threatresearch

@threatresearch@infosec.exchange

https://infosec.exchange/@threatresearch OR https://counter.social/@threatresearch

Principal Meat Popsicle https://infosec.exchange/@SophosXOps, researching and writing about malware, network forensics, and the intersection of crime with anything that electrons flow through.

Sophos' representative to the Cyber Threat Alliance (CTA), a threat intelligence sharing network whose members comprise most of the infosec industry's largest companies.

Volunteer docent and astromech droid for ancient technology at https://post.lurk.org/@mediaarchaeologylab - I break robust modern computers and act as caregiver to the old, fragile ones.

I use this account for posting about professional and infosec stuff. Personal account is @spike

This profile is from a federated server and may be incomplete. Browse more on the original instance.

threatresearch, to random

NO, YOUR MOM IS MALICIOUS 🤦🏼‍♂️​

threatresearch,

@pixelnull great minds think alike 🙃​

Tarah, to random

Yesterday morning, very suddenly, my beloved cat Frankie Fangs died of a stroke. He fell off his cat tower, I heard it, I picked him up, and after trying some rescue breaths and his inhaler, I had a few moments to make him feel loved. Dev and I were there while he crossed over the Rainbow Bridge.

He was the best gato and was filled with unconditional love. If the spirit moves you, please donate to your local pet shelter because animals are the best parts of our lives and deserve all the the care we can give them. Frankie is survived by his little sister Whisper, and nine and a half years of incredible, joy-filled, incredibly funny, lifelong memories.

threatresearch,

@Tarah @deviantollam condolences to the both of you. I know how hard it is to lose a beloved animal companion.

chetwisniewski, to infosec
@chetwisniewski@securitycafe.ca avatar

So the "takedown" of Volt Typhoon routers is interesting, but I am curious why it was done.. . To what end? They are all still vulnerable and instantly reinfectable and no patches were supplied (as far as I've heard). So... Sending a signal?

threatresearch,

@chetwisniewski unfortunately, Chet, these devices are more or less obsolete, and should be recycled, yet they are still capable of functioning in their original capacity. People need to remove them from service altogether, but many simply won't because they still work, and many more people won't pay any attention to this or care.

briankrebs, to random

Over the past month or so I've received multiple requests from other journalists to talk on background about what can be done about the swatting problem.

My replies could fill several pages of toots here, but one area that I think is important to focus on involves getting some mandatory, uniform reporting federally when these violent crimes occur at the state and local level (which they almost always do).

The Uniform Crime Reporting Program is voluntary for most agencies, but it is mandatory for federal law enforcement entities. It has categories for violent crimes like murder, rape, and assault. But is there a category for swatting? Would that be helpful in getting a better gauge on the size of this problem? I think so.

Anyway, I got a response from the DOJ. Short answer, there is no category for it. Also, a newish FBI entity created specifically to track these incidents has seen over 550 swatting incidents reported since May 1, 2023. Here's their official statement:

"In response to the national call on swatting, the FBI initiated the Virtual Command Center (VCC) known as the National Common Operation Picture (NCOP). The NCOP-VCC is a collaborative effort between the FBI and law enforcement partners to track and create a real-time picture of swatting incidents. Established in May 2023, this initiative is open to any law enforcement agencies and fusion centers who wish to participate in tracking and sharing swatting information in respective jurisdictions. Since its inception, there have been over 550 swatting incidents reported to the FBI’s NCOP-VCC since May 1, 2023."

threatresearch,

@briankrebs Brian, is one problem that there are not enough, or strong enough, laws at the state level to address swatting? What lessons/guidance should lawmakers take from this?

threatresearch, to infosec

An op-ed by two champions of women's professional tennis lays out a rationale not only for the WTA not to stage its championship in Saudi Arabia, but a perfectly cromulent reason why the conference should not now, or ever again - at least until its draconian social laws dramatically change - host an infosec conference in Saudi Arabia.

already treads a fine line and many members of our professional community are women, nonbinary, LGBTQ+, or members of other groups that are threatened, or have been subject to deeply offensive and (in some cases) genocidal behavior by those in charge of that country.

Nobody should have to wonder whether being accepted to speak at a professional conference will result in their death at the hands of the state where the conference will take place, or that their civil and human rights may be strictly curtailed by the host country.

It's disgusting that an organization with as much power as PLC would even consider hosting a professional conference in the KSA, as they plan to do in November.

I appeal to members of this community who care about human rights and their fellow community members who simply cannot travel to this part of the world without the fear of imprisonment, torture, or death not to support this conference, not to submit to their call for papers, not to promote or encourage others to attend, and to speak out about the human rights this government violates - KSA behaves abhorrently every day.

Informa PLC - you must end the practice of hosting this conference in Saudi Arabia until circumstances drastically change there.

Those of you who gladly appear on the Black Hat MEA website as speakers or keynote speakers - we see you, and this tells us everything we all need to know about you and your values. You should be deeply ashamed.

https://www.washingtonpost.com/opinions/2024/01/24/evert-navratilova-wta-saudi-arabia/

jfmezei, to random
@jfmezei@mstdn.ca avatar

@HoffmanLabs I got offered some VAX in case I ran a museum. Apparently a microvax 1000 they say. Do you know anyone who is running such a museum who might be interested ?

threatresearch,

@lcamtuf @chiefoldmist @jfmezei @HoffmanLabs I've shared the link to your Mastodon post with the folks at Media Archaeology Lab in Boulder. I'm not sure there's room for it; Do you have a photo of the unit and can you share its approximate size and weight?

hacks4pancakes, to random

IDK y’all but my ten year old Honda batteries seem to be rocking it right now in Chicago. Seems like a them problem.

threatresearch,

@hacks4pancakes the >12 year old batteries in my Nissan Leaf seem to be doing just fine, same as always when it gets well below zero in Colorado, which it does at least a few days every year.

MLE_online, to random
@MLE_online@social.afront.org avatar

Do I know anyone on here who has experience adapting a rotary phone to work over modern VOIP?

I know I will need both an adapter from rotary to touch tone and then a VOIP adapter, but there seems to be a variety of options and I can't tell what's good and what's lousy.

threatresearch,

@MLE_online I've actually plugged a totally standard rotary phone in to the Vonage VoIP adapter and it interpreted pulses without the intermediary tone-conversion being necessary, FWIW.

threatresearch,

@MLE_online I use it for my home phone. It's ridiculously cheap, especially for international calls, which is why I first signed up.

AAKL, to random
@AAKL@noc.social avatar

deleted_by_author

    •
    threatresearch,

    @AAKL @BBC I actually prefer self-checkout but I'm a very pedantic grocery bagger. I do wish the self-checkout stations at my grocery store were not so finicky about their weight sensors on the bagging area but it's a minor quibble.

    I'll add that I really began to appreciate them during the pandemic. Not having someone with indeterminate hygiene handle my groceries after handling other people's items/cards/cash just seems a bit more sanitary, though that might be an illusion.

    thomasfuchs, to random
    @thomasfuchs@hachyderm.io avatar

    𝓖𝓵𝓸𝓼𝓼𝓪𝓻𝔂

    Blockchain: a slow database

    Crypto: an expensive slow database

    NFT: an expensive slow database to store URLs

    AI: a way to write slow and inefficient algorithms

    LLM: a database that stores text in a slow and inefficient way

    Chat GPT: an expensive imprecise query language for slow and inefficient text databases that often returns wrong results

    threatresearch,

    @glennf @thomasfuchs that sounds amazing! What was it called?

    atomicpoet, to random
    @atomicpoet@atomicpoet.org avatar

    Oh my God. I’m tired of PC gamers – but also gamers in general – badmouthing emulation.

    I’m sorry, but most people don’t have an old beige box PC with a Pentium CPU and CRT monitor. That’s simply not an option for 99% of people out there. If they want to play old DOS games, they need DOSBox. Yes, it’s not perfect. Nothing is.

    But if you want to play the original game on new hardware, not some re-make that pretends to be the original, then emulation is the answer.

    threatresearch,

    @atomicpoet Steam (and the Steam Deck) uses DOSbox for games they still sell commercially

    hacks4pancakes, to random

    All packed up

    threatresearch,

    @hacks4pancakes wow, I really appreciate your organization skill with this kit

    dangoodin, to random

    Researchers have unearthed nearly two dozen vulnerabilities that could allow hackers to sabotage or disable a popular line of network-connected wrenches that factories around the world use to assemble sensitive instruments and devices.

    The vulnerabilities, reported Tuesday by researchers from security firm Nozomi, reside in the Bosch Rexroth Handheld Nutrunner NXA015S-36V-B. The cordless device, which wirelessly connects to the local network of organizations that use it, allows engineers to tighten bolts and other mechanical fastenings to precise torque levels that are critical for safety and reliability. When fastenings are too loose, they risk causing the device to overheat and start fires. When too tight, threads can fail and result in torques that are too loose. The Nutrunner provides a torque-level indicator display that’s backed by a certification from the Association of German Engineers and adopted by the automotive industry in 1999.

    Nozomi researchers said the device is riddled with 23 vulnerabilities that, in certain cases, can be exploited to install malware. The malware could then be used to disable entire fleets of the devices or to cause them to tighten fastenings too loosely or tightly while the display continues to indicate the critical settings are still properly in place.

    Bosch officials emailed a statement that included the usual lines about security being a top priority. It went on to say that Nozomi reached out a few weeks ago to reveal the vulnerabilities. "Bosch Rexroth immediately took up this advice and is working on a patch to solve the problem," the statement said. "This patch will be released at the end of January 2024."

    https://arstechnica.com/security/2024/01/network-connected-wrenches-used-in-factories-can-be-hacked-for-sabotage-or-ransomware/

    threatresearch,

    @dangoodin I just can't even with the internet-connected hand tools

    verovaleros, to grafana

    I am proud of the infrastructure we created for our Introduction to Security class at CTU in Prague.

    It is a challenge to keep services and student containers up in a quite adversarial network where everyone is attacking but we managed to secure a 99% uptime.

    In 15-16 weeks of class, our network sees hundreds of millions of network flows. We use for log collection, a dockerised suite with for monitoring, and for threat hunting.

    Students are in full control of their containers. Our classes are a well-balanced mix of attack and defence, where students are in charge of protecting their own containers for the duration of the class. The attacking includes a wide variety of attacks and tools, including active exploiting of web applications and services.

    Very proud of each of our students who do not stop surprising us each year!

    threatresearch,

    @verovaleros and the awesome telephones! ☎️

    threatresearch,

    @verovaleros it's just in a place of reverence in the @mediaarchaeologylab . I'll send a picture later today.

    (Still would love some of those wall jacks if you have any)

    codinghorror, to random

    Some helpful nutritional ideas

    threatresearch,

    @codinghorror so much affection for Meow Wolf's relentless surrealism

    dangoodin, to random

    I have been following the scandal involving Sarasota, Florida, husband and wife Christian and Bridget Ziegler. In brief, Christian was the chair of the Florida Republican Party and has straddled the fence between supporting Trump and Gov. DeSantis. Bridget, the founder of Moms for Liberty and a member of the Sarasota County School Board, has championed a cruel and bigotted campaign against trans and black people. DeSantis appointed her to Florida's recently created Disney Oversight Board. Together, the couple has aggressively promoted Christian and family values.

    Recently, an acquaintance of the couple accused Christian of rape. (Christian has denied the accusations and no charges have been filed, but video shot by him and recovered by Sarasota Police does confirm he had sex with the accuser.) In the resulting investigation, it was revealed that the couple had a three-way sexual encounter with the acquaintance. The hypocrisy bombshell has resulted in conservatives calling for both to resign their posts.

    I'm fascinated to know: how did the detailed police report get leaked to the press? I can't help wondering if Trump had something to do with it. Trump is mad that the Florida GOP hasn't endorsed him and has applied considerable pressure for it to do so. The Zieglers' fall from grace is a major benefit to Trump. It would also play into Trump's penchant for retaliating against anyone who doesn't support him. My guess is that it's within Team Trump's power to get the investigative report leaked.

    This is pure speculation on my part. There are lots of things I don't know about the Florida GOP dealings. Still, I really, really want to know how this came out.

    https://www.nytimes.com/2024/01/08/us/christian-ziegler-florida-republican.html

    threatresearch,

    @dangoodin Even the tiniest morsel of FO is delicious after all the FAing that has been going on with these two knuckleheads

    threatresearch, to random

    My unbroken streak of never attending will not be broken this year, but I will be in DC this week for to meet with congressional staffers and representatives to talk through technical and infosec topics they should be aware of in the coming year.

    It'll be my first time attending this event, so if anyone in my circle will be there or has attended previously, I'd love to hear about how it went and how much preparation you did.

    Also down for drinks/coffee/meeting up with other folks who will be there this week.

    jerry, to random

    Surprise 10:30pm conference call. Now I’m awake 😕

    threatresearch,

    @jerry surprise! 🎉​🥳​

    threatresearch, to apple

    PowerBook 145B

    I have replaced
    the battery
    that was soldered to
    the PRAM subassembly

    and which
    you were probably
    expecting
    was not user-serviceable

    Forgive me
    it was delicious
    to hear
    that bootup sound again

    A PowerBook 145B

    threatresearch,

    This 1988 Solitaire game appears to feature He Who Remains as one of the card decks.

    (I love you can see every individual pixel when you look closely enough at the screen)

    image/jpeg
    image/jpeg

    threatresearch,

    Duane Blehm...this sent me down a rabbit hole. And into a reverie about Strange New Worlds and Lower Decks.

    https://archive.org/details/TheDuaneBlehmCollection

    The "Ad Astra Per Aspera" cartoon version Starfleet recruitment poster from S2E8 of Star Trek: Strange New Worlds, featuring Una Chin Riley
    headstone for Duane Blehm. Born August 12 1951 died June 6 1988

    threatresearch,

    I have continued futzing around with the 145B. My weekend project was to remove the ancient, decrepit SCSI hard drive (functional, but loud as heck) with the replacement unit.

    Fortunately I already have some experience working with .hda disk image files from last year's project, so I had some ready-made virtual hard disks loaded with software I've barely touched.

    Today at @mediaarchaeologylab I found a floppy disk for the 1995 Norton Disk Editor, a low-level diagnostic tool that I can't imagine there was much consumer demand for. The disk editor contains some hidden gems of MacIntosh lore I was previously unaware of.

    The UI says "The Disk Type bytes identify the type of Macintosh file system in use on the volume. If the bytes are $D2D7 (or 'RW' - standing for Randy Wigginton) then the volume is an MFS volume. If the Disk Type bytes are $4244 (standing for 'BD' or "Big Disk") then the volume is an HFS volume."

    Randy was employee number 6 at Apple, and a neighbor of Woz. Turning your initials into magic bytes buried in the filesystem you designed seems just so...early Apple.

    The PowerBook is now completely silent when it runs. It doesn't have an internal fan. The hard drive motor was the only thing that made any noise (aside from the speaker, of course).

    And the BlueSCSI? With a 128GB MicroSD card, it has about 1600 times as much storage as that old 80MB hard drive.

    Photo of the 80MB SCSI hard drive that came out of the PowerBook. It's a black rectangle labeled Apple Computer Inc. and was OEMed from IBM. It's dated 1993.
    Randy Wigginton's employee #6 badge from Apple.
    The BlueSCSI device mounted inside the PowerBook

    threatresearch,

    Haha oh yeahhhh functional wifi on a Mac that only has a 9600 baud modem in it. It just feels wrong that this works so well.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • JUstTest
  • kavyap
  • thenastyranch
  • ethstaker
  • osvaldo12
  • mdbf
  • DreamBathrooms
  • InstantRegret
  • magazineikmin
  • Youngstown
  • ngwrru68w68
  • slotface
  • GTA5RPClips
  • rosin
  • megavids
  • cubers
  • everett
  • cisconetworking
  • tacticalgear
  • anitta
  • khanakhh
  • normalnudes
  • Durango
  • modclub
  • tester
  • provamag3
  • Leos
  • lostlight
  • All magazines
    •