June 30, 2022

Rolf Degen @DegenRolf

Landmark psychology experiment that indicated how easy it is to plant false memories in people's minds about getting lost in a shopping mall as a child passes the replication test with flying colors. psyarxiv.com/nh3zq/

-

Janggggg @testanull

CVE-2022-23277 Can't believe it works on Exchange Server (was patch in March)! Just use the same PoC of Tianfu patch with different gadgetchain to make it work! p/s: also saw the patch in Sharepoint May patch but can't find any related document yet🤔

Code White GmbH @codewhitesec

Bypassing .NET Serialization Binders: case studies for DevExpress (CVE-2022-28684) and Microsoft Exchange (CVE-2022-23277) by @mwulftange https://t.co/G90Qg7gQ9m

-

https://consilienceproject.org/technology-is-not-values-neutral/

-

-

Brendan Carr @BrendanCarrFCC

TikTok is not just another video app. That’s the sheep’s clothing. It harvests swaths of sensitive data that new reports show are being accessed in Beijing. I’ve called on @Apple & @Google to remove TikTok from their app stores for its pattern of surreptitious data practices.

-

Horizon3 Attack Team @Horizon3Attack

Check out a recent finding by one of our own, Naveen Sunkavally. CVE-2022-28219 is an unauth RCE for ManageEngine ADAudit Plus. This XXE -> Deserialization chain often leads to host compromise as well as priv'd AD creds. Check out the blog post and POC:

horizon3.aiCVE-2022-28219: Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit PlusCVE-2022-28219 is a unauthenticated remote code execution vulnerability affecting Zoho ManageEngine ADAudit Plus, a compliance tool used by enterprises to monitor changes to Active Directory. The vulnerability comprises several issues: untrusted Java deserialization, path traversal, and a blind XML…

-

Adam Segal @adschina

More attribution from Global Times and private security firm: Exclusive: US plants Trojan horse programs in hundreds of important Chinese information systems; new cyber weapon targets China, Russia

globaltimes.cnExclusive: US plants Trojan horse programs in hundreds of important Chinese information systems; new cyber weapon targets China, RussiaOn Wednesday China’s official virus emergency response office and leading cybersecurity company disclosed a new vulnerability attack weapon platform deployed by the US National Security Agency (NSA), which cybersecurity experts believe is the main equipment of the NSA’s computer network hacking oper…

Technical write up (Chinese):

https://www.cverc.org.cn/head/zhaiyao/news20220629-FoxAcid.htm

English here

https://www.cverc.org.cn/head/zhaiyao/FOXACID.pdf

-

Zach Dorfman @zachsdorfman

“Minions: The Rise of GRU” sounds very much like a book I’d like to read on a subject quite different than the movie

-

-

Joseph Cox @josephfcox

New: police arrested a man called "Paul K" in the Caribbean, suspected of being behind the encrypted phone firm Encrochat. Police previously hacked and arrested thousands of Encrochat users We can now add that Paul K is Paul Krusky, based on emails, more

vice.comCops Investigating ‘WhatsApp for Gangsters’ Arrest Key Suspect in CaribbeanPaul Krusky played a crucial role in the development of encrypted phone firm EncroChat. Now he has been arrested in the Dominican Republic.

-

https://www.cossacklabs.com/blog/cryptographic-failures-in-rf-encryption/

-

FBI warning about deepfakes being used to mask ppl applying for jobs.

https://www.theregister.com/2022/06/29/fbi_deepfake_job_applicant_warning/

-

The Intercept @theintercept

Cryptocurrency titan Coinbase providing “geo tracking data” to ICE interc.pt/3byTLlg by @samfbiddle

interc.ptCryptocurrency Titan Coinbase Providing “Geo Tracking Data” to ICEICE is now able to track transactions made through nearly a dozen different digital currencies, including Bitcoin, Ether, and Tether.

-

Byron Wan @Byron_Wan

🇨🇳 PLA is placing orders for AI chips designed by US companies and manufactured in Taiwan and South Korea. Of the 97 individual AI chips identified in public PLA purchase records, nearly all were designed by Nvidia, Xilinx (now AMD), Intel, or Microsemi. cset.georgetown.edu/publication/si…

cset.georgetown.eduSilicon Twist - Center for Security and Emerging TechnologyThe Chinese military’s progress in artificial intelligence largely depends on continued access to high-end semiconductors. By analyzing thousands of purchasing records, this policy brief offers a detailed look at how China’s military comes to access these devices. The authors find that most computer…

-

The Kaliningrad trouble, that is a European country blocking Russia’s access because of sanctions, is also an issue in Scandinavia. Yay!

Russia is a signatory of the Spitsbergen treaty from 1920 that makes Svalbard part of Norway, but guarantees some rights for residents of the Svalbard archipelago (way up in the arctic.) Now the Russians are upset about the way that Norway is apply sanctions.

SwitHak (👁) @SwitHak

🇷🇺💥🇳🇴 Svalbard (Spitsbergen is the old name before the 1920 treaty) 🔥 point 1/ ⬇️

-

The Times @thetimes

A pair of killer whales who have developed a taste for the livers of great white sharks appear to have transformed an ocean ecosystem in South Africa

thetimes.co.ukGreat fright: sharks fleeing hungry orcasA pair of killer whales who have developed a taste for the livers of great white sharks appear to have transformed an ocean ecosystem in South Africa, scientis

-

Click me…! The influence of clickbait on user engagement in social media and the role of digital nudging

https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0266743

-

Danny 🌻 @dadamitis

This morning we’re releasing our latest research today on an router campaign we’re calling ZuoRat.

blog.lumen.comZuoRAT Hijacks SOHO Routers to Silently Stalk Networks - LumenBlack Lotus Labs, is currently tracking elements of what appears to be a sophisticated campaign leveraging infected SOHO routers to target predominantly NA and European networks of interest.

-

francis wolf @francisxwolf

someone forgot to google

-

raptor @0xdea

Golang code review notes: Quick summary of some of the bug classes in Go

elttam.comGolang code review noteselttam is an independent security company providing research-driven security assessment services. We combine pragmatism and deep technical insight to help our customers secure their most important assets.

-

matt christman @cushbomb

The American version of finding a Roman bath while digging up a Tesco car park. https://t.co/JOvAMOaMXN

Jeze3D.exe v2.2.1 @RealJezebelley

A fully intact vintage Burger King was found behind a wall at the Concord Mall in Wilmington, DE. This photo was snapped by Jonathon Pruitt April of 2022. https://t.co/G3V3SnJM3J

-

elliott @ellx_tt

oh no :(

-

Doctrine Man @Doctrine_Man

"Join Space Force!" they said. "It'll be the adventure of a lifetime."

-

kie @kieransofar

woah apple, spoilers

-

First time an officer of 8200 has spoken to the public that was not an announcement for a startup!

VIDEO — it was here but has been made private.

I’m wondering what it means to have 70% of your force under 23yr old. Firstly, it means that they’re all 22.95. But what does it mean to have cyber without deep experience? Maybe that’s good for a high friction environment where new techniques are needed constantly. Idk, I’m biased towards old age and treachery.

-

Metlstorm @Metlstorm

The more things change 😭 https://t.co/lDyDIhyocq

Metlstorm @Metlstorm

Jeez the @kawaiiconnz hackers may be all cutesy-wutesey but they still have no mercy .... a unrinal. Who hacks a urinal? URINALS WITH CAMERAS AND TEAMVIEWER!? And I thought last year was a dystopian hellscape. Save us #kawaiicon #purplecon SAVE US HECKING PLZ https://t.co/CMhkCFsEXI