May 30, 2022
Polish LARPers play contemporary Americans.
In Poland, there is a LARP group that roleplays as contemporary Americans. Here they are doing βOhio.β
-
Using Twitter for threat intel.
-
The UK should scrap its terrible very bad idiotic Online Safety bill.
https://www.economist.com/leaders/2022/05/26/britain-should-scrap-its-online-safety-bill
-
Signs of Russian cyber coordinating with kinetic offenses. It is information warfare, not CNO as people want, but it is super relevant.
I also wanna briefly comment on the level of Russian twitter bot activity (attacks on my website etc.) Itβs been off the scale over the last week or soβthey really have been getting excited about this little offensive that the Russians have been getting up to in Luhansk.
-
βThrow in Edward Snowden tooβ
In an effort to free Brittney Griner, the pro basketball star detained in Russia, the Biden administration has offered to swap her for convicted arms dealer Viktor Bout and send him back to Russia, Forbes has learned. Negotiations are in the early stages.
Forbes SportsMoney @ForbesSports
-
Added an addendum blog post to ALPC to highlight some of the debugging and reversing techniques I used, which I thought might be valuable for all of us learning the craft of Debugging and Reversing.
Details are in this post: csandker.io/2022/05/29/Debβ¦
Carsten @0xcsandker
-
More on the 0day in Microsoft protocols.
Wake up babe, new custom URI to arbitrary command exec just dropped ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=calc?c IT_LaunchMethod=ContextMenu IT_BrowseForFile=h$(calc.exe))'))))i/../../../../../../../../../../.exe IT_AutoTroubleshoot=ts_AUTO"
Kevin Beaumont @GossiTheDog
And some analysis.
4)Brief analysis shows that this "patched 0day" attack was exactly exploiting the same attack vector exposed by the CVE-2021-40444 0day (MS didn't block the vector when patching 40444 in Sep 2021). I (& other researchers) repeatably warned about the risk.
Haifei Li @HaifeiLi
Mitigation
Btw Iβve seen people proposing wacky ways to mitigate this.
My take: donβt panic, see what MS says. Itβs not currently under mass exploitation.
If you need to hit the panic button, put something like this in user login script.
ftype ms-msdt="C:\Windows\System32\notepad.exe" %1
Evidence of abuse in the wild in April
A blog post
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
-
Epic Halvar Flake thread.
@tgraf__ @paxteam @_minipli @yuvalavra @_fel1x @spendergrsec So I would love you to understand the problem you're up against, so you don't waste your time (and others time) on non-solutions.
I don't want people to stop working on the problem, but I want people to focus their efforts on the right parts of the problem.
-
-
Damning indictment.
I think about this a lot: in today's media environment, Nixon would survive Watergate unscathed. What @Sulliview doesn't mention is that the RW built its media machine *in response to* Watergate, precisely to prevent accountability in the future.
-
Military made cyber weapons could soon be available on the dark web. send tweet.
-
Learning Machine Learning series by @harmj0y π
posts.specterops.io/learning-machiβ¦
posts.specterops.io/learning-machiβ¦
posts.specterops.io/learning-machiβ¦
-
β‘οΈPhotos of anti-Russian leaflets on the streets of occupied Tokmak and Melitopol, Zaporizhie region, posted by partisans, appeared on the network.
-
Youβll be shocked at the state of the REvil prosecution. Shocked!
REvil investigation in Russia is in an impasse per @kommersant. 4 months after suspects were arrested, they've been charged only with stealing from 2 people in the U.S., not ransomware attacks. The excuse: lack of cooperation & evidence from the U.S.
-