vp retweeted
We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯
How did we do it? Just two missing characters was all it took.
This is the story of #CodeBreach 🧵👇
vp retweeted
DOOM on the ANKER Prime Charging station😅
This internal SWM34S MCU is just way too nice!
8MB RAM + 16MB Flash directly mapped to memory allow goes brrrr
Also on Youtube: youtu.be/MdOU8SqCqeY
vp retweeted
🚨 NEW Blog from @mandiant 🚨
Suspected Chinese Threat Actor (#UNC3886) involved in Espionage Operations.
mandiant.com/resources/blog/…
🧵
vp retweeted
I just got DSMCC Carousels working.
That means the exploit still fires even if the TV is not connected to the internet. The entire exploit is served over the airwaves.
Everyone who said "just don't connect it to the internet" can shut up now :P
vp retweeted
Chinese cyber espionage actors (possibly including APT5) have been using a zero-day vuln (CVE-2021-22893) as well as some older, known vulns in Pulse Secure VPN to gain access to dozens of government, finance, and defense orgs in the US and Europe. fireeye.com/blog/threat-rese…
vp retweeted
Volexity has identified multiple 0-day exploits in Microsoft Exchange resulting in authentication bypass and RCE. Actively exploited in the wild since at least January 2021. More here: volexity.com/blog/2021/03/02…
#threatintel #dfir #infosec
vp retweeted
Finnish Customs has seized the web server and contents of the Silpulimarket trade site in its entirety. During the preliminary investigation, Finnish Customs cooperated extensively with @Europol and with authorities in other countries.
ℹ️ tulli.fi/en/-/contents-of-si…
Estonian email provider mail.ee was exploited to target a small number of email accounts according to The Estonian Internal Security Service.
Sounds like it was an XSS vulnerability that can be very powerful if wisely used.
kapo.ee/sites/default/files/…
vp retweeted
"Fingrid, the Finnish transmission system operator, said that the breach may delay its release of Energy Identification Codes that support trading on the European electricity market" #turpo
European power grid organization says its IT network was hacked cyberscoop.com/european-ents…
vp retweeted
@i41nbeer strikes again:
"...the ability to remotely dump device physical memory regions over the air with no user interaction on iPhone 11 Pro running iOS 13.3" 🤯🍎
bugs.chromium.org/p/project-…
vp retweeted
Kansallisen turvallisuuden katsaus 2019: Ulkomaiset tiedustelupalvelut ovat aiempaa kiinnostuneempia Suomen kriittisestä infrastruktuurista.
supo.fi/tiedotteet/1/0/kansa…
vp retweeted
Hunting Advanced IoT Malware
drive.google.com/file/d/1XYZ…
vp retweeted
The FSB has been placing teams of contractors across Europe to conduct cyber espionage operations.
But, more interesting than active Russian super spy cyber warrior contractors running around Europe, there are broader implications for cyber warfare…
gru.gq/2019/10/24/fsb-deploy…
vp retweeted
A joint report from the NCSC and @NSAGov exposing Turla group activity
ncsc.gov.uk/news/turla-group…
vp retweeted
#ESETresearch discovered 3 new malware families part of the #Dukes/#APT29 arsenal: #PolyglotDuke, #RegDuke and #FatDuke
📌 Twitter, Reddit as C&C
📌 C&C communications in pictures
🎯 3 European MFAs + 1 embassy in Washington, DC
📅 2013 to June 2019
welivesecurity.com/2019/10/1… 2/4
vp retweeted
We just published a new analysis report about cyber threats targeting service providers and design offices for #spying purposes. The information provided by the #CTI team in this report is based on #incident response investigations. cert.ssi.gouv.fr/cti/CERTFR-… #PlugX #SupplyChain
vp retweeted
Back in 2016, Gdata published about a mysterious APT and their malware named COMPfun. For years, we couldn’t find anything connected. Using code similarity, we discovered a new, related implant that patches RNG libraries to subvert SSL crypto securelist.com/compfun-succe…
