, transactions, etc. Shatters the idea that voice biometrics are foolproof vice.com/en/article/dy7…

-

badidea 🪐 @0xabad1dea

TIL that at one point in ancient Egypt there was a fad for writing hieroglyphs with intentionally absurd puzzle logic like in a point and click video game

-

An overview of the wipers used in Ukraine. Slightly dated.

https://www.virusbulletin.com/conference/vb2022/abstracts/russian-wipers-cyberwar-against-ukraine/

-