May 22, 2022

Great observation

Justin Troutman @justintroutman

Teaching cryptography to non-cryptographers has been most enlightening for students, and me, when we approach it from purpose: cryptography isn't useful because of what it does; it's useful because of what it makes possible. It's there to bolster what matters.

-

Phones are very complex devices.

Catherine @whitequark

i'm amused by this journalist discovering that the equipment required to reliably repair a modern cellphone is, in fact, complex, heavy, and expensive

theverge.comApple shipped us a 79-pound iPhone repair kit to fix a 1.1-ounce batteryNobody should do it this way.

-

Offensive deception. Always cool

Kate Pearce @secvalve

"Gaslighting With Honeypits And Mirages: Destroying Discovery To Deplete Attackers" [Slides] We made a reproducible vulnerability just for you - and nobody else gets it Oh, and i can get attackers to crack hashes for me.

-

The West should make a Marshall Plan for Ukraine when the war is over. Not just restore the country but improve it.

https://foreignpolicy.com/2022/05/20/ukraine-front-line-economy-loans-resources-russia-war/

-

Get your ACM on…

@mikko @mikko

As a part of ACM’s 75th anniversary celebrations, ACM is opening up a large portion of its archives, making the first 50 years of its published records—more than 117,500 documents dating from 1951 to 2000—accessible to the public without a login: dl.acm.org

-

This is definitely a Law (h/t @evacide)

EFF @EFF

We've learned this lesson before. Maybe we should just call it the Amazon Ring Hypothesis: Absent strict protections, any sensors that collect data and footage about people will eventually become a tool of police surveillance--even self-driving cars. 

vice.comSan Francisco Police Are Using Driverless Cars as Mobile Surveillance Cameras“Autonomous vehicles are recording their surroundings continuously and have the potential to help with investigative leads,” an internal training document states.

-

Alexander Popov @a13xp0p0v

I believe that detecting kernel vuln post-exploitation and illegal privilege escalation is impossible from inside the Linux kernel. PoC by @wipawel demonstrates that. My PoC exploit for CVE-2021-26708 bypassing LKRG @lkrg_org also demonstrates that: a13xp0p0v.github.io/2021/08/25/lkr…

Pawel Wieczorkiewicz @wipawel

@tgraf__ @Fire30_ @paxteam @yuvalavra @_minipli @_fel1x So, I now have a version of that exploit with a small modification (~10 lines) that bypasses and disabled tetragon checks entirely. ¯\_(ツ)_/¯ https://t.co/yPQWCWdZ35

-

OPSEC!

Michael A. Horowitz @michaelh992

A story in two parts: First part a #Russian reported excitedly reports on the Russian army shelling Ukrainian position using a 2S4 Tyulpan self-propelled mortar, revealing its position

-

Job security for life.

Greg Poirier @grepory

I'm kind of excited about this next paper: On The Relation Between Outdated Docker Containers, Severity Vulnerabilities and Bugs arxiv.org/pdf/1811.12874…

-

Good coverage of how Ukraine is conducting a sort of total war. They have a lockdown on casualty information. The army has their tank recovery capacity augmented by farmers with tractors. The Russian military is constantly under surveillance by civilians who report everything to the intelligence services. The Ukrainian app for most government functions allows uploading photos and videos. (As I understand anyway)

The problem is that when civilians do military jobs during war they are exposed to new risks such as being unlawful combatants, or spies. Given the dynamics of the conflict it is probably not a huge change, the Russians don’t seem to be adhering to the laws of war anyway. Still. Something to keep in mind

https://warontherocks.com/2022/05/intelligence-and-the-war-in-ukraine-part-2/