July 17, 2022

Good analysis on problems with the phrase “zero trust.” It’s not the best for getting buy in from end users, and why that matters.

https://code.mendhak.com/zero-trust-poor-choice-of-words/

-

Dagger-4 Seasons Total Landscaping @dagger0621

“We got hired to make a cover for All Quiet on the Western Front. Anyone here read the book and want to tackle it?” “I’ve read the title” “Good enough”

-

https://acoup.blog/2022/07/15/collections-logistics-how-did-they-do-it-part-i-the-problem/

-

Shivam Bhatt @elektrotal

-

BedlamDaughterOfLoki @BedlamLoki

""" >deploy new BGP configuration >leave for lunch >get free cheesesteak because payment system down """

-

While compromising SOHO routers as an access vector to gain access to an adjacent LAN is not a novel technique, it has seldom been reported," Black Lotus Labs researchers wrote. "Similarly, reports of person-in-the-middle style attacks, such as DNS and HTTP hijacking, are even rarer and a mark of a complex and targeted operation. The use of these two techniques congruently demonstrated a high level of sophistication by a threat actor, indicating that this campaign was possibly performed by a state-sponsored organization

Brazil has had extremely sophisticated router hacking attacks for the better part of a decade. I’ll grant that they’re not state level sophisticated, but it is false to claim that this methodology is rare.

https://arstechnica.com/information-technology/2022/06/a-wide-range-of-routers-are-under-attack-by-new-unusually-sophisticated-malware/

Original:

https://blog.lumen.com/zuorat-hijacks-soho-routers-to-silently-stalk-networks/

-

Mobile Security @mobilesecurity_

Lock Screen Bypass Exploit of Android Devices (CVE-2022–20006) #MobileSecurity #AndroidSecurity by Joshua Nearchos

link.medium.comLock Screen Bypass Exploit of Android Devices (CVE-2022–20006)Background on Lock Screen Bypass Exploits

-

The dogs face is blurred! lol

Christo Grozev @christogrozev

This is Gen. Andrey Ilchenko, a senior GRU officer in charge of 8 years of creating fakes about MH17, including attempts to tail, hack and discredit independent researchers like @bellingcat. Still not sanctioned by any Western country.

-

WILL AI STEAL SUBMARINES’ STEALTH?

Better detection will make the oceans transparent—and perhaps doom mutually assured destruction

https://spectrum.ieee.org/nuclear-submarine

-

Jerry Gamblin @JGamblin

Spent some time today playing with Micorosfts SBOM tool, and it is a good first start.

github.comGitHub - microsoft/sbom-tool: The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any vari…The SBOM tool is a highly scalable and enterprise ready tool to create SPDX 2.2 compatible SBOMs for any variety of artifacts. - GitHub - microsoft/sbom-tool: The SBOM tool is a highly scalable and...

-

-

Rey Bango 🇺🇦🌻 @reybango

Google Play hides app permissions in favor of developer-written descriptions “You alone are responsible for making complete and accurate declarations in your app’s store listing on Google Play.” 😜 arstechnica.com/gadgets/2022/0…

arstechnica.comGoogle Play hides app permissions in favor of developer-written descriptionsLet’s hope nobody lies about what permissions their app uses.

-

Exploring the XBAND Video Game Modem and Executing Arbitrary Code Over a Phone Line in 2022

https://fresh-eggs.github.io/xband_post.html

-

-

The technology involved in making a scary surveillance filled future is quite impressive.

https://thepointsguy.com/news/personal-flight-information-display-dtw/

-

raptor @0xdea

Great article as usual by @SonarSource: Remote Code Execution via Prototype Pollution in Blitz.js blog.sonarsource.com/blitzjs-protot…

-

Priya Chalakkal @priyachalakkal

We are super excited to open our Call for Talks/Trainings for ShaktiCon 22/23. If you are a women in the field of security, you are invited to join us in this mission to empower, and inspire women to join the field of cyber security. Checkout

shakticon.comAmrita ShaktiCon - CyberSecurity Conference, Trainings & Competition for WomenParticipate in Amrita ShaktiCon, cyber security conference, trainings and competitions for women, organized by team Shakti.

-

Juneau @Jun34u_sec

She’s a 10 but CVSS says she’s a 6.3

-

Shodan @shodanhq

The Shodan Membership is on sale now for $5 until the end of Sunday, July 17th (GMT): account.shodan.io/billing/member

-

Andrew Nadeau @TheAndrewNadeau

The most realistic part of the Jurassic Park series is nobody learns a lesson ever. They just keep making the same mistakes over and over again. If anything they get stupider.

-

return of the Lloyd @entertheLloyd

Throwing bags of fentanyl out the window during a police chase and the cops start spinning out and crashing like Mario Kart