July 8, 2022

All warfare is based…

— Sun Tzu

-

Argha 🏏 📚 💻 @StringsVsAtoms

“Laws can change. Social rules can change. The perfectly harmless conversation you had yesterday might come back to hurt you years from now,” says @matthew_d_green. “Encryption is just a way to give digital communications the same basic protections.”

wired.comEnd-to-End Encryption’s Central Role in Modern Self-DefenseWith abortion set to be criminalized in more than half the US, encryption has never been more important for protection—and civil disobedience.

-

The AN0M backdoored secure phone was sending a copy of every message to an account “bot@“ on the LEA controlled XMPP server. Interestingly they included the GPS coordinates when the message was sent. That’s clever. The article doesn’t mention which open source client was modified, but 10:1 it was Conversations, because that’s the base client for everyone doing encrypted XMPP on Android.

https://www.vice.com/en/article/v7veg8/anom-app-source-code-operation-trojan-shield-an0m

-

-

Jake Kwon @JakeKwon88

Facing soaring inflation, a Japanese zoo has resorted to offering cheaper fish to its sea animals. The penguins are very unimpressed, refusing to even look at them. The otters are throwing the offerings aside.

-

Catalin Cimpanu @campuscodi

TripleCross is a Linux eBPF rootkit that demonstrates the offensive capabilities of the eBPF technology. github.com/h3xduck/Triple…

-

Tony "Abolish ICE" Arcieri 🦀🌹 @bascule

This is epic: the creators of Rainbow signatures claimed they offered a crypto contest with a $400,000 prize for breaking them, even after a paper had been published demonstrating a breakage. Someone took them up on their offer… groups.google.com/a/list.nist.go…

-

Cybergibbons @cybergibbons

One of my favourite physical access jobs to a datacenter involved toilets. Let me explain. I needed to gain access from the less-secure side of a sub basement floor to the more-secure side. General office space to data centre.

-

“without” (ignore the typo, this is the best take)

James Forshaw @tiraniddo

The Apple "Lockdown mode" does sound interesting. But what would really be a game changer would be system transparency so you could actually inspect your iOS device with jailbreaking it. After all how can you verify lockdown mode hasn't been tampered with?😐

-

Five Individuals Indicted for Crimes Related to Transnational Repression Scheme to Silence Critics of the People's Republic of China Residing in the United States

Defendants Include Federal Law Enforcement Officer and Private Investigator Who Lied to FBI Agents and Obstructed Justice

ACAB

https://www.justice.gov/usao-edny/pr/five-individuals-indicted-crimes-related-transnational-repression-scheme-silence

-

Another user land rootkit. Again, people, this stuff is not impossible to detect. It fails if you use busybox to hunt for it.

https://www.intezer.com/blog/incident-response/orbit-new-undetected-linux-threat/

I wrote about this last month.

Userland Rootkits are Lame

-

Raphael Satter @razhael

I’m reading Martyn Gregory’s “Dirty Tricks,” which describes British Airways’ spy campaign against Virgin Airlines in the late 80s and early 90s. I was surprised to find that, more than three decades ago, there was also a strong cyberespionage angle.

-

Alex Clemmer 🔥🔥🔥😅🔥🔥🔥 @hausdorff_space

A colleague tells the story about how he trained a bunch of bots on departed Etsy employees and put them in the #purgatory IRC channel. And that was fine until they learned the chatops commands and became an existential threat to etsy.com

gist.github.comMarkov Chat Bot Disaster StoryMarkov Chat Bot Disaster Story. GitHub Gist: instantly share code, notes, and snippets.

-

HostileSpectrum @HostileSpectrum

The latest Predatory Sparrow hack & leak op represents a fascinating milestone, in that it sets groundwork to justify further actions against entities that meet sanctions criteria. Providing its own evidence taken directly from the regime’s own security services networks.

Gonjeshke Darande @GonjeshkeDarand

Today, we are exposing for the first time, top secret documents and tens of thousands of emails from these companies on their customers and trading practices as evidence of these companies’ affiliation with the IRGC. Link to first part of this #exposure:

mega.nz19.76 GB file on MEGA

-

daphne is on summer hiatus @daphnekylee

Learned a very relatable term today: “報復性熬夜” (revenge bedtime procrastination), a phenomenon in which people who don’t have much control over their daytime life refuse to sleep early in order to regain some sense of freedom during late night hours.

-

Roundup of Secure Messengers with Off-The-Grid Capabilities (Distributed/Mesh Messengers)

https://changelog.complete.org/archives/10205-roundup-of-secure-messengers-with-off-the-grid-capabilities-distributed-mesh-messengers

Followup:

The Hidden Drawbacks of P2P (And a Defense of Signal)

https://changelog.complete.org/archives/10216-the-hidden-drawbacks-of-p2p-and-a-defense-of-signal

-

Detecting Deepfake Video Calls Through Monitor Illumination -

https://www.unite.ai/detecting-deepfake-video-calls-through-monitor-illumination/

-

JP Aumasson @veorq

Attempt to explain ZK proofs at @EuskalHack (slides at aumasson.jp/data/talks/eus…)

-

Ciaran Martin @ciaranmartinoxf

In this brilliant ⁦@guardian⁩ article ⁦@ProfWoodward⁩ does much more than review Channel 4’s #theundeclaredwar. He actually explains how operational cyber defence works

theguardian.com‘Some staff work behind armoured glass’: a cybersecurity expert on The Undeclared WarHow realistic is Peter Kosminsky’s Channel 4 drama about an IT attack on the UK? Very, according to one of the UK’s top digital intelligence experts

-

Vincent Manancourt @vmanancourt

The EU’s top court says mass surveillance is banned. Governments do it anyway. My story for POLITICO’s #LawlessEurope series.

politico.euEurope’s state of mass surveillanceThe EU’s top court says mass surveillance is banned. Governments do it anyway.