June 16, 2022

Crazy story of the Indian police and hacking and all.

Thomas Rid @RidT

Absolutely wild story that has it all: hacking, an extraordinary integrity attack, with forged and planted evidence, (ethical) leaking to help expose (unethical) law enforcement active measures — and hugely creative, collaborative threat hunting

wired.comPolice Linked to Hacking Campaign to Frame Indian ActivistsNew details connect police in India to a plot to plant evidence on victims’ computers that led to their arrest.

-

Master of Shannanigans @fancy_4n6

How do you protect your yubikey?

-

https://taskandpurpose.com/culture/military-cybersecurity-competition-netwars/

-

Russian spy evicted from the Netherlands. Be sure to check out the PDF which contains his entire cover story, probably written by himself to help him memorise and review.

The Russian intelligence officer purported to be Brazilian citizen Viktor Muller Ferreira (born on 4 April 1989), when in fact his real name is Sergey Vladimirovich Cherkasov (born 11 September 1985). Cherkasov used a well-constructed cover identity by which he concealed all his ties with Russia in general, and the GRU in particular.

https://english.aivd.nl/latest/news/2022/06/16/aivd-disrupts-activities-of-russian-intelligence-officer-targeting-the-international-criminal-court

Full details of his cover story are included here:

https://english.aivd.nl/binaries/aivd-en/documenten/publications/2022/06/16/cover-identity-of-russian-intelligence-officer/Enclosed+document+with+cover+identity+of+Russian+intelligence+officer-English+version.pdf

-

Matthew Green @matthew_d_green

Wow. I did not realize that Intel sat on Hertzbleed from Q3 2021 to June 2022 without fixing anything. During this attack another set of authors independently scooped them. That’s pretty frustrating.

Luca De Feo @luca_defeo

@matthew_d_green Uh? If it's about our work, I would not call it scooping. We happen to have one algebraic technique in common, but the two works are substantially different, and I don't think our work appearing online has impacted the chances of Hertzbleed being accepted in any way.

-

https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/victory-reimagined/

And Dave Aitel’s review

https://cybersecpolitics.blogspot.com/2022/06/the-atlantic-council-paper-and.html

-

Tim Misiak @timmisiak

I finally got around to integrating the WinDbg disassembly window with the awesome disassembler that @wmessmer wrote. If you have symbols, it will resolve registers and memory locations to names. It also does some color coding on conditional/jumps/rets.

-

Corey Quinn @QuinnyPig

If you want knockoff @Cartier, your best option remains Amazon Basics.

Amazon News @amazonnews

Amazon’s Counterfeit Crimes Unit has stopped a social media influencer from selling knockoff @Cartier. The criminal concealed their iconic motifs & brand name as generic products in our store while promoting the fakes on social media—and was caught. https://t.co/0yIQIhfxAv

-

Mel Conway @conways_law

Every so often there will be a burst of Twitter conversations on the “Reverse Conway Manoeuver” and related topics. I find this encouraging, but not for a reason you might suspect. Hear me out; this is important. 1/28

-

Orca summer fashion included salmon hats.

Emma Luck @emmaluck22

The 1987 summer salmon-hat trend of the southern residents remains one of my favorite facts about this population

Much cooler than the chimp fashionistas’ grass-in-ear look, which is rather pedestrian *sniff*

https://www.smithsonianmag.com/smart-news/animal-fashion-some-chimps-are-putting-grass-ears-and-nobody-knows-why-180951888/

-

Soonson Kwon @ksoonson

Someone built a real tombstone of Internet Explorer in Korea. "He was a good tool to download other browsers." goo.gl/maps/7oCnRZJDz…

-

Tim Strazzere @timstrazz

Breaking Secure Boot on Google Nest Hub (2nd Gen) to run Ubuntu fredericb.info/2022/06/breaki… < what an awesome write up

fredericb.infoBreaking Secure Boot on Google Nest Hub (2nd Gen) to run UbuntuIn this post, we attack the Nest Hub (2nd Gen), an always-connected smart home display from Google, in order to boot a custom OS. First, we explore both hardware and software attack surface in search of security vulnerabilities that could permit arbitrary code execution on the device. Then, using a…

-

Matthew Green @matthew_d_green

Whenever someone says “7 figures” I’m like, honestly, that’s not even 128 bucks.

-

Alex Gantman @againsthimself

"Deputy U.S. Marshal Adrian Pena is accused of searching for cellphone locations of people with whom he had relationships, and their spouses."

washingtonpost.comAgent allegedly used law enforcement database to track acquaintancesA deputy U.S. marshal is accused of monitoring the cellphone locations of personal acquaintances through a law enforcement database — then lying about it when confronted.

-

Lukasz Olejnik @lukOlejnik

The Disinformation Code of Practice also speaks on deepfakes but not as a prominent issue. Indeed this non-issue is easy to solve. The Practice is much better than its 2018 precursor (analysed here blog.lukaszolejnik.com/european-ideas…). How to implement it is another story.

blog.lukaszolejnik.comEuropean ideas on fighting disinformation - want it fast or good?Today, disinformation is a broad problem touching national, international, and cyber security policies, as well as domains such as social sciences and technology, including technical cybersecurity and privacy. Different tactics are used by state and non-state actors, both internal and external. Vari…