November 23, 2022

Nov 23, 2022

The Swedes are rolling up a lot of Russian spies recently.

Christo Grozev @christogrozev

Swedish couple who immigrated from Russia more than 20 years ago arrested for espionage. They worked in the "import-export" business which should have been enough of a red flag (apologies to any legitimate "impex international businessmen" that do exist:)

Tony Ingesson @tonyingesson

New arrests in Sweden this morning, two individuals have been apprehended. One is suspected of gross illicit intelligence collection targeting both Sweden and an unnamed foreign power, the other is suspected of aiding and abetting this.

Shashank Joshi @shashj

Yet more spy arrests in Sweden. They follow Sweden's arrest of two other suspected Russian spies earlier this month, Norway's arrest of a suspected GRU illegal in October, the Netherlands' arrest of another in June (now jailed in Brazil) & Poland's arrest of yet another in March.

Tony Ingesson @tonyingesson

New arrests in Sweden this morning, two individuals have been apprehended. One is suspected of gross illicit intelligence collection targeting both Sweden and an unnamed foreign power, the other is suspected of aiding and abetting this.

-

-

European Parliament is discussing 0day vulnerabilities on Thursday.

https://www.europarl.europa.eu/news/en/press-room/20221118IPR55802/meps-discuss-technical-vulnerabilities-related-to-spyware-with-experts

-

She Extends (Read Pinned!) @68tilinfinity

"Diagnosis made by hallucinatory voices" Woman hears voices asking her to get a CT scan because they claim she has a brain tumour. Her psychiatrist orders a scan to reassure her but they actually find the tumor. After her surgery the voices thank her for listening and disappear

In the winter of 1984, as she was at home reading,
she heard a distinct voice inside her head. The voice
told her, “Please don’t be afraid. I know it must be
shocking for you to hear me speaking to you like this,
but this is the easiest way I could think of. My friend
and I used to work at the Children’s Hospital, Great
Ormond Street, and we would like to help you.”
AB had heard of the Children’s Hospital, but did
not know where it was and had never visited it. Her
children were well, so she had no reason to worry
about them. This made it all the more frightening for
her, and the voice intervened again: “To help you see
that we are sincere, we would like you to check out the
following”—and the voice gave her three separate
pieces of information, which she did not possess at the
time. She checked them out, and they were true, but
this did not help because she had already come to the
conclusion that she had “gone mad.” In a state of panic,
AB went to see her doctor

In order to reassure her, I requested a brain scan,
explaining in my letter that hallucinatory voices had
told her that she had a brain tumour, that I had not,
personally, found any physical signs suggestive of an
intracranial space occupying lesion, and that the
purpose of the scan was essentially to reassure the
patient. The request was initially declined, on the
grounds that there was no clinical justification for such
an expensive investigation. It was also implied that I
had gone a little overboard, believing what my patient’s
hallucinatory voices were telling her.
Eventually, after some negotiation, the scan was
done in April. The initial findings led to a repeat scan,
with enhancement, in May, revealing a left posterior
frontal parafalcine mass, which extended through the
falx to the right side. It had all the appearances of a
meningioma.

[Note: cut short because of character limit]

AB later told me that when she recovered
consciousness after the operation the voices told her,
“We are pleased to have helped you. Goodbye.” There
were no postoperative complications. The dosage of
dexamethasone was halved every four days, and then it
was stopped. She was on prophylactic anticonvulsants
for six months. Antipsychotic medication was discontinued immediately after the operation, and there was
no return of the hallucinatory voices or the delusions
which she had expressed.

AB telephoned me last Christmas to wish me and family a merry festive season, and to tell me that she had
been completely well in the 12 years since the
operation. It was this telephone call that brought this
case to mind again.

She Extends (Read Pinned!) @68tilinfinity

I can't speak too much on True Crime stuff because I read medical case reports for fun

-

Paul Moore @Paul_Reviews

.@EufyOfficial - Couple of Q's Why is my "local storage" #doorbellDual storing every face, without encryption, to your servers? Why can I stream my camera without #authentication?! But crucially, is this really the AES key for my video footage? Please tell me it's not.

-

Matt Armstrong @mountainrunner

The Freedom Academy, an idea resurrected by @AshaRangappa_

mountainrunner.substack.comThe Freedom AcademyAn old idea resurfacing

-

So a new thing happened. A paper we submitted got rejected by a journal after automated plagiarism detection. It turned out two students in India had plagiarised our preprint and then published online reports. So we've been accused of copying them. Fun.

https://someone.elses.computer/@jackstilgoe/109387380974508737

-

Jack Stilgoe @Jackstilgoe

So a new thing happened. A paper we submitted got rejected by a journal after automated plagiarism detection. It turned out two students in India had plagiarised our preprint and then published online reports. So we've been accused of copying them. Fun.

-

Ian Beer @i41nbeer

Mind the gap: googleprojectzero.blogspot.com/2022/11/mind-t… Part of project zero's remit is to drive structural improvements across the ecosystem.

googleprojectzero.blogspot.comMind the GapBy Ian Beer, Project Zero Note: The vulnerabilities discussed in this blog post (CVE-2022-33917) are fixed by the upstream vendor, but...

-

Micah Lee @micahflee

A few years ago Twitter censored a link to a single @nypost story about Hunter Biden's laptop for TWO DAYS, then reversed the decision. Conservatives still talk about it. Twitter has been censoring ALL LINKS to ddosecrets dot come over TWO YEARS

theintercept.comElon Musk’s “Free Speech” Twitter Is Still Censoring DDoSecretsTwitter has censored the website of nonprofit transparency collective Distributed Denial of Secrets for more than two years.

-

The "#Vulnerabilities 1001: C-Family Software Implementation Vulnerabilities" free course by #OpenSecurityTraining2 is awesome and very recommended to all developers and beginner code auditors.

https://ost2.fyi/Vulns1001

Also, make sure to check out all the other high-quality, free #OST2 training courses.

https://infosec.exchange/@raptor/109389711077567099

-

-

Jevin Sweval @jevinskie

Wow, @borrello_pietro! A PoC for pointer signing on Intel via a custom microcode patch. Mind blown!

github.comx86 PAC · pietroborrello/CustomProcessingUnit@936a684The first dynamic analysis framework for CPU microcode - x86 PAC · pietroborrello/CustomProcessingUnit@936a684

-

Pietro Borrello @borrello_pietro

@jevinskie Thank you! 🙂 Still wip but I'm exploring different routes for benefits of microcode control Up to now I implemented: - fast software breakpoints for fuzzing - conditional hw breakpoints for perf profiling - constant time hw division - and yes x86 PAC 😁 Suggestions are welcome!

-

Bakhti Nishanov @b_nishanov

A confectionery producer in Kazakhstan dropped a new ad for their chocolate bar called “Kazakhstan”. In it, what looks like a Russian draft dodger walks over to Kazakhstan and is handed a chocolate bar. He asks what it is and is told, “It’s the taste of freedom.” Absolute fire.

Vyacheslav Abramov @vvabramov

@b_nishanov Russian advertising agency made this ad without any requests from the client.

-

The video record of my Black Hat USA 2022 talk is up! @BlackHatEvents "DirectX: The New Hyper-V Attack Surface"

youtube.comDirectX: The New Hyper-V Attack SurfaceIn 2020, Hyper-V introduced a new feature of GPU-Paravirtualization, which is based on GPU virtualization technology. This technology is integrated into WDDM...

-

payloadartist @payloadartist

🔓 Google Pixel Lock Screen Bypass (CVE-2022-20465), wow just wow - Make failed attempts to unlock device - Remove SIM, & insert your own SIM - Enter wrong SIM PIN thrice - Enter your SIM's PUK & change SIM PIN - Voila, unlocked! bugs.xdavidhu.me/google/2022/11… #infosec #cybersecurity

-

NCC Group Research & Technology @NCCGroupInfosec

Video from our @BlackHatEvents talk by Iain Smart ( @smarticu5 ) & Viktor Gazdag ( @wucpi ) on "RCE-as-a-Service: Lessons Learned from 5 Years of Real-World CI/CD Pipeline Compromise" is available now

youtube.comRCE-as-a-Service: Lessons Learned from 5 Years of Real-World CI/CD Pipeline CompromiseIn this presentation, we’ll explain why CI/CD pipelines are the most dangerous potential attack surface of your software supply chain. To do this, we’ll disc...

-

Discussion about this post

No posts

#nojs-banner { position: fixed; bottom: 0; left: 0; padding: 16px 16px 16px 32px; width: 100%; box-sizing: border-box; background: red; color: white; font-family: -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 13px; line-height: 13px; } #nojs-banner a { color: inherit; text-decoration: underline; } This site requires JavaScript to run correctly. Please turn on JavaScript or unblock scripts