Schneier on Security

ResearcherZero • October 1, 2023 2:23 AM

whois?

‘https://www.france24.com/en/technology/20230930-counterfeit-people-the-dangers-posed-by-meta-s-ai-celebrity-lookalike-chatbots

–

The defendant must show that a computer was not operating correctly.

“If the presumption is unrealistic in and of itself, or if rebuttal is unrealistic, then the presumption converts from being something that assists the course of justice to something that causes miscarriages of justice.”

This is the failure of the law itself and of the procedures of the courts.

“in the absence of evidence to the contrary, the courts will presume that mechanical instruments were in order at the material time”

In 1984 a law was passed which pointed this presumption in the opposite direction. Section 69 replaced the old common law position. Section 69, however, was repealed in 1999…

The effect of this repeal was that the old common law presumption returned, meaning that is was again for the defendant to show that a computer was not operating correctly, rather than for the prosecutor to show that the computer was operating correctly.

‘https://emptycity.substack.com/p/computer-says-guilty-an-introduction

https://www.youtube.com/watch?v=UAywCnNDVvo

ResearcherZero • October 1, 2023 2:33 AM

“insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature”

Execute arbitrary code and gain full control of the affected system.

‘https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-getvpn-rce-g8qR68sx

–

‘https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-chain/

‘https://www.youtube.com/watch?v=x0DPpVh8fO4

bypass authentication

‘https://github.com/Chocapikk/CVE-2023-29357

–

SysUpdate DLL inicore_v2.3.30.dll

‘https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-tool-update-telecoms-govt

This new version has similar features to the 2021 version, except that the C++ run-time type information (RTTI) classes we previously observed in 2021 had been removed, and that the code structure was changed to use the ASIO C++ asynchronous library.

‘https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html

ResearcherZero • October 2, 2023 2:18 AM

@Clive Robinson

RSA Prime Factorization on IBM Qiskit

‘https://www.researchgate.net/publication/371479752_RSA_Prime_Factorization_on_IBM_Qiskit

ResearcherZero • October 2, 2023 2:49 AM

@Clive

That includes a lot of stuff:

“FIPS certification for cryptographic modules doesn’t require robust testing of side-channel protections. Only on Level 4 certification are protections against side-channel attacks mandatory. You’re just as much at risk if your site’s certificate or key is used anywhere else on a server that does support RSA.”

‘https://people.redhat.com/~hkario/marvin/

ResearcherZero • October 2, 2023 5:08 AM

In-Q-Tel, was its first outside investor, and until 2010, its only customers were in intelligence, law enforcement, and defense.

Intelligence and national security agencies use its tools to flag suspicious activities. Palantir’s “forward-deployed engineers” essentially operated as a mobile sales force, customizing the software to the needs of each client.

‘https://www.palantir.com/_ptwp_live_ect0/wp-content/uploads/2012/06/ImpactStudy_USMC.pdf

example

‘https://www.cartercenter.org/news/multimedia/map/exploring-historical-control-in-syria.html

ResearcherZero • October 2, 2023 6:19 AM

Google plans to reduce the lifespan of SSL/TLS certificates.

‘https://www.helpnetsecurity.com/2023/09/28/certificate-automation-challenges/

–

“The certificate, originally spawned by Symantec, was scheduled to be banished years ago.”

The removed credential is known as a root certificate, meaning it anchors the trust of hundreds or thousands of intermediate and individual certificates downstream.

‘https://arstechnica.com/security/2023/08/a-renegade-certificate-is-removed-from-windows-then-it-returns-confusion-ensues/

As a result of acquisitions over the years the company now controls the root certificates of several formerly standalone certificate authorities including VeriSign, GeoTrust, Thawte and RapidSSL.
https://www.pcworld.com/article/406198/to-punish-symantec-google-may-distrust-a-third-of-the-webs-ssl-certificates.html

Of particular concern are so-called Extended Validation (EV) certificates, for which issuers are supposed to take additional actions to authenticate the identity of the entity requesting them. Faced with the prospect of recontacting millions of its customers to renew their certificates ahead of schedule, and revalidating the identity of EV certificate holders, Symantec chose to hand the problem to DigiCert.

‘https://www.csoonline.com/article/562511/symantec-sells-its-problem-ssl-unit-to-digicert-for-1b.html

GoDaddy discovered that an unauthorised third-party had accessed its managed WordPress hosting environment, with the attacker using a compromised password for it.

The unauthorised acess led to 457,911 private keys for users’ digital certificates being compromised, along with email adddresses and other sensitive data.
https://www.itnews.com.au/news/godaddy-took-weeks-to-revoke-compromised-certificates-573870

This is a violation of the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, Section 4.9.1.1 “Reasons for Revoking a Subscriber Certificate” which states that “the CA SHALL revoke a Certificate within 24 hours if the CA obtains evidence that the Subscriber’s Private Key corresponding to the Public Key in the Certificate suffered a Key Compromise”

‘https://bugzilla.mozilla.org/show_bug.cgi?id=1742657#c15

“To protect your business, you must know the location of every certificate in use and be able to replace any of them instantly.”

As we’ve seen with Symantec, GlobalSign, GoDaddy and many more, CAs can make errors, are victims of fraud, and can be hacked.

‘https://www.computerweekly.com/news/450410837/Flawed-GoDaddy-security-certificates-show-need-for-control

” …any web server configured this way caused domain control verification to complete successfully.”
https://groups.google.com/g/mozilla.dev.security.policy/c/Htujoyq-pO8

Attack on DigiNotar resulted in fraudulent web authentication certificates being issue for hundreds of websites, including google[.]com.

(DigiNotar Root CA, DigiNotar Root CA G2, DigiNotar PkIoverheid CA Overheid, DigiNotar PKIoveheid CA Organisate-G2, and DigiNotar PKIoverheid CA Overheid en Bedrijven.)

The Fox-IT report identified 300,000 unique IP requests to the phony domain, with 99 percent originating from Iran.

“The hacker claimed responsibility for the recent attack on DigiNotar and claimed to have access to four other CAs, including GlobalSign.”
https://spectrum.ieee.org/diginotar-certificate-authority-breach-crashes-egovernment-in-the-netherlands

The attack had gone undetected for more than a month. 531 fraudulent certificates were issued for 344 domain names.

‘https://www.diginotar.nl/Portals/7/Persberichten/Operation%20Black%20Tulip%20v1.0a.pdf

ResearcherZero • October 2, 2023 7:53 AM

Theater Undersea Surveillance Command

‘https://www.reuters.com/investigates/special-report/usa-china-tech-surveillance/

–

“They are now announcing more address space than anything ever in the history of the Internet.”

…messages began to arrive telling network administrators that IP addresses assigned to the Pentagon but long dormant could now accept traffic — but it should be routed to Global Resource Systems.

‘https://www.kentik.com/blog/the-mystery-of-as8003/

“reassignment of a massive government-owned block of well over sixteen million IP addresses”
https://seclists.org/nanog/2021/Mar/186

Modern apps often include SDKs written by little-known companies like Measurement Systems

‘https://www.foxbusiness.com/technology/apps-with-hidden-data-harvesting-software-banned-by-google

Google’s Chrome, Apple’s Safari, nonprofit Firefox and others allow the company, TrustCor Systems, to act as what’s known as a root certificate authority.

Measurement Systems, had been paying developers to include code in a variety of innocuous apps to record and transmit users’ phone numbers, email addresses and exact locations.

Vostrom filed papers in 2007 to do business as Packet Forensics.

‘https://www.washingtonpost.com/technology/2022/11/08/trustcor-internet-addresses-government-connections/

“The company’s Panamanian registration records show that it has the identical slate of officers, agents and partners as a spyware maker identified this year as an affiliate of Arizona-based Packet Forensics, which public contracting records and company documents show has sold communication interception services to U.S. government agencies for more than a decade.” (longer)

‘https://www.usaspending.gov/award/CONT_AWD_HB000122C1003_9700_-NONE-_-NONE-

“Your investigative staff will collect its best evidence while users are lulled into a false sense of security afforded by web, e-mail or VOIP encryption.”

‘https://www.wired.com/2010/03/packet-forensics/

An attacker who obtains a certificate, either through theft or malicious enrollment, is limited by the validity period of that certificate. However, they can always issue a renewal request to extend the life of the certificate, which would not leave enrollment records on the server, in case such artifacts are being monitored.
https://posts.specterops.io/certified-pre-owned-d95910965cd2

http://paranoia.dubfire.net/2009/12/8-million-reasons-for-real-surveillance.html

‘https://www.issworldtraining.com/ISS_WASH/

ResearcherZero • October 2, 2023 9:37 AM

@Clive Robinson, ALL,

outage – CNE 😉

–

Home affairs boss tried to stifle press freedom (his encrypted messages)

“Home Affairs secretary Michael Pezzullo used WhatsApp messages to try to reshape governments.”

The public servant in charge of Australia’s internal security lobbied hard for the power to censor the media’s reporting of national security issues after the Australian Federal Police controversially raided three Australian journalists over their reporting.

In a series of text messages to an influential Liberal Party operative in 2019, the secretary of the Home Affairs Department, Michael Pezzullo, sought to convince then prime minister Scott Morrison to introduce a system of “D-Notices” – by which government agencies would be able to pressure media organisations not to publish stories deemed damaging to national security.

‘https://www.smh.com.au/national/modern-version-of-the-d-notice-how-the-home-affairs-boss-tried-to-stifle-press-freedom-20230919-p5e5sy.html

–

Last Drinks

“Under our system, when someone falls from a window or gets shot in their driveway, the case is handled by local police. Oftentimes, that’s where the incident will stay.”

…cases involving a foreign intelligence agency are liable to get handled by detectives with no particular expertise in the methods and motivations of state-sponsored assassinations. Worse still, a history of tension between local cops and the feds means detectives might not be especially eager to call for assistance.

“It’s very important for us to communicate to the world that we’re not going to tolerate this and we’re going to throw resources at it to get to the bottom of it,” he says.

What Joyal says he’d like to see is an FBI resource that could be dispatched to local cases where a foreign government might be involved.

‘https://www.politico.com/news/magazine/2023/09/22/foreign-ops-in-america-00117466

ResearcherZero • October 4, 2023 2:24 AM

China is a deep state.

“political-ideological construct”

‘https://www.csis.org/analysis/ideological-security-national-security

Russia is headed in the same direction as China. The U.S. is not a deep state.

–

The Marine Corps is, for the first time in more than 100 years, without a permanent leader.

“These vacancies place unnecessary uncertainty on critical national security roles and send troubling signals to U.S. allies and adversaries; they undermine command authority at senior levels, making it more difficult for our military leaders to lead effectively.”
https://www.pilotonline.com/2023/09/08/opinion-tubervilles-misguided-stunt-threatens-our-national-security/

“For six months, he’s been blocking the promotion of every general and flag officer in the U.S. military. That’s 301 military positions and counting. Let that sink in.”

“…It has also impacted thousands of officers beneath them who are prevented from advancing. That hamstrings our military – and undermines our readiness to the benefit of our adversaries.” “…the tactics he is using are unconscionable and dangerous.”

“Every single day Tuberville’s block on military nominations continues, the damage to our national security multiplies. He has lost one vote on the policy, declined the opportunity to have another, and no court has agreed with his claim that it’s illegal. Unable to change a policy he disagrees with, he’s opted to take his ball and go home, punishing service members and compounding damage to our national security.”

‘https://www.foxnews.com/opinion/tubervilles-actions-horribly-dangerous-military-hurt-american-families

Waywardness, with little thought for the consequences…

MATT GAETZ strategy of single subject spending bills.

He dictated his list of the first four: Defense, Homeland Security, State-Foreign Operations, and the Agriculture-FDA bill.
https://www.politico.com/newsletters/playbook/2023/09/22/how-matt-gaetz-took-over-the-house-00117565

–

Factors Jeopardizing Civil-Military Cooperation on Cyber Defense

“The most significant challenges in bridging the gap between civilian and military worlds seems to be power and budget struggles and a lack of political direction on cyber matters from leaders.”

‘http://dx.doi.org/10.1080/19361610.2021.2006033

Serving themselves…

Populism argues that elites are corrupt and the people need better representation, but makes very few policy commitments beyond this criticism.

It is also a message that doesn’t tie politicians down to any other ideological or policy commitment.

“Populist politicians and governments view the formal institutions of liberal democracy as corrupt creations spawned by crooked establishment elites – and so they systematically hollow out and undermine these institutions, such as the courts, regulatory agencies, intelligence services, the press, and so on.”

They justify these attacks as replacing discredited and corrupt institutions with ones that serves “the people” – or, in other words, themselves.

https://news.stanford.edu/2020/03/11/populism-jeopardizes-democracies-around-world/

ResearcherZero • October 4, 2023 2:45 AM

@Clive Robinson

entirely passive system to desalinate water at low cost

‘https://news.mit.edu/2023/desalination-system-could-produce-freshwater-cheaper-0927

–

“Fibres were first spun into a tight thread. Four of these threads were then twisted together to create strings, which experiments showed could draw water higher up.”

‘https://www.chemistryworld.com/news/strings-that-draw-up-brine-could-help-supply-the-world-with-lithium/4018121.article

–

Shoot down drones for a vastly cheaper cost.

The system is capable of countering modern drone threats with just one shot and can track and engage at ranges beyond 800m.

When equipped with thermal imaging and night vision devices, the gun can achieve a firing rate of either 100 or 200 rounds per minute.

The system includes a radar, a 30mm cannon with specialized ammunition, and EOS’s exclusive stabilization and pointing technology. Weighs less than 400 kg and is fully stabilized for on-the-move operation.

‘https://www.abc.net.au/news/2023-10-02/australian-drone-killer-system-ukraine-730/102876242

ResearcherZero • October 4, 2023 4:21 AM

@Captain Sensible

5 minutes was about the time it took for someone to show up and put bullets through the door of a “safe house”. Though, that was more than 20 years ago.
I would still avoid WitSec in Australia, but that is just my personal opinion.

I saw a lot of people die just because someone thought they might know something, or just because the people responsible liked inflicting pain by knocking someone’s, friends, family, or children.

It’s better today, but a lot of my friends and colleagues are in the ground via murder, suicide or accident. Many crooks walked, and many innocent people got burned.They could at least properly investigate.

The evidence has been sitting in boxes for about 35 years gathering dust. They could close a number of cold cases, if they wanted to. But they might then have to explain why they let it happen. Why they took no action.

Someone else always has to wear the responsibility. They prefer volunteers, as asking would confer some responsibility on law enforcement. I think it would be both morally correct and polite if they stuck their own necks out on occasion. They simply have to look at who previously kidnapped the victim, leading up to their murder. Interview the witnesses this time, for example, and actually listen to what they say without making assumptions.

This is not the guy.

‘https://www.abc.net.au/news/2019-12-07/claremont-serial-killer-trial-the-case-for-sarah-spiers-murder/11775938

This is the man tried to kidnap Sarah in Claremont, shortly before she vanished

‘https://thewest.com.au/news/wa/karl-ocallaghan-bows-out-how-an-accidental-police-officer-became-was-top-cop-ng-b88537547z

The same guy who put a bullet from a rifle through my window screen, and another through my wife’s bedroom window, after we gave evidence in court after he repeatedly tried to kill us, kidnapped us, including Sarah Spiers.

All the promises they would lock him up if we gave evidence turned out to be a crock of s**t. Afterwards they let him join the police force.

But where is the motive and opportunity? I’m too thick to figure it out.

He had another crack at us right before he resigned. Probably all a complete coincidence. Many of the witnesses are now also pushing up daisies.

However, ‘Claremont Serial Killer’ is a better headline than ‘Top Cop Crook’. Easier to explain, and much simpler to digest.

ResearcherZero • October 4, 2023 11:47 PM

Chinese state-owned enterprises are using Australian law firms to advise on takeovers of critical local infrastructure and minerals projects according to a new report that exposes potential conflicts with other sensitive work the same companies complete at home.

‘https://www.abc.net.au/news/2023-10-03/beijing-owned-businesses-using-australian-law-firms/102925108

Beijing’s attempts to gain influence via infrastructure partnerships and low-cost technology investments comes with risks that China may exploit the systems it helps finance.

‘https://cyberscoop.com/mayorkas-latin-america-china/

“TSA did not ensure all pipeline operators timely adhered to security requirements contained in the directives. TSA also did not follow up and track the pipeline operators’ assessments of the effectiveness of their cybersecurity practices.”

‘https://www.oig.dhs.gov/sites/default/files/assets/2023-09/OIG-23-57-Sep23-Redacted.pdf

–

Meta reported that it had recently taken down thousands of accounts and Facebook pages that “were part of the largest known cross-platform covert operation in the world,” run by “geographically dispersed operators across China.”

‘https://thediplomat.com/2023/09/chinas-increasingly-aggressive-tactics-for-foreign-disinformation-campaigns/

The Chinese government is pouring billions of dollars annually into a global campaign of disinformation, using investments abroad and an array of tactics to promote Beijing’s geopolitical aims and squelch criticism of its policies, according to a new State Department assessment. Beijing’s broad-ranging efforts feature online bot and troll armies, legal actions against those critical of Chinese companies and investments and content-sharing agreements with media in Latin America and Africa.

X approved all of the fake ads, TikTok approved 70 per cent and Meta allowed all but one through.
https://www.abc.net.au/news/2023-09-30/voice-to-parliament-misinformation-elon-musk-x/102912548

ResearcherZero • October 5, 2023 12:02 AM

When people are desperate enough, they’ll go for a counterfeit. It’s a dangerous time to give people more reasons not to believe what’s in front of them.

Complicating matters is the fact that simply presenting accurate data to the misinformed doesn’t always work.
https://www.smh.com.au/politics/federal/truth-decay-defence-force-chief-warns-of-information-warfare-risks-20230915-p5e4w8.html

The most difficult transition in the intelligence community’s history…

‘https://www.cia.gov/static/242fbcb4c50958e6d49fa7a3c2718a05/Getting-to-Know-the-President-Fourth-Edition-2021-web.pdf

Moral courage comes into play when analysts notice their objectivity being suppressed or politicization going on.

“Want I want to convey here is the human dimension of trying to ensure analytic objectivity and avoiding politicization of intelligence.”

‘https://www.cia.gov/static/d826a89c7c1497ab0ef6cde6cab830b6/Article-Zulauf-SafeguardingObjectivityInIntelligenceAnalysis.pdf

“…any time you declassify information, you run the risk of revealing a source, which, in the Russian case, is almost always sensitive.”

“And there’s another danger here that’s equally important, I think, and that is that you give hostile intelligence services an invitation then to deceive you in the future.”
https://www.pbs.org/newshour/show/the-risks-of-politicizing-the-u-s-intelligence-community

–

“As chairman, you swear to support and defend the Constitution of the United States, but what if the commander in chief is undermining the Constitution?”
https://www.theatlantic.com/magazine/archive/2023/11/general-mark-milley-trump-coup/675375/

“War on paper and real war are different. In real war, real people die.”

‘https://edition.cnn.com/2023/09/25/politics/mark-milley-chairman-joint-chiefs-controversial-legacy/index.html

“There is nothing more that can be said,” Kelly concluded.
https://edition.cnn.com/2023/10/02/politics/john-kelly-donald-trump-us-service-members-veterans/index.html

ResearcherZero • October 6, 2023 3:11 AM

Lift the leg of your pants and keep your mouth shut!

“Mr Pratt, who is a Mar-a-Lago member which costs about $USD200,000 and gives him access to the “World of Trump”, met with the fellow billionaire in April 2021.”

‘https://www.skynews.com.au/world-news/global-affairs/donald-trump-allegedly-revealed-sensitive-information-about-us-nuclear-submarines-to-australian-businessman-anthony-pratt/news-story/2ad0c9fae26d3b424ab72a8e8f062085

‘https://www.abc.net.au/news/2023-10-06/donald-trump-allegedly-discussed-nuclear-subs-with-anthony-pratt/102943844

–

Letting the Big Fish Swim

‘https://prospect.org/justice/can-our-legal-system-bring-donald-trump-to-justice/

Buying access to elected officials is, in most cases, not a crime.

‘https://www.reuters.com/legal/cuomo-era-new-york-corruption-cases-go-before-us-supreme-court-2022-11-28/

kickbacks and clemency for wealthy crooks

‘https://www.nytimes.com/2021/03/21/us/politics/trump-pardons.html

In effect, the court has defined corruption in a way that requires prosecutors to prove an explicit quid pro quo agreement.
https://www.washingtonpost.com/news/monkey-cage/wp/2016/07/20/defining-corruption-is-inherently-political-why-do-we-think-the-supreme-court-will-solve-it/

The unprivileged are frequently convicted, rarely the wealthy or connected.

‘https://www.theguardian.com/us-news/2015/oct/18/judge-bias-corrupts-court-cases

“WHEN it comes to poor people arrested for felonies in Scott County, Miss., Judge Marcus D. Gordon doesn’t bother with the Constitution. He refuses to appoint counsel until arrestees have been formally charged by an indictment, which means they must languish in jail without legal representation for as long as a year.”
https://www.nytimes.com/2015/11/27/opinion/how-to-prosecute-abusive-prosecutors.html

ResearcherZero • October 6, 2023 4:37 AM

The VSSE said every Chinese company was legally obliged to provide data to Chinese security services on request, and it believes they have the “intent and capacity to use this data for non-commercial purposes.”

‘https://www.cnn.com/2023/10/05/business/alibaba-belgium-spying-accusations/

(paywalled)

“Cainiao is able to access data about merchants, products, transport details and flows, said a person familiar with its IT systems.”

The site in Liège is the only European logistics centre run by Alibaba’s logistics spin-off Cainiao. It mainly handles goods sold directly to European consumers through the online shopping site AliExpress. Cainiao is applying for a permit to more than triple the size of its warehouses to 100,000 sq m.

One possible espionage risk relates to Cainiao’s software used to streamline logistics procedures, which is part of Alibaba’s “electronic world trade platform” (EWTP).

‘https://www.ft.com/content/256ee824-9710-49d2-a8bc-f173e3f74286

–

“Amazon’s pricing tool would repeatedly lower the price on an item to match its competitor, leading to what insiders dubbed a death spiral.”
https://www.geekwire.com/2023/ftc-targets-alleged-secret-amazon-pricing-algorithm-project-nessie-in-antitrust-complaint/

It is able to block third-party sellers from going elsewhere, and therefore also stop potential rivals from gaining share.

‘https://www.thebignewsletter.com/p/the-ftc-sues-to-break-up-amazon-over

–

Google’s chief argument against public disclosure of its trial is that it might generate “clickbait,” also known as public interest.

‘https://www.theverge.com/2023/9/21/23884734/clickbait-in-my-antitrust-trial

https://www.thebignewsletter.com/p/how-to-hide-a-2-trillion-antitrust

tracking links (html, epub, gmail content, search query, etc)

‘https://www.bloomberg.com/news/features/2023-09-28/google-user-data-is-police-s-top-shortcut-for-solving-crimes

ResearcherZero • October 7, 2023 6:28 AM

Retained a device that allows for access to secure military computer networks and offered the device to Chinese authorities.

‘https://www.justice.gov/opa/pr/former-soldier-indicted-attempting-pass-national-defense-information-peoples-republic-china

ResearcherZero • October 10, 2023 2:00 AM

Place attachment and perception of climate change as a threat in rural and urban areas

“although rural people express higher levels of place attachment than urbanites, climate change is viewed as less of a threat by those living in very rural areas than more urban ones. …Given the more direct connections between rural people and the local environment, it is likely that rural residents are more used to thinking about nature as part of their daily/weekly routines. Being more disconnected from nature, urban inhabitants may be unused to considering nature in this way and so, when forced to do so by climate change, it is considered more frightening as it is less familiar.”

‘https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0290354

In rural areas people often volunteer for emergency services, (fire, first-aid, rescue) in order to maintain those services. Confrontation with fire, floods, and serious injury due to accidents is far more common.

ResearcherZero • October 10, 2023 5:38 AM

@Clive Robinson

Generally a good idea to disable file indexing if not required and concerned about privacy and security.

–

“Russia almost certainly wants to avoid openly sinking civilian ships, instead falsely laying blame on Ukraine for any attacks against civilian vessels in the Black Sea.”

‘https://www.nbcnews.com/news/world/russia-planning-mine-black-sea-target-ukraine-grain-ships-rcna118946

Russian milbloggers continued to exploit Hamas’ attacks in Israel to further Russian information operations on October 8 intended to reduce US and Western support to Ukraine

‘https://www.understandingwar.org/sites/default/files/Russian%20Offensive%20Campaign%20Assessment%2C%20October%208%2C%202023%20%28PDF%29.pdf

The Russian State Social University (RGSU) confirmed that they are testing the “We” platform, a system for generating a social rating of Russians.
https://www.perild.com/2023/10/06/the-we-social-rating-system-is-being-tested-in-russia-it-will-be-used-for-prompt-and-objective-social-support-of-the-population/

The Russian Federal Security Service (FSB) additionally proposed a draft resolution on October 3 that would expand the list of personal and geolocation data that “organizers of information dissemination” (ORIs) are required to store and provide to law enforcement bodies upon request. The FSB’s October 3 proposal notably follows its recent backing of amendments that would allow it unrestricted access to user data of Russian internet, banking, and telecom companies.

‘https://www.understandingwar.org/backgrounder/russian-offensive-campaign-assessment-october-4-2023

“Okhotnik can successfully identify Telegram account admins and owners, using a built-in neural-network method. Personal information is then refined based on the target’s phone number, geolocation data, and IP address. …has official access to current law-enforcement data.”

‘https://meduza.io/en/feature/2023/04/01/hunting-down-the-haters

ResearcherZero • October 11, 2023 1:07 AM

Improvements in North Korean cyber operations.

‘https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023

“The cyber domain is a perfect breeding ground for political disorder and strategic instability”

‘https://www.mdpi.com/2071-1050/14/3/1744

–

Iranian state actors are demonstrating increased sophistication.

Gaza actors increase attacks against Israeli telcommunications, defense and gov.

‘https://www.microsoft.com/content/dam/microsoft/final/en-us/microsoft-brand/documents/MDDR_FINAL_2023_1004.pdf

–

For Iran, its alliance with Hamas is a key point of leverage.

“Iran is building an increasingly capable and cohesive coalition of state security services and foreign militias to execute its rulers’ offensive concepts. This coalition fuses conventional and unconventional means to threaten enemies. They now view their conflict against the US as hybrid in nature, rather than conventional.” (1)

“Increased insecurity in politically sensitive areas will further undermine the legitimacy of military rulers, leading to more internal dissent and creating additional opportunities for insurgents.” (2) “Most weapons are now manufactured in Gaza, using technical expertise from Iran.” (3)

Tehran’s goal goes further than merely maintaining a balance of power with its enemies or ending their influence in the region.
https://newlinesmag.com/reportage/how-irans-missile-strategy-has-rewritten-the-rules-of-middle-eastern-wars/

The surge has occurred alongside an increase in Russian coordination with Iran on planning and intelligence sharing in Syria.

‘https://www.understandingwar.org/backgrounder/salafi-jihadi-movement-weekly-update-july-20-2023

Hamas homemade 140mm rocket launcher
https://bnn.network/world/israel/the-rajum-rocket-launcher-a-new-threat-on-the-battlefield/

1. ‘https://www.aei.org/wp-content/uploads/2023/05/Pivot-to-Offense-How-Iran-Is-Adapting-for-Modern-Conflict-and-Warfare.pdf
2. ‘https://www.understandingwar.org/backgrounder/salafi-jihadi-movement-weekly-update-october-4-2023
3. ‘https://www.nytimes.com/2021/05/13/world/middleeast/gaza-rockets-hamas-israel.html

–

“Here I Remember Something, Nothing There”

History has a habit of serving the same lessons with changed variables. Geopolitics is moving in a multi-polar direction.

‘https://eurasianet.org/perspectives-pakistan-and-india-wage-proxy-struggle-in-nagorno-karabakh

https://www.aljazeera.com/news/2022/10/22/iran-opens-consulate-in-armenias-kapan-to-deliver-a-message

“Darkness is good,” Bannon said. “Dick Cheney. Darth Vader. Satan. That’s power. …It will be as exciting as the 1930s”

‘https://www.cbsnews.com/news/steve-bannon-on-white-nationalism-donald-trumps-agenda/

The biggest danger, of course, is that the Iranians respond, and possibly miscalculate, and then the United States does the same. That’s how wars start.
https://www.newyorker.com/news/daily-comment/the-dangers-posed-by-the-killing-of-qassem-suleimani

ResearcherZero • October 11, 2023 7:47 AM

Intelligence gathering

‘https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks

–

Actor linked to MSS exploiting CVE-2023-22515 (Atlassian Confluence Data Center and Server)

‘https://twitter.com/MsftSecIntel/status/1711871732644970856

“broken access control”

‘https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html

–

Larger credential harvesting campaign – “threat actor is likely opportunistically compromising vulnerable NetScaler Gateways”

‘https://securityintelligence.com/x-force/x-force-uncovers-global-netscaler-gateway-credential-harvesting-campaign/

ResearcherZero • October 13, 2023 2:15 AM

“Once complete, SAWGraph will power an online map that will display contamination sites color-coded based on where the PFAS was found (soil, water, farm, food, domestic or wild animal), the source of the PFAS, and if the area was ever fertilized with wastewater sludge.”

‘https://www.govtech.com/education/higher-ed/umaine-researcher-building-online-tool-to-track-forever-chemicals

3M executive talked about delaying the publication of a study which suggested forever chemicals were hazardous, arguing they first needed to find a way to cover the “weenie” in bread, ketchup and mustard.

‘https://www.smh.com.au/national/the-factory-that-contaminated-the-world-with-a-forever-chemical-20231005-p5e9zx.html

(bread, ketchup and mustard)

https://lobbymap.org/influencer/American-Petroleum-Institute-API

arsenic, uranium, fracking fluids, lead, nitrates, chlorinated disinfection byproducts, and per- and polyfluoroalkyl substances (PFAS)

‘https://www.dailymail.co.uk/sciencetech/article-12595087/toxins-like-arsenic-uranium-drinking-water-americans.html