March 30, 2023

Between Two Nerds: The Real Problem with TikTok

The best podcast has released another episode.

https://risky.biz/BTN30/

-

Google finds more Android, iOS zero-days used to install spyware

https://www.bleepingcomputer.com/news/security/google-finds-more-android-ios-zero-days-used-to-install-spyware/

-

Joseph Cox @josephfcox

New: for years instead of getting a warrant, the DEA paid rogue employees inside U.S. airline, bus, and parcel private companies for access to reams of customer data. Bypassed the courts and simply bought info instead. Senators now trying to stop it.

vice.comThe DEA Bought Customer Data from Rogue Employees Instead of Getting a WarrantFor years the DEA has used paid informants inside airline, bus, and parcel companies to bypass needing to get a warrant. A pair of bipartisan Senators now want the DOJ to put an end to it.

-

-

Dr. Dan Lomas @Sandbagger_01

Adding to the reading pile 👀 rusi.org/explore-our-re…

rusi.orgPreliminary Lessons from Russia’s Unconventional Operations During the Russo-Ukrainian War, February 2022–February 2023An early analysis of the evidence sheds light on Russia’s unconventional operations in its war against Ukraine.

-

yoshimi battles the xiaofenhong @nise_yoshimi

love those PLA side hustles

-

Aaron Bateman @aaronbateman22

Just finished Bruce’s book on undersea cable telegraphy and I’m pleased to say it is a great read. Undersea cable telegraphy is such a fascinating topic and there’s so much more work to be done on this subject.

Aaron Bateman @aaronbateman22

Super excited to dive into Bruce Hunt’s book on cable telegraphy and electrical physics in the Victorian British Empire https://t.co/3C6ZWxzNC4

-

Adam Segal (@adschina@mastodon.social) @adschina

China's Nuclear Energy Sector Targeted in Cyberespionage Campaign  - SecurityWeek

securityweek.comChina’s Nuclear Energy Sector Targeted in Cyberespionage CampaignA South Asian espionage group named Bitter has been observed targeting the Chinese nuclear energy sector.

-

So it turns out that police can touch fentanyl without having a seizure.

Jonah Owen Lamb @jonahowenlamb

Here is our story

sfstandard.comSJ Police Union Exec Accused of Smuggling Drugs as Wedding Gifts, Makeup, ChocolateThe executive director of San Jose’s police union allegedly used staff equipment to ship pills across the country.

-

Dominic White 👾 @singe

New WiFi vulns that downgrade power save buffered frames! As always @vanhoefm has usable code ready to go, this time without limitations to specific atheros cards. The readme is also super accessible if you aren’t the type to read the paper.

github.comGitHub - vanhoefm/macstealerContribute to vanhoefm/macstealer development by creating an account on GitHub.

-

vx-underground @vxunderground

MacOS malware expert @patrickwardle has been covering the MacOS variant of the 3CX VOIP supply chain attack. Additionally, we have managed to get our hands on the MacOS variant. Download: share.vx-underground.org

Patrick Wardle @patrickwardle

RE: The 3CX VOIP supply chain attack, vendors have stated that macOS was also targeted - but I couldn't find any specific technical details (yet) 🍎🐛☠️ One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized" ...let's dive in! 1/n 🧵

-

Basharath @wahVinci

Backend dev doing CSS

-

Dan Black @DanWBlack

Thrilled to see my new @IISS_org paper covered here alongside an excellent report from @MsftSecIntel on recent GRU activity.

economist.comRussian hackers are preparing for a new campaign in UkraineA spring cyber-offensive is about to be unleashed

-

Dr. Dan Lomas @Sandbagger_01

nzherald.co.nzSoldier accused of spying: Hearing to restart in closed court after year-long delaySoldier facing 17 charges of espionage and attempting to commit espionage.

-

Dr. Dan Lomas @Sandbagger_01

salon.comExclusive: Declassified report suggests “Havana syndrome” could result from energy weaponFull intelligence report contradicts official claims that strange cluster of ailments wasn’t caused by attack

-

Dr. Dan Lomas @Sandbagger_01

"It is evident that the Russian special services managed to recruit a large agent network in Ukraine ... and that much of the support apparatus has remained viable after the invasion, providing a steady stream of human intelligence to Russian forces".

bbc.co.ukRussian spies more effective than army, say expertsRussia’s intelligence services have had more success in Ukraine than its army, says a top think tank.

-

Halvar Flake @halvarflake

There is a fallacy in the "AI will cause unemployment" discussion that employment is related to the amount of work that needs to get done. This is not actually the case. Employment in large orgs is more driven by resource allocation politics than actual work.

-

“When the police hit you with teargas but you still need to smoke”

Vincent Dain @v_dain

📸 Le calme pendant la tempête. Rennes, 23 mars.

-

Jon @Jontafkasi

Head of cyber for the treasury of Britain. £57k

-

Mehran Jalali @mehran__jalali

I emotionally manipulated GPT-4 into revealing its prompt

-

Rich (me/acc) 🍀 @Duderichy

somewhere on Wall Street there is a computer like this running an excel spreadsheet where if someone shuts the lid the whole world economy comes to a halt https://t.co/M6zdiC75Qa

Jed Bridges @JedBridges

If you see this at work your company is gonna be worth a billion dollars https://t.co/H55CyiAwdW

Jonathan 🇿🇦🇺🇦 @JonoCoetzee

@Duderichy @thegrugq I know of a bank in my home country that had an outage and couldn't take on new clients because they reached the maximum number of lines in an Excel file (at the time at least)🙈

-

Hillai Ben-Sasson @hillai

I hacked into a @bing CMS that allowed me to alter search results and take over millions of @Office365 accounts. How did I do it? Well, it all started with a simple click in @Azure… 👀 This is the story of #BingBang 🧵⬇️

BingBang: The AAD misconfiguration that led to Bing.com results manipulation and account takeover explained

https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration

-

A Q&A with the hacktivists rocking Latin America: Guacamaya

https://therecord.media/interview-with-guacamaya-hacktivist-group-latin-america

-

Jack Grieve @JWGrieve

Really happy to announce that @helenawoodfield's and my new book 'The Language for Fake News' has finally been published by @CambUP_LangLing! Please check it out! It's a quick read and can be downloaded in full for free (forever)! doi.org/10.1017/978100… A thread...

-