logo
0
читателей
Jen See  Джен Си музыкант-импровизатор, самоучка. Создает джемы (импровизации) используя разные инструменты (двух-гифовая гитара, драм машина, синтезатор и пр.) в прямом эфире. Hi, I'm Jen See a self-taught music creator thats making songs on-the-fly.
О проекте Просмотр Уровни подписки Фильтры Статистика Обновления проекта Контакты Поделиться Метки
Все проекты
О проекте
Всем привет!
На связи Джен Си с далекой Альфы Центавры!
Если вы любитель разной музыки, экспериментов, импровизаций и космических звуков, то вы там где нужно, здесь вы можете найти много часов авторского контента.
Так же возможно вы когда-нибудь смотрели один из моих стримов (и если вы не смотрели его (https://www.twitch.tv/jen_see), тогда вы знаете, что мы (я и зрители) вытворяем (создаем) используя синты, гитары и другие инструменты и не инструменты.
И если вам нравятся мои стримы и вы хотите поддержать меня, а также получить особые привилегии, ознакомьтесь с уровнями Sponsr =)
Hello!
Jen See from Alpha Centauri in touch!
If you like different kind of music, experimets, improvisations and space sounds then you are in a right place! Here you can find many hours of original content.
If you ever watched one of my streams (and if you didn't check it out (https://www.twitch.tv/jen_see), then you know the drill - you choose song, I sing them, do loops and creating Jams!
And if you like my streams and want to support me, and also gain some very special priviledges, check out the Sponsr tiers =)
Публикации, доступные бесплатно
Уровни подписки
У проекта в настоящий момент нет открытых подписок
Фильтры
Статистика
Обновления проекта
Поделиться
Читать: 1+ мин
logo Jen See

Мысли/ Some thoughts

Пару ‎слов‏ ‎о ‎Джемах: ‎такого ‎рода ‎Джем‏ ‎Сешены ‎начали‏ ‎свое‏ ‎существование ‎в ‎конце‏ ‎декабря ‎2021,‏ ‎и ‎продолжают ‎улучшаться ‎и‏ ‎становиться‏ ‎более ‎интересными‏ ‎(см.стрим ‎),‏ ‎первые ‎10 ‎Джемов ‎это ‎начало‏ ‎развития,‏ ‎начало ‎возможно‏ ‎чего-то ‎большего,‏ ‎а ‎может ‎самого ‎рассвета! ‎

Это‏ ‎удивительный‏ ‎опять‏ ‎для ‎меня,‏ ‎и ‎надеюсь‏ ‎это ‎умение,‏ ‎ощущение‏ ‎или ‎просто‏ ‎творчество ‎будет ‎и ‎дальше ‎развиваться!‏ ‎Посмотрим ‎что‏ ‎будет‏ ‎через ‎год ‎:D‏ ‎

Couple ‎words‏ ‎about ‎Jams: ‎I ‎started‏ ‎creating‏ ‎long ‎Jams‏ ‎in ‎the‏ ‎end ‎of ‎2021 ‎and ‎I‏ ‎try‏ ‎to ‎keep‏ ‎improving ‎and‏ ‎make ‎them ‎more ‎interesting ‎(check‏ ‎streams),‏ ‎first‏ ‎10 ‎Jams‏ ‎are ‎the‏ ‎beginning ‎of‏ ‎smth‏ ‎bigger ‎maybe‏ ‎or ‎it ‎can ‎be ‎the‏ ‎highest ‎hight‏ ‎of‏ ‎my ‎carrier ‎and‏ ‎what ‎I‏ ‎can, ‎who ‎knows? ‎

It‏ ‎is‏ ‎a ‎very‏ ‎extraordinary ‎experience‏ ‎and ‎I'll ‎try ‎my ‎best‏ ‎do‏ ‎make ‎it‏ ‎even ‎more‏ ‎creative! ‎Lets ‎see ‎what ‎will‏ ‎be‏ ‎in‏ ‎one ‎year!


Читать: 3+ мин
logo Snarky Security

Nine Years a Spy: The Epic Saga of Israel vs. the ICC

The ‎nine-year‏ ‎campaign by ‎Israel ‎against ‎the ‎International‏ ‎Criminal ‎Court‏ ‎(ICC)‏ ‎involved ‎a ‎series‏ ‎of ‎covert‏ ‎operations ‎and ‎diplomatic ‎maneuvers‏ ‎aimed‏ ‎at ‎obstructing‏ ‎the ‎court’s‏ ‎investigations ‎into ‎alleged ‎war ‎crimes‏ ‎committed‏ ‎by ‎Israeli‏ ‎leaders.

Timeline ‎and‏ ‎Initiation

📌Start ‎of ‎the ‎Campaign: ‎The‏ ‎campaign‏ ‎began‏ ‎in ‎2015,‏ ‎shortly ‎after‏ ‎Palestine ‎was‏ ‎recognized‏ ‎as ‎a‏ ‎state ‎by ‎the ‎UN ‎General‏ ‎Assembly ‎and‏ ‎joined‏ ‎the ‎ICC. ‎This‏ ‎move ‎was‏ ‎seen ‎by ‎Israeli ‎officials‏ ‎as‏ ‎a ‎significant‏ ‎threat, ‎prompting‏ ‎a ‎coordinated ‎response ‎to ‎protect‏ ‎Israeli‏ ‎leaders ‎from‏ ‎potential ‎prosecutions.

Key‏ ‎Players ‎and ‎Agencies

📌Involved ‎Agencies: The ‎campaign‏ ‎involved‏ ‎multiple‏ ‎Israeli ‎intelligence‏ ‎agencies, ‎including‏ ‎Mossad, ‎Shin‏ ‎Bet‏ ‎(domestic ‎security‏ ‎service), ‎the ‎IDF’s ‎Military ‎Intelligence‏ ‎Directorate, ‎and‏ ‎Unit‏ ‎8200 ‎(cyber-intelligence ‎division).

📌Leadership: The‏ ‎operations ‎were‏ ‎reportedly ‎led ‎by ‎high-ranking‏ ‎officials,‏ ‎including ‎then-Mossad‏ ‎chief ‎Yossi‏ ‎Cohen, ‎who ‎played ‎a ‎central‏ ‎role‏ ‎in ‎the‏ ‎intimidation ‎and‏ ‎espionage ‎efforts ‎against ‎ICC ‎officials.

Tactics‏ ‎and‏ ‎Methods

📌Espionage‏ ‎and ‎Surveillance: Israeli‏ ‎intelligence ‎agencies‏ ‎conducted ‎extensive‏ ‎surveillance‏ ‎on ‎ICC‏ ‎officials, ‎intercepting ‎their ‎communications, ‎including‏ ‎phone ‎calls,‏ ‎emails,‏ ‎and ‎messages. ‎This‏ ‎provided ‎Israel‏ ‎with ‎advance ‎knowledge ‎of‏ ‎the‏ ‎ICC’s ‎plans‏ ‎and ‎allowed‏ ‎them ‎to ‎strategize ‎accordingly.

📌Intimidation ‎and‏ ‎Threats: Cohen‏ ‎and ‎other‏ ‎officials ‎allegedly‏ ‎used ‎threats ‎and ‎intimidation ‎tactics‏ ‎against‏ ‎ICC‏ ‎prosecutors, ‎particularly‏ ‎Fatou ‎Bensouda.‏ ‎These ‎included‏ ‎veiled‏ ‎threats ‎to‏ ‎her ‎and ‎her ‎family’s ‎safety,‏ ‎as ‎well‏ ‎as‏ ‎attempts ‎to ‎discredit‏ ‎her ‎using‏ ‎compromising ‎information.

📌Diplomatic ‎Pressure: Israel ‎also‏ ‎exerted‏ ‎significant ‎diplomatic‏ ‎pressure ‎on‏ ‎other ‎countries ‎and ‎international ‎organizations‏ ‎to‏ ‎isolate ‎the‏ ‎ICC ‎and‏ ‎discourage ‎it ‎from ‎pursuing ‎investigations‏ ‎against‏ ‎Israeli‏ ‎leaders.

Specific ‎Incidents

📌Threats‏ ‎to ‎Bensouda: Cohen‏ ‎reportedly ‎threatened‏ ‎Bensouda‏ ‎in ‎a‏ ‎series ‎of ‎clandestine ‎meetings, ‎suggesting‏ ‎that ‎her‏ ‎security‏ ‎and ‎that ‎of‏ ‎her ‎family‏ ‎could ‎be ‎compromised ‎if‏ ‎she‏ ‎continued ‎with‏ ‎the ‎investigation.‏ ‎These ‎threats ‎were ‎part ‎of‏ ‎a‏ ‎broader ‎effort‏ ‎to ‎intimidate‏ ‎her ‎into ‎abandoning ‎the ‎probe.

📌Intercepted‏ ‎Communications: Israeli‏ ‎intelligence‏ ‎intercepted ‎communications‏ ‎between ‎ICC‏ ‎officials ‎and‏ ‎Palestinian‏ ‎contacts, ‎gaining‏ ‎insights ‎into ‎the ‎court’s ‎investigative‏ ‎steps ‎and‏ ‎using‏ ‎this ‎information ‎to‏ ‎preemptively ‎counteract‏ ‎the ‎ICC’s ‎actions.

Impact ‎and‏ ‎Response

📌Effectiveness:‏ ‎Despite ‎these‏ ‎efforts, ‎the‏ ‎campaign ‎ultimately ‎failed ‎to ‎prevent‏ ‎the‏ ‎ICC ‎from‏ ‎pursuing ‎its‏ ‎investigations. ‎In ‎March ‎2021, ‎Bensouda‏ ‎announced‏ ‎the‏ ‎opening ‎of‏ ‎a ‎formal‏ ‎investigation ‎into‏ ‎alleged‏ ‎war ‎crimes‏ ‎in ‎the ‎Palestinian ‎territories.

📌Continued ‎Efforts: The‏ ‎campaign ‎continued‏ ‎under‏ ‎Bensouda’s ‎successor, ‎Karim‏ ‎Khan, ‎who‏ ‎has ‎also ‎faced ‎similar‏ ‎pressures‏ ‎and ‎threats.‏ ‎Khan ‎recently‏ ‎sought ‎arrest ‎warrants ‎for ‎Israeli‏ ‎leaders,‏ ‎including ‎Prime‏ ‎Minister ‎Benjamin‏ ‎Netanyahu, ‎marking ‎a ‎significant ‎escalation‏ ‎in‏ ‎the‏ ‎ICC’s ‎efforts.

International‏ ‎Reaction

📌Condemnation ‎and‏ ‎Support: The ‎international‏ ‎community,‏ ‎including ‎human‏ ‎rights ‎organizations, ‎has ‎condemned ‎Israel’s‏ ‎actions ‎against‏ ‎the‏ ‎ICC. ‎The ‎ICC‏ ‎has ‎implemented‏ ‎countermeasures ‎to ‎protect ‎its‏ ‎staff‏ ‎and ‎ensure‏ ‎the ‎integrity‏ ‎of ‎its ‎investigations.

Читать: 4+ мин
logo Overkill Security

Passkeys: Making Phishing Scams Work a Little Harder

The ‎introduction‏ ‎and ‎support ‎of ‎passkeys ‎by‏ ‎Apple ‎and‏ ‎Google mark‏ ‎a ‎significant ‎step‏ ‎towards ‎a‏ ‎more ‎secure ‎and ‎user-friendly‏ ‎authentication‏ ‎method. ‎This‏ ‎technology ‎is‏ ‎poised ‎to ‎have ‎a ‎substantial‏ ‎impact‏ ‎on ‎various‏ ‎industries ‎by‏ ‎enhancing ‎security, ‎improving ‎user ‎experience,‏ ‎and‏ ‎driving‏ ‎the ‎adoption‏ ‎of ‎passwordless‏ ‎authentication ‎solutions.

Technical‏ ‎Key‏ ‎Points

Passkeys ‎Overview:

📌Passkeys‏ ‎are ‎digital ‎credentials ‎that ‎enable‏ ‎passwordless ‎authentication‏ ‎using‏ ‎private ‎cryptographic ‎keys.‏ ‎They ‎are‏ ‎designed ‎to ‎be ‎more‏ ‎secure‏ ‎and ‎user-friendly‏ ‎than ‎traditional‏ ‎passwords.

📌Passkeys ‎use ‎biometric ‎identification ‎(e.g.,‏ ‎fingerprint,‏ ‎face ‎scan)‏ ‎or ‎a‏ ‎screen ‎lock ‎PIN ‎to ‎authenticate‏ ‎users,‏ ‎making‏ ‎them ‎resistant‏ ‎to ‎phishing‏ ‎attacks.

Apple’s ‎Implementation:

📌Apple‏ ‎has‏ ‎introduced ‎an‏ ‎API ‎that ‎allows ‎passkeys ‎to‏ ‎work ‎with‏ ‎third-party‏ ‎software, ‎enhancing ‎their‏ ‎usability ‎across‏ ‎different ‎applications ‎and ‎platforms.

📌Passkeys‏ ‎are‏ ‎supported ‎on‏ ‎Safari ‎and‏ ‎can ‎be ‎synchronized ‎across ‎Apple‏ ‎devices‏ ‎using ‎iCloud‏ ‎Keychain. ‎This‏ ‎synchronization ‎ensures ‎that ‎passkeys ‎are‏ ‎available‏ ‎on‏ ‎all ‎devices‏ ‎signed ‎into‏ ‎the ‎same‏ ‎iCloud‏ ‎account.

📌Managed ‎Apple‏ ‎IDs ‎support ‎passkey ‎synchronization, ‎allowing‏ ‎third-party ‎password‏ ‎managers‏ ‎like ‎1Password ‎and‏ ‎Dashlane ‎to‏ ‎save ‎and ‎exchange ‎passkeys‏ ‎across‏ ‎iOS, ‎iPadOS,‏ ‎and ‎macOS.

Google’s‏ ‎Implementation:

📌Google ‎has ‎rolled ‎out ‎passkey‏ ‎support‏ ‎across ‎Google‏ ‎Accounts ‎on‏ ‎all ‎major ‎platforms, ‎providing ‎an‏ ‎additional‏ ‎sign-in‏ ‎option ‎alongside‏ ‎passwords ‎and‏ ‎2-Step ‎Verification‏ ‎(2SV).

📌Passkeys‏ ‎can ‎be‏ ‎created ‎and ‎used ‎on ‎multiple‏ ‎devices, ‎and‏ ‎they‏ ‎are ‎backed ‎up‏ ‎and ‎synchronized‏ ‎across ‎devices ‎that ‎support‏ ‎them,‏ ‎such ‎as‏ ‎those ‎using‏ ‎the ‎same ‎Google ‎account.

📌Google ‎Workspace‏ ‎and‏ ‎Google ‎Cloud‏ ‎users ‎can‏ ‎now ‎log ‎into ‎their ‎accounts‏ ‎using‏ ‎passkeys,‏ ‎enhancing ‎security‏ ‎for ‎business‏ ‎users.

Cross-Platform ‎Support:

📌Chrome‏ ‎on‏ ‎macOS ‎now‏ ‎supports ‎passkeys ‎stored ‎in ‎iCloud‏ ‎Keychain, ‎allowing‏ ‎users‏ ‎to ‎create ‎and‏ ‎use ‎passkeys‏ ‎across ‎different ‎browsers ‎and‏ ‎devices‏ ‎within ‎the‏ ‎Apple ‎ecosystem.

📌The‏ ‎API ‎behaviors ‎for ‎passkeys ‎are‏ ‎consistent‏ ‎across ‎Safari‏ ‎and ‎Chrome,‏ ‎ensuring ‎a ‎seamless ‎user ‎experience.


Impact‏ ‎on‏ ‎Industries

Enhanced‏ ‎Security:

📌Passkeys ‎provide‏ ‎a ‎higher‏ ‎level ‎of‏ ‎security‏ ‎compared ‎to‏ ‎traditional ‎passwords ‎and ‎even ‎some‏ ‎multifactor ‎authentication‏ ‎(MFA)‏ ‎methods. ‎They ‎are‏ ‎resistant ‎to‏ ‎phishing ‎and ‎other ‎online‏ ‎attacks,‏ ‎reducing ‎the‏ ‎risk ‎of‏ ‎credential ‎theft.

📌By ‎eliminating ‎the ‎need‏ ‎for‏ ‎passwords, ‎passkeys‏ ‎reduce ‎the‏ ‎likelihood ‎of ‎password-related ‎security ‎breaches,‏ ‎such‏ ‎as‏ ‎those ‎caused‏ ‎by ‎weak‏ ‎or ‎reused‏ ‎passwords.

Improved‏ ‎User ‎Experience:

📌Passkeys‏ ‎streamline ‎the ‎authentication ‎process, ‎making‏ ‎it ‎faster‏ ‎and‏ ‎more ‎convenient ‎for‏ ‎users ‎to‏ ‎log ‎in ‎to ‎their‏ ‎accounts.‏ ‎For ‎example,‏ ‎Google ‎reported‏ ‎that ‎users ‎could ‎authenticate ‎with‏ ‎passkeys‏ ‎in ‎an‏ ‎average ‎of‏ ‎14.9 ‎seconds, ‎compared ‎to ‎30.4‏ ‎seconds‏ ‎with‏ ‎passwords.

📌The ‎use‏ ‎of ‎biometric‏ ‎authentication ‎(e.g.,‏ ‎Face‏ ‎ID, ‎Touch‏ ‎ID) ‎simplifies ‎the ‎login ‎process,‏ ‎reducing ‎the‏ ‎cognitive‏ ‎load ‎on ‎users‏ ‎who ‎no‏ ‎longer ‎need ‎to ‎remember‏ ‎complex‏ ‎passwords.

Adoption ‎by‏ ‎Enterprises:

📌Enterprises ‎can‏ ‎benefit ‎from ‎the ‎enhanced ‎security‏ ‎and‏ ‎user ‎experience‏ ‎provided ‎by‏ ‎passkeys. ‎For ‎instance, ‎Google ‎Workspace‏ ‎and‏ ‎Google‏ ‎Cloud ‎users‏ ‎can ‎now‏ ‎use ‎passkeys‏ ‎for‏ ‎secure ‎and‏ ‎efficient ‎access ‎to ‎their ‎accounts.

📌The‏ ‎integration ‎of‏ ‎passkeys‏ ‎into ‎third-party ‎applications‏ ‎and ‎password‏ ‎managers ‎allows ‎businesses ‎to‏ ‎adopt‏ ‎this ‎technology‏ ‎without ‎significant‏ ‎changes ‎to ‎their ‎existing ‎infrastructure.

Industry‏ ‎Momentum:

📌The‏ ‎collaboration ‎between‏ ‎major ‎tech‏ ‎companies ‎like ‎Apple, ‎Google, ‎and‏ ‎Microsoft,‏ ‎along‏ ‎with ‎the‏ ‎FIDO ‎Alliance,‏ ‎is ‎driving‏ ‎the‏ ‎adoption ‎of‏ ‎passkeys ‎across ‎the ‎industry. ‎This‏ ‎collective ‎effort‏ ‎is‏ ‎likely ‎to ‎accelerate‏ ‎the ‎transition‏ ‎to ‎a ‎passwordless ‎future.

📌The‏ ‎support‏ ‎for ‎passkeys‏ ‎in ‎popular‏ ‎browsers ‎and ‎operating ‎systems ‎ensures‏ ‎broad‏ ‎compatibility ‎and‏ ‎encourages ‎more‏ ‎organizations ‎to ‎adopt ‎this ‎technology.

Читать: 7+ мин
logo Snarky Security

The European Union, where grand gestures and sternly-worded press releases are the epitome of effective action.

Today, ‎we‏ ‎celebrate ‎the ‎EU’s ‎latest ‎triumph‏ ‎in ‎the‏ ‎fight‏ ‎against ‎cybercrime: ‎adding‏ ‎six ‎people‏ ‎to ‎a ‎sanctions ‎list.‏ ‎Yes,‏ ‎you ‎read‏ ‎that ‎right‏ ‎— ‎six ‎whole ‎people. ‎The‏ ‎scourge‏ ‎of ‎cyber-attacks‏ ‎must ‎be‏ ‎shaking ‎in ‎its ‎digital ‎boots.

In‏ ‎a‏ ‎bold‏ ‎move, ‎the‏ ‎EU ‎has‏ ‎decided ‎to‏ ‎freeze‏ ‎the ‎assets‏ ‎of ‎these ‎six ‎individuals ‎and‏ ‎ban ‎them‏ ‎from‏ ‎traveling ‎to ‎the‏ ‎EU. ‎Oh,‏ ‎the ‎horror ‎No ‎more‏ ‎sipping‏ ‎espresso ‎in‏ ‎Paris ‎or‏ ‎strolling ‎along ‎the ‎canals ‎of‏ ‎Amsterdam‏ ‎for ‎these‏ ‎cyber ‎warriors.‏ ‎The ‎EU ‎has ‎truly ‎outdone‏ ‎itself‏ ‎this‏ ‎time.

But ‎wait,‏ ‎there’s ‎more‏ ‎The ‎EU‏ ‎has‏ ‎also ‎vowed‏ ‎to ‎«step ‎up ‎efforts ‎to‏ ‎provide ‎a‏ ‎stronger‏ ‎response ‎to ‎persistent‏ ‎malicious ‎cyber‏ ‎activities.» ‎Because, ‎you ‎know,‏ ‎that’s‏ ‎exactly ‎what’s‏ ‎been ‎missing‏ ‎— ‎a ‎stronger ‎response. ‎Not,‏ ‎say,‏ ‎actual ‎action‏ ‎or ‎tangible‏ ‎results, ‎but ‎a ‎stronger ‎response.‏ ‎That’s‏ ‎sure‏ ‎to ‎strike‏ ‎fear ‎into‏ ‎the ‎hearts‏ ‎of‏ ‎everyone ‎everywhere.

And‏ ‎let’s ‎not ‎forget ‎the ‎EU’s‏ ‎impressive ‎track‏ ‎record‏ ‎on ‎cybersecurity.

The ‎EU’s‏ ‎Greatest ‎Hits‏ ‎in ‎Cyber ‎Sanctions:

2020: The ‎First‏ ‎Ever‏ ‎Cyber ‎Sanctions:

📌Target: Six‏ ‎individuals ‎and‏ ‎three ‎entities.

📌Actions: Travel ‎bans, ‎asset ‎freezes,‏ ‎and‏ ‎prohibitions ‎on‏ ‎EU ‎entities‏ ‎making ‎funds ‎available ‎to ‎the‏ ‎sanctioned‏ ‎parties.

📌Impact: Groundbreaking,‏ ‎in ‎the‏ ‎sense ‎that‏ ‎it ‎was‏ ‎the‏ ‎first ‎time‏ ‎the ‎EU ‎decided ‎to ‎«bite‏ ‎back» ‎at‏ ‎cyber‏ ‎warriors. ‎But ‎did‏ ‎it ‎stop‏ ‎the ‎cyber ‎onslaught? ‎Not‏ ‎really.‏ ‎Cyberattacks ‎continued‏ ‎to ‎rise,‏ ‎and ‎the ‎EU’s ‎digital ‎defenses‏ ‎remained‏ ‎as ‎porous‏ ‎as ‎ever.

2023: Sanctions‏ ‎on ‎Russian ‎Hackers:

📌Target: Eleven ‎Russian ‎nationals‏ ‎involved‏ ‎in‏ ‎the ‎Trickbot‏ ‎and ‎Conti‏ ‎ransomware ‎schemes.

📌Actions: Similar‏ ‎to‏ ‎the ‎2020‏ ‎sanctions ‎— ‎travel ‎bans ‎and‏ ‎asset ‎freezes.

📌Impact: The‏ ‎sanctions‏ ‎were ‎more ‎about‏ ‎making ‎a‏ ‎statement ‎than ‎causing ‎any‏ ‎real‏ ‎disruption. ‎The‏ ‎hackers ‎continued‏ ‎their ‎operations, ‎and ‎the ‎EU’s‏ ‎cybersecurity‏ ‎landscape ‎saw‏ ‎little ‎improvement.

2024: The‏ ‎Latest ‎Sanctions:

📌Target: Six ‎individuals, ‎including ‎members‏ ‎of‏ ‎notorious‏ ‎groups ‎like‏ ‎Wizard ‎Spider‏ ‎and ‎Callisto.

📌Actions: You‏ ‎guessed‏ ‎it ‎—‏ ‎travel ‎bans, ‎asset ‎freezes, ‎and‏ ‎prohibitions ‎on‏ ‎transactions‏ ‎with ‎EU ‎entities.

📌Impact: The‏ ‎EU ‎proudly‏ ‎announced ‎that ‎this ‎was‏ ‎the‏ ‎first ‎time‏ ‎they ‎targeted‏ ‎cyber ‎warriors ‎using ‎ransomware ‎against‏ ‎essential‏ ‎services ‎like‏ ‎healthcare ‎and‏ ‎banking. ‎But ‎let’s ‎be ‎real‏ ‎—‏ ‎the‏ ‎hackers ‎are‏ ‎probably ‎not‏ ‎losing ‎sleep‏ ‎over‏ ‎their ‎inability‏ ‎to ‎vacation ‎in ‎the ‎French‏ ‎Riviera.


The ‎EU’s‏ ‎To-Do‏ ‎List ‎for ‎Cyber‏ ‎Sanctions:

📌Identify ‎a‏ ‎few ‎cybercriminals: ‎Six ‎individuals,‏ ‎to‏ ‎be ‎precise.‏ ‎Because, ‎you‏ ‎know, ‎cybercrime ‎is ‎totally ‎limited‏ ‎to‏ ‎just ‎a‏ ‎handful ‎of‏ ‎people.

📌Freeze ‎their ‎assets: ‎Because ‎nothing‏ ‎says‏ ‎«we‏ ‎mean ‎business»‏ ‎like ‎preventing‏ ‎these ‎hackers‏ ‎from‏ ‎accessing ‎their‏ ‎European ‎vacation ‎funds.

📌Ban ‎them ‎from‏ ‎traveling ‎to‏ ‎the‏ ‎EU: ‎Now ‎they‏ ‎can’t ‎enjoy‏ ‎the ‎Eiffel ‎Tower ‎or‏ ‎the‏ ‎Colosseum. ‎That’ll‏ ‎teach ‎them.

📌Issue‏ ‎a ‎press ‎release: The ‎pièce ‎de‏ ‎résistance.‏ ‎A ‎strongly‏ ‎worded ‎statement‏ ‎to ‎show ‎the ‎world ‎that‏ ‎the‏ ‎EU‏ ‎is ‎on‏ ‎top ‎of‏ ‎things.


The ‎Reality:

📌Impact‏ ‎on‏ ‎Cybercrime: ‎Minimal,‏ ‎if ‎any. ‎Cyberattacks ‎from ‎Russian‏ ‎groups ‎like‏ ‎Fancy‏ ‎Bear ‎and ‎Wizard‏ ‎Spider ‎continue‏ ‎unabated, ‎targeting ‎critical ‎infrastructure‏ ‎and‏ ‎causing ‎significant‏ ‎economic ‎damage.

📌Deterrence:‏ ‎Questionable. ‎The ‎sanctions ‎are ‎more‏ ‎about‏ ‎making ‎a‏ ‎public ‎statement‏ ‎than ‎actually ‎disrupting ‎the ‎operations‏ ‎of‏ ‎these‏ ‎cybercriminals.

📌Operational ‎Effectiveness: The‏ ‎EU’s ‎sanctions‏ ‎are ‎often‏ ‎seen‏ ‎as ‎a‏ ‎tactic ‎to ‎sow ‎discord ‎within‏ ‎cybercriminal ‎groups‏ ‎rather‏ ‎than ‎a ‎direct‏ ‎financial ‎hit.‏ ‎Naming ‎and ‎shaming ‎might‏ ‎stress‏ ‎some ‎relationships,‏ ‎but ‎it‏ ‎hardly ‎stops ‎the ‎attacks.


Money

Ah, ‎the‏ ‎EU’s‏ ‎grand ‎strategy‏ ‎to ‎prevent‏ ‎cyberattacks ‎— ‎a ‎tale ‎of‏ ‎throwing‏ ‎money‏ ‎at ‎the‏ ‎problem ‎and‏ ‎hoping ‎it‏ ‎goes‏ ‎away. ‎Let’s‏ ‎take ‎a ‎look ‎at ‎how‏ ‎the ‎EU‏ ‎has‏ ‎been ‎filling ‎its‏ ‎coffers ‎and‏ ‎what ‎they’ve ‎been ‎doing‏ ‎with‏ ‎all ‎that‏ ‎cash.

The ‎EU’s‏ ‎Cybersecurity ‎Funding ‎Extravaganza

Horizon ‎Europe:

📌Budget: €15 billion ‎for‏ ‎digital‏ ‎and ‎industry-related‏ ‎projects, ‎including‏ ‎cybersecurity.

📌Focus: Research ‎into ‎cutting-edge ‎technologies ‎like‏ ‎AI‏ ‎and‏ ‎quantum ‎computing‏ ‎to ‎bolster‏ ‎cybersecurity.

Digital ‎Europe‏ ‎Programme:

📌Budget: €1.6 billion‏ ‎specifically ‎for‏ ‎cybersecurity, ‎out ‎of ‎a ‎total‏ ‎€7.5 ‎billion‏ ‎for‏ ‎various ‎digital ‎initiatives.

📌Focus: Building‏ ‎European ‎cybersecurity‏ ‎infrastructures, ‎promoting ‎state-of-the-art ‎practices,‏ ‎and‏ ‎enhancing ‎digital‏ ‎sovereignty.

European ‎Cybersecurity‏ ‎Competence ‎Centre ‎(ECCC):

📌Role: Manages ‎projects ‎funded‏ ‎by‏ ‎the ‎Digital‏ ‎Europe ‎Programme‏ ‎and ‎other ‎initiatives.

📌Focus: Strengthening ‎the ‎cybersecurity‏ ‎ecosystem,‏ ‎supporting‏ ‎national ‎SOCs,‏ ‎and ‎developing‏ ‎advanced ‎technologies.

Connecting‏ ‎Europe‏ ‎Facility ‎(CEF):

📌Budget: Part‏ ‎of ‎the ‎€2 ‎trillion ‎Recovery‏ ‎Plan ‎for‏ ‎Europe.

📌Focus: High-performance‏ ‎digital ‎infrastructure, ‎secure‏ ‎communication ‎networks,‏ ‎and ‎cybersecurity ‎enhancements.

European ‎Defence‏ ‎Fund‏ ‎(EDF):

📌Budget: €60 million ‎for‏ ‎2023.

📌Focus: Cybersecurity ‎solutions‏ ‎for ‎defense ‎systems ‎and ‎enhancing‏ ‎the‏ ‎cybersecurity ‎of‏ ‎defense ‎infrastructure.


The‏ ‎Extra ‎Reality

📌Throwing ‎Money ‎at ‎the‏ ‎Problem:‏ ‎The‏ ‎EU ‎has‏ ‎certainly ‎not‏ ‎been ‎shy‏ ‎about‏ ‎allocating ‎funds‏ ‎to ‎cybersecurity. ‎With ‎billions ‎earmarked‏ ‎for ‎various‏ ‎programs,‏ ‎you’d ‎think ‎they’d‏ ‎have ‎this‏ ‎cyber ‎thing ‎under ‎control‏ ‎by‏ ‎now. ‎But‏ ‎alas, ‎the‏ ‎cyberattacks ‎keep ‎coming, ‎and ‎the‏ ‎hackers‏ ‎are ‎still‏ ‎having ‎a‏ ‎field ‎day.

📌Research ‎and ‎Innovation: Sure, ‎investing‏ ‎in‏ ‎AI,‏ ‎quantum ‎computing,‏ ‎and ‎other‏ ‎advanced ‎technologies‏ ‎sounds‏ ‎impressive. ‎But‏ ‎how ‎much ‎of ‎this ‎research‏ ‎actually ‎translates‏ ‎into‏ ‎real-world ‎protection ‎against‏ ‎cyber ‎threats?‏ ‎It’s ‎like ‎buying ‎a‏ ‎fancy‏ ‎alarm ‎system‏ ‎but ‎forgetting‏ ‎to ‎lock ‎the ‎front ‎door.

📌Building‏ ‎Infrastructures:‏ ‎The ‎EU‏ ‎is ‎all‏ ‎about ‎building ‎robust ‎cybersecurity ‎infrastructures‏ ‎and‏ ‎promoting‏ ‎best ‎practices.‏ ‎Yet, ‎despite‏ ‎these ‎efforts,‏ ‎the‏ ‎digital ‎landscape‏ ‎remains ‎as ‎vulnerable ‎as ‎ever.‏ ‎It’s ‎like‏ ‎constructing‏ ‎a ‎fortress ‎with‏ ‎a ‎drawbridge‏ ‎that ‎never ‎quite ‎closes.

📌Supporting‏ ‎SMEs:‏ ‎The ‎EU‏ ‎has ‎initiatives‏ ‎like ‎CYSSME ‎to ‎help ‎small‏ ‎and‏ ‎medium-sized ‎enterprises‏ ‎(SMEs) ‎with‏ ‎their ‎cybersecurity ‎needs. ‎While ‎this‏ ‎is‏ ‎commendable,‏ ‎the ‎reality‏ ‎is ‎that‏ ‎many ‎SMEs‏ ‎still‏ ‎struggle ‎with‏ ‎basic ‎cybersecurity ‎measures. ‎It’s ‎like‏ ‎giving ‎a‏ ‎band-aid‏ ‎to ‎someone ‎with‏ ‎a ‎broken‏ ‎leg.

📌Grand ‎Plans, ‎Minimal ‎Impact:‏ ‎The‏ ‎EU’s ‎funding‏ ‎programs ‎are‏ ‎filled ‎with ‎grand ‎plans ‎and‏ ‎ambitious‏ ‎goals. ‎But‏ ‎when ‎it‏ ‎comes ‎to ‎actual ‎impact, ‎the‏ ‎results‏ ‎are‏ ‎underwhelming. ‎Cyberattacks‏ ‎continue ‎to‏ ‎rise, ‎and‏ ‎the‏ ‎EU’s ‎digital‏ ‎defenses ‎seem ‎perpetually ‎one ‎step‏ ‎behind ‎the‏ ‎attackers.


Conclusion

So,‏ ‎what ‎exactly ‎did‏ ‎the ‎EU‏ ‎do ‎to ‎prevent ‎these‏ ‎cyberattacks?‏ ‎They ‎threw‏ ‎a ‎lot‏ ‎of ‎money ‎at ‎the ‎problem,‏ ‎set‏ ‎up ‎numerous‏ ‎funding ‎programs,‏ ‎and ‎issued ‎a ‎slew ‎of‏ ‎press‏ ‎releases.‏ ‎And ‎how‏ ‎effective ‎are‏ ‎these ‎sanctions‏ ‎and‏ ‎funding ‎efforts‏ ‎in ‎stopping ‎cyberattacks? ‎Well, ‎let’s‏ ‎just ‎say‏ ‎the‏ ‎hackers ‎are ‎still‏ ‎laughing ‎all‏ ‎the ‎way ‎to ‎the‏ ‎(digital)‏ ‎bank. ‎But‏ ‎hey, ‎at‏ ‎least ‎the ‎EU ‎can ‎say‏ ‎they’re‏ ‎doing ‎something,‏ ‎right?

Читать: 14+ мин
logo Snarky Security

The Globalization’s Revenge: Navigating the Maze of Inaccuracy

The ‎use‏ ‎of ‎different ‎GPS ‎standards ‎or‏ ‎the ‎implementation‏ ‎of‏ ‎GPS ‎jamming ‎and‏ ‎spoofing ‎in‏ ‎India, ‎Israel ‎and ‎Palestine,‏ ‎North‏ ‎Korea, ‎Westchester‏ ‎County, ‎New‏ ‎York, ‎and ‎Antarctica ‎is ‎driven‏ ‎by‏ ‎various ‎strategic,‏ ‎security, ‎and‏ ‎environmental ‎factors

China

📌BeiDou ‎Navigation ‎Satellite ‎System‏ ‎(BDS):‏ ‎China‏ ‎uses ‎its‏ ‎own ‎BeiDou‏ ‎system, ‎which‏ ‎has‏ ‎been ‎recognized‏ ‎as ‎a ‎global ‎standard ‎for‏ ‎commercial ‎aviation‏ ‎and‏ ‎other ‎applications. ‎It‏ ‎provides ‎both‏ ‎civilian ‎and ‎military ‎services‏ ‎and‏ ‎is ‎part‏ ‎of ‎China’s‏ ‎strategy ‎to ‎achieve ‎technological ‎self-sufficiency‏ ‎and‏ ‎reduce ‎dependency‏ ‎on ‎the‏ ‎U.S. ‎GPS.

📌Obfuscation ‎Algorithm: The ‎GCJ-02 ‎system,‏ ‎also‏ ‎known‏ ‎as ‎«Mars‏ ‎Coordinates,» ‎uses‏ ‎an ‎obfuscation‏ ‎algorithm‏ ‎that ‎introduces‏ ‎random ‎offsets ‎to ‎latitude ‎and‏ ‎longitude ‎coordinates.‏ ‎This‏ ‎is ‎intended ‎to‏ ‎prevent ‎accurate‏ ‎mapping ‎by ‎foreign ‎entities,‏ ‎which‏ ‎could ‎be‏ ‎used ‎for‏ ‎military ‎or ‎intelligence ‎purposes.

📌Legal ‎Framework: The‏ ‎Surveying‏ ‎and ‎Mapping‏ ‎Law ‎of‏ ‎the ‎People’s ‎Republic ‎of ‎China‏ ‎mandates‏ ‎that‏ ‎all ‎geographic‏ ‎data ‎must‏ ‎be ‎processed‏ ‎using‏ ‎the ‎GCJ-02‏ ‎system. ‎Unauthorized ‎mapping ‎or ‎surveying‏ ‎activities ‎are‏ ‎strictly‏ ‎prohibited ‎and ‎can‏ ‎result ‎in‏ ‎severe ‎penalties, ‎including ‎fines‏ ‎and‏ ‎legal ‎action.‏ ‎Companies ‎providing‏ ‎location-based ‎services ‎in ‎China ‎must‏ ‎obtain‏ ‎authorization ‎from‏ ‎the ‎Chinese‏ ‎government ‎and ‎use ‎the ‎GCJ-02‏ ‎system.‏ ‎This‏ ‎includes ‎purchasing‏ ‎a ‎«shift‏ ‎correction» ‎algorithm‏ ‎to‏ ‎align ‎GPS‏ ‎coordinates ‎correctly ‎on ‎maps.

📌Cold ‎War‏ ‎Era: The ‎use‏ ‎of‏ ‎a ‎different ‎coordinate‏ ‎system ‎dates‏ ‎back ‎to ‎the ‎Cold‏ ‎War‏ ‎era, ‎aimed‏ ‎at ‎frustrating‏ ‎foreign ‎intelligence ‎efforts. ‎The ‎GCJ-02‏ ‎system‏ ‎continues ‎to‏ ‎serve ‎this‏ ‎purpose ‎by ‎ensuring ‎that ‎geographic‏ ‎data‏ ‎within‏ ‎China ‎cannot‏ ‎be ‎easily‏ ‎used ‎for‏ ‎unauthorized‏ ‎purposes.

📌Daily ‎Navigation: For‏ ‎users ‎in ‎China, ‎this ‎means‏ ‎that ‎GPS‏ ‎devices‏ ‎and ‎applications ‎may‏ ‎show ‎their‏ ‎location ‎inaccurately ‎on ‎maps‏ ‎unless‏ ‎they ‎use‏ ‎local ‎services‏ ‎like ‎Baidu ‎Maps, ‎which ‎also‏ ‎employs‏ ‎an ‎additional‏ ‎layer ‎of‏ ‎obfuscation ‎called ‎BD-09.

📌Device ‎Restrictions: Many ‎GPS-enabled‏ ‎devices,‏ ‎including‏ ‎cameras ‎and‏ ‎smartphones, ‎have‏ ‎restrictions ‎or‏ ‎modifications‏ ‎to ‎comply‏ ‎with ‎Chinese ‎laws. ‎This ‎can‏ ‎include ‎disabling‏ ‎geotagging‏ ‎features ‎or ‎using‏ ‎modified ‎GPS‏ ‎chips ‎that ‎align ‎with‏ ‎GCJ-02.

India

📌Indian‏ ‎Regional ‎Navigation‏ ‎Satellite ‎System‏ ‎(IRNSS): ‎India ‎has ‎developed ‎its‏ ‎own‏ ‎regional ‎navigation‏ ‎system, ‎known‏ ‎as ‎NavIC ‎(Navigation ‎with ‎Indian‏ ‎Constellation),‏ ‎to‏ ‎reduce ‎dependency‏ ‎on ‎foreign‏ ‎GPS ‎systems‏ ‎like‏ ‎the ‎U.S.‏ ‎GPS. ‎This ‎system ‎ensures ‎regional‏ ‎self-reliance, ‎enhances‏ ‎positioning‏ ‎accuracy, ‎and ‎provides‏ ‎strategic ‎advantages,‏ ‎especially ‎for ‎military ‎operations.

📌Strategic‏ ‎Autonomy: The‏ ‎development ‎of‏ ‎NavIC ‎was‏ ‎partly ‎motivated ‎by ‎the ‎denial‏ ‎of‏ ‎GPS ‎data‏ ‎by ‎the‏ ‎U.S. ‎during ‎the ‎Kargil ‎War‏ ‎in‏ ‎1999.‏ ‎NavIC ‎provides‏ ‎India ‎with‏ ‎an ‎independent‏ ‎and‏ ‎reliable ‎navigation‏ ‎system ‎that ‎can ‎be ‎used‏ ‎for ‎both‏ ‎civilian‏ ‎and ‎military ‎purposes.

Israel‏ ‎and ‎Palestine

📌GPS‏ ‎Jamming ‎and ‎Spoofing: Israel ‎uses‏ ‎GPS‏ ‎jamming ‎and‏ ‎spoofing ‎as‏ ‎defensive ‎measures ‎to ‎protect ‎against‏ ‎potential‏ ‎attacks ‎from‏ ‎adversaries ‎like‏ ‎Hezbollah ‎and ‎Iran. ‎This ‎jamming‏ ‎can‏ ‎disrupt‏ ‎enemy ‎navigation‏ ‎systems ‎and‏ ‎precision-guided ‎weapons,‏ ‎but‏ ‎it ‎also‏ ‎affects ‎civilian ‎GPS ‎services, ‎causing‏ ‎inaccuracies ‎in‏ ‎location‏ ‎data ‎for ‎apps‏ ‎like ‎Google‏ ‎Maps ‎and ‎Uber.

📌Security ‎Measures: The‏ ‎use‏ ‎of ‎GPS‏ ‎jamming ‎is‏ ‎primarily ‎for ‎defensive ‎purposes, ‎to‏ ‎prevent‏ ‎the ‎use‏ ‎of ‎GPS-guided‏ ‎munitions ‎by ‎adversaries. ‎This ‎has‏ ‎led‏ ‎to‏ ‎significant ‎disruptions‏ ‎in ‎civilian‏ ‎navigation ‎and‏ ‎communication‏ ‎systems ‎in‏ ‎the ‎region.

North ‎Korea

📌GLONASS ‎and ‎BeiDou:‏ ‎North ‎Korea‏ ‎avoids‏ ‎using ‎the ‎U.S.‏ ‎GPS ‎due‏ ‎to ‎concerns ‎about ‎potential‏ ‎disruption‏ ‎by ‎the‏ ‎U.S. ‎military.‏ ‎Instead, ‎it ‎uses ‎Russia’s ‎GLONASS‏ ‎and‏ ‎China’s ‎BeiDou‏ ‎systems ‎for‏ ‎its ‎navigation ‎needs, ‎including ‎missile‏ ‎tests.

📌GPS‏ ‎Jamming:‏ ‎North ‎Korea‏ ‎has ‎been‏ ‎known ‎to‏ ‎jam‏ ‎GPS ‎signals,‏ ‎particularly ‎in ‎the ‎Yellow ‎Sea,‏ ‎as ‎a‏ ‎means‏ ‎of ‎disrupting ‎South‏ ‎Korean ‎and‏ ‎allied ‎military ‎operations. ‎This‏ ‎jamming‏ ‎can ‎affect‏ ‎civilian ‎aircraft‏ ‎and ‎ships, ‎leading ‎to ‎navigation‏ ‎challenges.

📌Limited‏ ‎Access: The ‎general‏ ‎population ‎in‏ ‎North ‎Korea ‎has ‎limited ‎access‏ ‎to‏ ‎GPS-enabled‏ ‎devices ‎and‏ ‎the ‎internet,‏ ‎making ‎the‏ ‎impact‏ ‎of ‎GPS‏ ‎jamming ‎more ‎significant ‎for ‎external‏ ‎entities ‎rather‏ ‎than‏ ‎for ‎daily ‎civilian‏ ‎use ‎within‏ ‎the ‎country.

Westchester ‎County, ‎New‏ ‎York

📌Security-Related‏ ‎Blurring: ‎Certain‏ ‎locations ‎in‏ ‎Westchester ‎County ‎are ‎intentionally ‎blurred‏ ‎on‏ ‎Google ‎Maps‏ ‎to ‎prevent‏ ‎potential ‎terrorist ‎attacks. ‎This ‎measure‏ ‎is‏ ‎taken‏ ‎to ‎protect‏ ‎sensitive ‎sites‏ ‎and ‎infrastructure,‏ ‎but‏ ‎it ‎can‏ ‎hinder ‎accurate ‎navigation ‎for ‎residents‏ ‎and ‎visitors.

📌Impact‏ ‎on‏ ‎Navigation: The ‎blurring ‎of‏ ‎maps ‎can‏ ‎make ‎it ‎difficult ‎for‏ ‎users‏ ‎to ‎find‏ ‎specific ‎locations,‏ ‎affecting ‎daily ‎navigation ‎and ‎potentially‏ ‎leading‏ ‎to ‎confusion.

Antarctica

📌GPS:‏ ‎Antarctica ‎primarily‏ ‎relies ‎on ‎the ‎U.S. ‎GPS‏ ‎for‏ ‎navigation‏ ‎and ‎scientific‏ ‎research. ‎The‏ ‎harsh ‎environment‏ ‎and‏ ‎dynamic ‎ice‏ ‎landscape ‎present ‎unique ‎challenges, ‎but‏ ‎GPS ‎remains‏ ‎the‏ ‎most ‎accurate ‎and‏ ‎reliable ‎system‏ ‎available ‎for ‎this ‎region.

📌Common‏ ‎Mode‏ ‎Errors ‎(CME):‏ ‎Antarctica ‎does‏ ‎not ‎use ‎a ‎different ‎GPS‏ ‎standard,‏ ‎but ‎the‏ ‎region ‎faces‏ ‎unique ‎challenges ‎due ‎to ‎common‏ ‎mode‏ ‎errors‏ ‎in ‎GPS‏ ‎coordinate ‎time-series.‏ ‎These ‎errors‏ ‎are‏ ‎caused ‎by‏ ‎environmental ‎factors ‎and ‎systematic ‎issues,‏ ‎affecting ‎the‏ ‎accuracy‏ ‎of ‎GPS ‎measurements‏ ‎used ‎for‏ ‎scientific ‎research ‎and ‎navigation.

📌Harsh‏ ‎Environment:‏ ‎The ‎extreme‏ ‎conditions ‎and‏ ‎vast, ‎featureless ‎ice ‎landscapes ‎make‏ ‎high-resolution‏ ‎mapping ‎difficult.‏ ‎Specialized ‎techniques‏ ‎and ‎equipment ‎are ‎required ‎to‏ ‎achieve‏ ‎accurate‏ ‎GPS ‎data,‏ ‎which ‎is‏ ‎crucial ‎for‏ ‎scientific‏ ‎studies ‎and‏ ‎logistical ‎operations.


Impact

Inaccurate ‎mapping ‎systems ‎can‏ ‎significantly ‎impact‏ ‎daily‏ ‎navigation ‎in ‎various‏ ‎regions ‎around‏ ‎the ‎world, ‎including ‎China,‏ ‎India,‏ ‎Israel ‎and‏ ‎Palestine, ‎North‏ ‎Korea, ‎Westchester ‎County ‎in ‎New‏ ‎York,‏ ‎and ‎Antarctica.

China

Misalignment‏ ‎of ‎Maps‏ ‎and ‎GPS ‎Data

📌Offset ‎Issues: The ‎GCJ-02‏ ‎system‏ ‎introduces‏ ‎random ‎offsets‏ ‎to ‎latitude‏ ‎and ‎longitude,‏ ‎ranging‏ ‎from ‎50‏ ‎to ‎500 ‎meters. ‎This ‎results‏ ‎in ‎GPS‏ ‎coordinates‏ ‎(based ‎on ‎the‏ ‎global ‎WGS-84‏ ‎system) ‎not ‎aligning ‎correctly‏ ‎with‏ ‎Chinese ‎maps,‏ ‎which ‎use‏ ‎GCJ-02.

📌Practical ‎Impact: For ‎users, ‎this ‎means‏ ‎that‏ ‎GPS ‎devices‏ ‎and ‎applications‏ ‎may ‎show ‎their ‎location ‎inaccurately‏ ‎on‏ ‎maps.‏ ‎For ‎example,‏ ‎a ‎GPS‏ ‎coordinate ‎might‏ ‎place‏ ‎a ‎user‏ ‎in ‎a ‎different ‎part ‎of‏ ‎a ‎city‏ ‎than‏ ‎their ‎actual ‎location.

Challenges‏ ‎for ‎Foreign‏ ‎Mapping ‎Services

📌Google ‎Maps: Google ‎Maps‏ ‎in‏ ‎China ‎must‏ ‎use ‎the‏ ‎GCJ-02 ‎system ‎for ‎street ‎maps‏ ‎but‏ ‎uses ‎WGS-84‏ ‎for ‎satellite‏ ‎imagery, ‎causing ‎visible ‎misalignments ‎between‏ ‎the‏ ‎two.‏ ‎This ‎discrepancy‏ ‎can ‎make‏ ‎navigation ‎difficult‏ ‎for‏ ‎users ‎relying‏ ‎on ‎Google ‎Maps.

📌Other ‎Services: Similar ‎issues‏ ‎affect ‎other‏ ‎foreign‏ ‎mapping ‎services, ‎which‏ ‎must ‎either‏ ‎comply ‎with ‎GCJ-02 ‎or‏ ‎face‏ ‎inaccuracies. ‎Unauthorized‏ ‎mapping ‎or‏ ‎attempts ‎to ‎correct ‎the ‎offsets‏ ‎without‏ ‎approval ‎are‏ ‎illegal.

Local ‎Solutions‏ ‎and ‎Workarounds

📌Chinese ‎Apps: Local ‎apps ‎like‏ ‎Baidu‏ ‎Maps‏ ‎and ‎WeChat‏ ‎use ‎the‏ ‎GCJ-02 ‎system‏ ‎and‏ ‎often ‎provide‏ ‎more ‎accurate ‎navigation ‎within ‎China.‏ ‎Baidu ‎Maps‏ ‎even‏ ‎uses ‎an ‎additional‏ ‎layer ‎of‏ ‎obfuscation ‎called ‎BD-09.

📌Conversion ‎Tools:‏ ‎Several‏ ‎open-source ‎projects‏ ‎and ‎tools‏ ‎exist ‎to ‎convert ‎between ‎GCJ-02‏ ‎and‏ ‎WGS-84 ‎coordinates,‏ ‎helping ‎developers‏ ‎and ‎users ‎mitigate ‎some ‎of‏ ‎the‏ ‎navigation‏ ‎issues.

Legal ‎and‏ ‎Security ‎Implications

📌Regulations: The‏ ‎Chinese ‎government‏ ‎enforces‏ ‎strict ‎regulations‏ ‎on ‎geographic ‎data ‎to ‎protect‏ ‎national ‎security.‏ ‎Unauthorized‏ ‎mapping ‎activities ‎can‏ ‎result ‎in‏ ‎severe ‎penalties, ‎including ‎fines‏ ‎and‏ ‎legal ‎action.

📌Device‏ ‎Restrictions: Many ‎GPS-enabled‏ ‎devices, ‎including ‎cameras ‎and ‎smartphones,‏ ‎have‏ ‎restrictions ‎or‏ ‎modifications ‎to‏ ‎comply ‎with ‎Chinese ‎laws. ‎This‏ ‎can‏ ‎include‏ ‎disabling ‎geotagging‏ ‎features ‎or‏ ‎using ‎modified‏ ‎GPS‏ ‎chips ‎that‏ ‎align ‎with ‎GCJ-02.

India

📌Routing ‎Issues: Google ‎Maps‏ ‎in ‎India‏ ‎often‏ ‎suggests ‎inefficient ‎or‏ ‎incorrect ‎routes,‏ ‎such ‎as ‎diverting ‎users‏ ‎through‏ ‎small ‎villages‏ ‎or ‎bad‏ ‎road ‎patches ‎when ‎better ‎roads‏ ‎are‏ ‎available. ‎This‏ ‎can ‎lead‏ ‎to ‎longer ‎travel ‎times ‎and‏ ‎confusion,‏ ‎especially‏ ‎for ‎first-time‏ ‎users.

📌Residential ‎Colonies: The‏ ‎app ‎sometimes‏ ‎directs‏ ‎users ‎through‏ ‎residential ‎colonies, ‎which ‎may ‎have‏ ‎restricted ‎access‏ ‎or‏ ‎closed ‎gates, ‎causing‏ ‎further ‎navigation‏ ‎problems.

📌Taxi ‎Services: Users ‎of ‎taxi-hailing‏ ‎apps‏ ‎like ‎Uber‏ ‎and ‎OLA‏ ‎frequently ‎experience ‎inaccuracies ‎in ‎the‏ ‎location‏ ‎of ‎cars‏ ‎and ‎their‏ ‎own ‎position, ‎necessitating ‎phone ‎calls‏ ‎to‏ ‎drivers‏ ‎for ‎precise‏ ‎directions.

Israel ‎and‏ ‎Palestine

📌Biased ‎Routing: Google‏ ‎Maps‏ ‎prioritizes ‎routes‏ ‎for ‎Israeli ‎citizens, ‎often ‎ignoring‏ ‎the ‎segregated‏ ‎road‏ ‎system ‎and ‎checkpoints‏ ‎that ‎affect‏ ‎Palestinians. ‎This ‎can ‎result‏ ‎in‏ ‎suggested ‎routes‏ ‎that ‎are‏ ‎illegal ‎or ‎dangerous ‎for ‎Palestinians‏ ‎to‏ ‎use.

📌Omission ‎of‏ ‎Palestinian ‎Localities: Many‏ ‎Palestinian ‎villages ‎and ‎localities ‎are‏ ‎either‏ ‎misrepresented‏ ‎or ‎omitted‏ ‎from ‎maps,‏ ‎which ‎can‏ ‎alienate‏ ‎Palestinians ‎from‏ ‎their ‎homeland ‎and ‎complicate ‎navigation‏ ‎within ‎these‏ ‎areas.

📌Political‏ ‎Bias: Maps ‎often ‎reflect‏ ‎political ‎biases,‏ ‎such ‎as ‎labeling ‎Israeli‏ ‎settlements‏ ‎clearly ‎while‏ ‎Palestinian ‎areas‏ ‎are ‎left ‎blank ‎or ‎inaccurately‏ ‎labeled.‏ ‎This ‎affects‏ ‎the ‎usability‏ ‎of ‎maps ‎for ‎Palestinians ‎and‏ ‎can‏ ‎lead‏ ‎to ‎significant‏ ‎navigation ‎challenges.

North‏ ‎Korea

📌Limited ‎Data: While‏ ‎Google‏ ‎Maps ‎has‏ ‎started ‎to ‎include ‎more ‎detailed‏ ‎information ‎about‏ ‎North‏ ‎Korea, ‎the ‎data‏ ‎is ‎still‏ ‎limited ‎and ‎often ‎outdated.‏ ‎This‏ ‎makes ‎it‏ ‎difficult ‎for‏ ‎users ‎to ‎navigate ‎accurately ‎within‏ ‎the‏ ‎country.

📌Restricted ‎Access: The‏ ‎majority ‎of‏ ‎North ‎Koreans ‎do ‎not ‎have‏ ‎access‏ ‎to‏ ‎the ‎internet‏ ‎or ‎GPS-enabled‏ ‎devices, ‎rendering‏ ‎the‏ ‎available ‎mapping‏ ‎data ‎largely ‎useless ‎for ‎local‏ ‎navigation.

Westchester ‎County,‏ ‎New‏ ‎York

📌Blurring ‎for ‎Security: Certain‏ ‎locations ‎in‏ ‎Westchester ‎County ‎are ‎intentionally‏ ‎blurred‏ ‎on ‎Google‏ ‎Maps ‎to‏ ‎prevent ‎potential ‎terrorist ‎attacks. ‎This‏ ‎can‏ ‎hinder ‎accurate‏ ‎navigation ‎and‏ ‎make ‎it ‎difficult ‎for ‎users‏ ‎to‏ ‎find‏ ‎specific ‎locations.

📌General‏ ‎Inaccuracies: The ‎map‏ ‎data ‎may‏ ‎not‏ ‎always ‎reflect‏ ‎the ‎most ‎current ‎or ‎precise‏ ‎information, ‎which‏ ‎can‏ ‎affect ‎navigation ‎for‏ ‎residents ‎and‏ ‎visitors ‎alike.

Antarctica

📌Low-Resolution ‎Imagery: Large ‎areas‏ ‎of‏ ‎Antarctica ‎are‏ ‎shown ‎in‏ ‎low ‎resolution ‎or ‎are ‎blurred‏ ‎due‏ ‎to ‎the‏ ‎featureless ‎ice‏ ‎and ‎snow, ‎making ‎high-resolution ‎imaging‏ ‎difficult‏ ‎and‏ ‎largely ‎unnecessary.

📌Survey‏ ‎Challenges: Accurate ‎mapping‏ ‎in ‎Antarctica‏ ‎requires‏ ‎specialized ‎equipment‏ ‎and ‎techniques, ‎such ‎as ‎Differential‏ ‎GPS ‎Surveying,‏ ‎to‏ ‎minimize ‎errors. ‎This‏ ‎can ‎be‏ ‎logistically ‎challenging ‎and ‎expensive,‏ ‎affecting‏ ‎the ‎availability‏ ‎of ‎accurate‏ ‎maps ‎for ‎navigation.

📌Limited ‎Use: The ‎practical‏ ‎need‏ ‎for ‎detailed‏ ‎maps ‎in‏ ‎Antarctica ‎is ‎limited ‎to ‎scientific‏ ‎and‏ ‎logistical‏ ‎operations, ‎rather‏ ‎than ‎daily‏ ‎navigation ‎for‏ ‎the‏ ‎general ‎public

Benefits‏ ‎of ‎Inaccurate ‎Maps ‎for ‎Specific‏ ‎Countries

China

📌National ‎Security: The‏ ‎primary‏ ‎benefit ‎of ‎using‏ ‎the ‎GCJ-02‏ ‎coordinate ‎system, ‎which ‎introduces‏ ‎intentional‏ ‎offsets, ‎is‏ ‎to ‎protect‏ ‎national ‎security. ‎By ‎obfuscating ‎geographic‏ ‎data,‏ ‎China ‎prevents‏ ‎foreign ‎entities‏ ‎from ‎using ‎accurate ‎maps ‎for‏ ‎military‏ ‎or‏ ‎intelligence ‎purposes.

📌Economic‏ ‎Protectionism: The ‎policy‏ ‎also ‎supports‏ ‎local‏ ‎mapping ‎companies‏ ‎by ‎limiting ‎competition ‎from ‎foreign‏ ‎mapping ‎services,‏ ‎ensuring‏ ‎that ‎only ‎authorized‏ ‎providers ‎can‏ ‎offer ‎accurate ‎maps ‎within‏ ‎China.

India

📌Territorial‏ ‎Integrity: India ‎enforces‏ ‎strict ‎regulations‏ ‎on ‎maps ‎to ‎ensure ‎that‏ ‎its‏ ‎territorial ‎claims,‏ ‎especially ‎in‏ ‎disputed ‎regions ‎like ‎Kashmir ‎and‏ ‎Arunachal‏ ‎Pradesh,‏ ‎are ‎accurately‏ ‎represented. ‎This‏ ‎helps ‎maintain‏ ‎national‏ ‎sovereignty ‎and‏ ‎supports ‎India’s ‎geopolitical ‎stance.

📌Strategic ‎Autonomy: By‏ ‎developing ‎its‏ ‎own‏ ‎regional ‎navigation ‎system‏ ‎(NavIC), ‎India‏ ‎reduces ‎dependency ‎on ‎foreign‏ ‎GPS‏ ‎systems, ‎enhancing‏ ‎both ‎civilian‏ ‎and ‎military ‎navigation ‎capabilities.

Israel ‎and‏ ‎Palestine

📌Security‏ ‎Measures: Israel ‎uses‏ ‎GPS ‎jamming‏ ‎and ‎spoofing ‎to ‎protect ‎against‏ ‎potential‏ ‎attacks‏ ‎from ‎adversaries.‏ ‎This ‎defensive‏ ‎measure ‎disrupts‏ ‎enemy‏ ‎navigation ‎systems‏ ‎and ‎precision-guided ‎weapons, ‎enhancing ‎national‏ ‎security.

📌Political ‎Narratives: Both‏ ‎Israel‏ ‎and ‎Palestine ‎use‏ ‎maps ‎to‏ ‎support ‎their ‎respective ‎territorial‏ ‎claims.‏ ‎Inaccurate ‎or‏ ‎biased ‎maps‏ ‎can ‎influence ‎public ‎perception ‎and‏ ‎international‏ ‎opinion, ‎which‏ ‎is ‎crucial‏ ‎in ‎the ‎ongoing ‎conflict.

North ‎Korea

📌Military‏ ‎Defense: North‏ ‎Korea‏ ‎employs ‎GPS‏ ‎jamming ‎to‏ ‎disrupt ‎foreign‏ ‎military‏ ‎operations, ‎particularly‏ ‎those ‎of ‎South ‎Korea ‎and‏ ‎its ‎allies.‏ ‎This‏ ‎measure ‎complicates ‎navigation‏ ‎for ‎adversaries,‏ ‎providing ‎a ‎strategic ‎defense‏ ‎advantage.

📌Controlled‏ ‎Information: The ‎limited‏ ‎and ‎outdated‏ ‎mapping ‎data ‎available ‎within ‎North‏ ‎Korea‏ ‎helps ‎the‏ ‎regime ‎maintain‏ ‎control ‎over ‎information ‎and ‎restricts‏ ‎the‏ ‎population’s‏ ‎access ‎to‏ ‎external ‎geographic‏ ‎data.

Westchester ‎County,‏ ‎New‏ ‎York

📌Security ‎Concerns: Certain‏ ‎locations ‎in ‎Westchester ‎County ‎are‏ ‎intentionally ‎blurred‏ ‎on‏ ‎maps ‎to ‎prevent‏ ‎potential ‎terrorist‏ ‎attacks. ‎This ‎measure ‎protects‏ ‎sensitive‏ ‎sites ‎and‏ ‎infrastructure ‎from‏ ‎being ‎targeted.

Antarctica

📌Environmental ‎Protection: Inaccurate ‎or ‎less‏ ‎detailed‏ ‎maps ‎can‏ ‎help ‎protect‏ ‎sensitive ‎environmental ‎areas ‎by ‎limiting‏ ‎human‏ ‎activity‏ ‎and ‎reducing‏ ‎the ‎risk‏ ‎of ‎exploitation‏ ‎or‏ ‎damage.

📌Scientific ‎Research: The‏ ‎dynamic ‎and ‎harsh ‎environment ‎of‏ ‎Antarctica ‎makes‏ ‎accurate‏ ‎mapping ‎challenging. ‎However,‏ ‎the ‎focus‏ ‎on ‎improving ‎mapping ‎accuracy‏ ‎supports‏ ‎scientific ‎research‏ ‎and ‎environmental‏ ‎management.

Drawbacks ‎for ‎Other ‎Countries

📌Navigation ‎Challenges: Inaccurate‏ ‎maps‏ ‎can ‎lead‏ ‎to ‎significant‏ ‎navigation ‎issues ‎for ‎travelers, ‎businesses,‏ ‎and‏ ‎emergency‏ ‎services. ‎This‏ ‎can ‎result‏ ‎in ‎inefficiencies,‏ ‎increased‏ ‎travel ‎times,‏ ‎and ‎potential ‎safety ‎hazards.

📌Economic ‎Impact: Businesses‏ ‎that ‎rely‏ ‎on‏ ‎accurate ‎geographic ‎data,‏ ‎such ‎as‏ ‎logistics ‎and ‎delivery ‎services,‏ ‎can‏ ‎face ‎operational‏ ‎challenges ‎and‏ ‎increased ‎costs ‎due ‎to ‎map‏ ‎inaccuracies.

📌Geopolitical‏ ‎Tensions: Inaccurate ‎maps‏ ‎can ‎exacerbate‏ ‎territorial ‎disputes ‎and ‎contribute ‎to‏ ‎geopolitical‏ ‎tensions.‏ ‎Misrepresentation ‎of‏ ‎borders ‎and‏ ‎territories ‎can‏ ‎lead‏ ‎to ‎conflicts‏ ‎and ‎diplomatic ‎issues.

📌Scientific ‎Limitations: In ‎regions‏ ‎like ‎Antarctica,‏ ‎inaccurate‏ ‎maps ‎hinder ‎scientific‏ ‎research ‎and‏ ‎environmental ‎management. ‎Accurate ‎geographic‏ ‎data‏ ‎is ‎crucial‏ ‎for ‎studying‏ ‎climate ‎change, ‎managing ‎natural ‎resources,‏ ‎and‏ ‎protecting ‎ecosystems.

📌Public‏ ‎Misinformation: Inaccurate ‎maps‏ ‎can ‎mislead ‎the ‎public ‎and‏ ‎perpetuate‏ ‎misinformation.‏ ‎This ‎can‏ ‎affect ‎education,‏ ‎public ‎opinion,‏ ‎and‏ ‎policymaking, ‎leading‏ ‎to ‎a ‎less ‎informed ‎society.


Читать: 3+ мин
logo Overkill Security

Android Live Threat Detection: 200 billion Scans a Day Still Won’t Catch Everything

The ‎security‏ ‎updates ‎announced at ‎Google ‎I/O ‎2024‏ ‎are ‎poised‏ ‎to‏ ‎enhance ‎the ‎security‏ ‎and ‎privacy‏ ‎of ‎Android ‎devices ‎significantly,‏ ‎impacting‏ ‎various ‎industries‏ ‎by ‎reducing‏ ‎fraud, ‎protecting ‎sensitive ‎data, ‎and‏ ‎fostering‏ ‎greater ‎trust‏ ‎in ‎mobile‏ ‎technologies.

Key ‎Points

Google ‎Play ‎Protect ‎Live‏ ‎Threat‏ ‎Detection:

📌Functionality:‏ ‎Scans ‎200‏ ‎billion ‎Android‏ ‎apps ‎daily‏ ‎using‏ ‎on-device ‎AI‏ ‎to ‎detect ‎and ‎mitigate ‎malware‏ ‎and ‎fraudulent‏ ‎apps.

📌Implementation:‏ ‎Uses ‎Private ‎Compute‏ ‎Core ‎for‏ ‎privacy-preserving ‎analysis.

📌Deployment: ‎Available ‎on‏ ‎devices‏ ‎from ‎manufacturers‏ ‎like ‎Google‏ ‎Pixel, ‎Honor, ‎Lenovo, ‎Nothing, ‎OnePlus,‏ ‎Oppo,‏ ‎Sharp, ‎and‏ ‎Transsion.

Stronger ‎Protections‏ ‎Against ‎Fraud ‎and ‎Scams:

📌Scam ‎Call‏ ‎Detection:‏ ‎Uses‏ ‎Gemini-Nano ‎AI‏ ‎to ‎detect‏ ‎and ‎alert‏ ‎users‏ ‎about ‎potential‏ ‎scam ‎calls ‎in ‎real-time.

📌Screen ‎Sharing‏ ‎Safeguards: ‎Enhanced‏ ‎controls‏ ‎to ‎prevent ‎social‏ ‎engineering ‎attacks‏ ‎during ‎screen ‎sharing.

📌Advanced ‎Cellular‏ ‎Security:‏ ‎New ‎protections‏ ‎against ‎cell‏ ‎site ‎simulators ‎to ‎prevent ‎surveillance‏ ‎and‏ ‎SMS-based ‎fraud.

Private‏ ‎Space ‎Feature:

📌Functionality:‏ ‎Allows ‎users ‎to ‎create ‎a‏ ‎secure,‏ ‎siloed‏ ‎portion ‎of‏ ‎the ‎OS‏ ‎for ‎sensitive‏ ‎information,‏ ‎similar ‎to‏ ‎Incognito ‎mode.

📌Developer ‎Access: ‎Available ‎for‏ ‎developers ‎to‏ ‎experiment‏ ‎with, ‎with ‎a‏ ‎bug ‎fix‏ ‎expected ‎soon.

Enhanced ‎Developer ‎Tools:

📌Play‏ ‎Integrity‏ ‎API: ‎Updated‏ ‎to ‎include‏ ‎new ‎in-app ‎signals ‎to ‎help‏ ‎developers‏ ‎detect ‎and‏ ‎prevent ‎fraudulent‏ ‎or ‎risky ‎behavior.

📌Photo ‎Picker: ‎Improved‏ ‎to‏ ‎support‏ ‎cloud ‎storage‏ ‎services ‎and‏ ‎enforce ‎stricter‏ ‎permissions‏ ‎for ‎accessing‏ ‎photos ‎and ‎videos.


Impact ‎on ‎Industries

Financial‏ ‎Services:

📌Fraud ‎Prevention:‏ ‎Enhanced‏ ‎scam ‎call ‎detection‏ ‎and ‎advanced‏ ‎cellular ‎security ‎features ‎will‏ ‎significantly‏ ‎reduce ‎the‏ ‎risk ‎of‏ ‎financial ‎fraud ‎and ‎scams, ‎protecting‏ ‎both‏ ‎consumers ‎and‏ ‎financial ‎institutions.

📌Data‏ ‎Privacy: The ‎Private ‎Space ‎feature ‎ensures‏ ‎that‏ ‎sensitive‏ ‎financial ‎data‏ ‎remains ‎secure,‏ ‎fostering ‎greater‏ ‎trust‏ ‎in ‎mobile‏ ‎banking ‎and ‎financial ‎apps.

Healthcare:

📌Patient ‎Data‏ ‎Security: The ‎improved‏ ‎security‏ ‎measures, ‎including ‎live‏ ‎threat ‎detection‏ ‎and ‎Private ‎Space, ‎will‏ ‎help‏ ‎protect ‎sensitive‏ ‎patient ‎information‏ ‎stored ‎on ‎mobile ‎devices.

📌Telehealth: ‎Enhanced‏ ‎screen-sharing‏ ‎safeguards ‎will‏ ‎secure ‎telehealth‏ ‎sessions, ‎preventing ‎unauthorized ‎access ‎to‏ ‎patient‏ ‎data‏ ‎during ‎remote‏ ‎consultations.

E-commerce:

📌Transaction ‎Security: Scam‏ ‎call ‎detection‏ ‎and‏ ‎advanced ‎cellular‏ ‎security ‎will ‎protect ‎users ‎from‏ ‎phishing ‎and‏ ‎fraud‏ ‎attempts, ‎ensuring ‎safer‏ ‎online ‎transactions.

📌User‏ ‎Trust: Enhanced ‎privacy ‎controls ‎and‏ ‎secure‏ ‎app ‎environments‏ ‎will ‎increase‏ ‎user ‎confidence ‎in ‎mobile ‎shopping‏ ‎platforms.

Telecommunications:

📌Network‏ ‎Security: Advanced ‎cellular‏ ‎protections ‎will‏ ‎help ‎telecom ‎providers ‎safeguard ‎their‏ ‎networks‏ ‎from‏ ‎cell ‎site‏ ‎simulators ‎and‏ ‎other ‎surveillance‏ ‎tools.

📌Customer‏ ‎Safety: Real-time ‎scam‏ ‎detection ‎features ‎will ‎enhance ‎customer‏ ‎safety, ‎reducing‏ ‎the‏ ‎incidence ‎of ‎fraud-related‏ ‎complaints.

App ‎Development:

📌Security‏ ‎Integration: Developers ‎can ‎leverage ‎the‏ ‎updated‏ ‎Play ‎Integrity‏ ‎API ‎and‏ ‎other ‎security ‎tools ‎to ‎build‏ ‎more‏ ‎secure ‎apps,‏ ‎reducing ‎the‏ ‎risk ‎of ‎exploitation ‎and ‎abuse.

📌User‏ ‎Privacy: Stricter‏ ‎photo‏ ‎permissions ‎and‏ ‎the ‎Private‏ ‎Space ‎feature‏ ‎will‏ ‎help ‎developers‏ ‎ensure ‎compliance ‎with ‎privacy ‎regulations‏ ‎and ‎build‏ ‎user‏ ‎trust.

Читать: 3+ мин
logo Snarky Security

AI for the Chronically Lazy: Mastering the Art of Doing Nothing with Gemini

The ‎updates‏ ‎to ‎Gemini and ‎Gemma ‎models ‎significantly‏ ‎enhance ‎their‏ ‎technical‏ ‎capabilities ‎and ‎broaden‏ ‎their ‎impact‏ ‎across ‎various ‎industries, ‎driving‏ ‎innovation‏ ‎and ‎efficiency‏ ‎while ‎promoting‏ ‎responsible ‎AI ‎development.

Key ‎Points

Gemini ‎1.5‏ ‎Pro‏ ‎and ‎1.5‏ ‎Flash ‎Models:

📌Gemini‏ ‎1.5 ‎Pro: Enhanced ‎for ‎general ‎performance‏ ‎across‏ ‎tasks‏ ‎like ‎translation,‏ ‎coding, ‎reasoning,‏ ‎and ‎more.‏ ‎It‏ ‎now ‎supports‏ ‎a ‎2 ‎million ‎token ‎context‏ ‎window, ‎multimodal‏ ‎inputs‏ ‎(text, ‎images, ‎audio,‏ ‎video), ‎and‏ ‎improved ‎control ‎over ‎responses‏ ‎for‏ ‎specific ‎use‏ ‎cases.

📌Gemini ‎1.5‏ ‎Flash: A ‎smaller, ‎faster ‎model ‎optimized‏ ‎for‏ ‎high-frequency ‎tasks,‏ ‎available ‎with‏ ‎a ‎1 ‎million ‎token ‎context‏ ‎window.

Gemma‏ ‎Models:

📌Gemma‏ ‎2: Built ‎for‏ ‎industry-leading ‎performance‏ ‎with ‎a‏ ‎27B‏ ‎parameter ‎instance,‏ ‎optimized ‎for ‎GPUs ‎or ‎a‏ ‎single ‎TPU‏ ‎host.‏ ‎It ‎includes ‎new‏ ‎architecture ‎for‏ ‎breakthrough ‎performance ‎and ‎efficiency.

📌PaliGemma: A‏ ‎vision-language‏ ‎model ‎optimized‏ ‎for ‎image‏ ‎captioning ‎and ‎visual ‎Q& ‎A‏ ‎tasks.

New‏ ‎API ‎Features:

📌Video‏ ‎Frame ‎Extraction: Allows‏ ‎developers ‎to ‎extract ‎frames ‎from‏ ‎videos‏ ‎for‏ ‎analysis.

📌Parallel ‎Function‏ ‎Calling: Enables ‎returning‏ ‎more ‎than‏ ‎one‏ ‎function ‎call‏ ‎at ‎a ‎time.

📌Context ‎Caching: Reduces ‎the‏ ‎need ‎to‏ ‎resend‏ ‎large ‎files, ‎making‏ ‎long ‎contexts‏ ‎more ‎affordable.

Developer ‎Tools ‎and‏ ‎Integration:

📌Google‏ ‎AI ‎Studio‏ ‎and ‎Vertex‏ ‎AI: Enhanced ‎with ‎new ‎features ‎like‏ ‎context‏ ‎caching ‎and‏ ‎higher ‎rate‏ ‎limits ‎for ‎pay-as-you-go ‎services.

📌Integration ‎with‏ ‎Popular‏ ‎Frameworks: Support‏ ‎for ‎JAX,‏ ‎PyTorch, ‎TensorFlow,‏ ‎and ‎tools‏ ‎like‏ ‎Hugging ‎Face,‏ ‎NVIDIA ‎NeMo, ‎and ‎TensorRT-LLM.


Impact ‎on‏ ‎Industries

Software ‎Development:

📌Enhanced‏ ‎Productivity: Integration‏ ‎of ‎Gemini ‎models‏ ‎in ‎tools‏ ‎like ‎Android ‎Studio, ‎Firebase,‏ ‎and‏ ‎VSCode ‎helps‏ ‎developers ‎build‏ ‎high-quality ‎apps ‎with ‎AI ‎assistance,‏ ‎improving‏ ‎productivity ‎and‏ ‎efficiency.

📌AI-Powered ‎Features: New‏ ‎features ‎like ‎parallel ‎function ‎calling‏ ‎and‏ ‎video‏ ‎frame ‎extraction‏ ‎streamline ‎workflows‏ ‎and ‎optimize‏ ‎AI-powered‏ ‎applications.

Enterprise ‎and‏ ‎Business ‎Applications:

📌AI ‎Integration ‎in ‎Workspace: Gemini‏ ‎models ‎are‏ ‎embedded‏ ‎in ‎Google ‎Workspace‏ ‎apps ‎(Gmail,‏ ‎Docs, ‎Drive, ‎Slides, ‎Sheets),‏ ‎enhancing‏ ‎functionalities ‎like‏ ‎email ‎summarization,‏ ‎Q& ‎A, ‎and ‎smart ‎replies.

📌Custom‏ ‎AI‏ ‎Solutions: Businesses ‎can‏ ‎leverage ‎Gemma‏ ‎models ‎for ‎tailored ‎AI ‎solutions,‏ ‎driving‏ ‎efficiency‏ ‎and ‎innovation‏ ‎across ‎various‏ ‎sectors.

Research ‎and‏ ‎Development:

📌Open-Source‏ ‎Innovation: Gemma’s ‎open-source‏ ‎nature ‎democratizes ‎access ‎to ‎advanced‏ ‎AI ‎technologies,‏ ‎fostering‏ ‎collaboration ‎and ‎rapid‏ ‎advancements ‎in‏ ‎AI ‎research.

📌Responsible ‎AI ‎Development: Tools‏ ‎like‏ ‎the ‎Responsible‏ ‎Generative ‎AI‏ ‎Toolkit ‎ensure ‎safe ‎and ‎reliable‏ ‎AI‏ ‎applications, ‎promoting‏ ‎ethical ‎AI‏ ‎development.

Multimodal ‎Applications:

📌Vision-Language ‎Tasks: PaliGemma’s ‎capabilities ‎in‏ ‎image‏ ‎captioning‏ ‎and ‎visual‏ ‎Q& ‎A‏ ‎open ‎new‏ ‎possibilities‏ ‎for ‎applications‏ ‎in ‎fields ‎like ‎healthcare, ‎education,‏ ‎and ‎media.

📌Multimodal‏ ‎Reasoning: Gemini‏ ‎models' ‎ability ‎to‏ ‎handle ‎text,‏ ‎images, ‎audio, ‎and ‎video‏ ‎inputs‏ ‎enhances ‎their‏ ‎applicability ‎in‏ ‎diverse ‎scenarios, ‎from ‎content ‎creation‏ ‎to‏ ‎data ‎analysis.


Читать: 2+ мин
logo Overkill Security

Why Clicking on 'Urgent Invoice' Emails is the Best Way to Make Friends with IT

The ‎blog‏ ‎post ‎titled ‎«On ‎Fire ‎Drills‏ ‎and ‎Phishing‏ ‎Tests» from‏ ‎the ‎Google ‎Security‏ ‎Blog ‎discusses‏ ‎the ‎importance ‎of ‎phishing‏ ‎tests‏ ‎and ‎fire‏ ‎drills ‎in‏ ‎enhancing ‎organizational ‎security.

Importance ‎of ‎Phishing‏ ‎Tests

📌Phishing‏ ‎Tests ‎as‏ ‎Training ‎Tools: Phishing‏ ‎tests ‎are ‎used ‎to ‎train‏ ‎employees‏ ‎to‏ ‎recognize ‎and‏ ‎respond ‎to‏ ‎phishing ‎attempts.‏ ‎They‏ ‎simulate ‎real-world‏ ‎phishing ‎attacks ‎to ‎help ‎employees‏ ‎identify ‎suspicious‏ ‎emails‏ ‎and ‎links.

📌Behavioral ‎Insights: These‏ ‎tests ‎provide‏ ‎insights ‎into ‎employee ‎behavior‏ ‎and‏ ‎the ‎effectiveness‏ ‎of ‎current‏ ‎training ‎programs. ‎They ‎help ‎identify‏ ‎which‏ ‎employees ‎or‏ ‎departments ‎are‏ ‎more ‎susceptible ‎to ‎phishing ‎attacks.

Fire‏ ‎Drills‏ ‎for‏ ‎Incident ‎Response

📌Simulated‏ ‎Incidents: Fire ‎drills‏ ‎involve ‎simulating‏ ‎security‏ ‎incidents ‎to‏ ‎test ‎the ‎organization’s ‎incident ‎response‏ ‎capabilities. ‎This‏ ‎includes‏ ‎how ‎quickly ‎and‏ ‎effectively ‎the‏ ‎team ‎can ‎detect, ‎respond‏ ‎to,‏ ‎and ‎mitigate‏ ‎security ‎threats.

📌Preparedness‏ ‎and ‎Improvement: Regular ‎fire ‎drills ‎help‏ ‎ensure‏ ‎that ‎the‏ ‎incident ‎response‏ ‎team ‎is ‎prepared ‎for ‎actual‏ ‎security‏ ‎incidents.‏ ‎They ‎also‏ ‎highlight ‎areas‏ ‎for ‎improvement‏ ‎in‏ ‎the ‎incident‏ ‎response ‎plan.

Integration ‎of ‎Phishing ‎Tests‏ ‎and ‎Fire‏ ‎Drills

📌Comprehensive‏ ‎Security ‎Training: Combining ‎phishing‏ ‎tests ‎with‏ ‎fire ‎drills ‎provides ‎a‏ ‎comprehensive‏ ‎approach ‎to‏ ‎security ‎training.‏ ‎It ‎ensures ‎that ‎employees ‎are‏ ‎not‏ ‎only ‎aware‏ ‎of ‎phishing‏ ‎threats ‎but ‎also ‎know ‎how‏ ‎to‏ ‎respond‏ ‎to ‎them‏ ‎effectively.

📌Realistic ‎Scenarios: By‏ ‎integrating ‎these‏ ‎two‏ ‎methods, ‎organizations‏ ‎can ‎create ‎more ‎realistic ‎and‏ ‎challenging ‎scenarios‏ ‎that‏ ‎better ‎prepare ‎employees‏ ‎for ‎real-world‏ ‎threats.

Metrics ‎and ‎Evaluation

📌Measuring ‎Effectiveness: Both‏ ‎phishing‏ ‎tests ‎and‏ ‎fire ‎drills‏ ‎should ‎be ‎evaluated ‎using ‎metrics‏ ‎to‏ ‎measure ‎their‏ ‎effectiveness. ‎This‏ ‎includes ‎tracking ‎the ‎number ‎of‏ ‎employees‏ ‎who‏ ‎fall ‎for‏ ‎phishing ‎tests‏ ‎and ‎the‏ ‎response‏ ‎times ‎during‏ ‎fire ‎drills.

📌Continuous ‎Improvement: The ‎data ‎collected‏ ‎from ‎these‏ ‎exercises‏ ‎should ‎be ‎used‏ ‎to ‎continuously‏ ‎improve ‎security ‎training ‎programs‏ ‎and‏ ‎incident ‎response‏ ‎plans.

Organizational ‎Culture

📌Promoting‏ ‎a ‎Security-First ‎Culture: Regular ‎phishing ‎tests‏ ‎and‏ ‎fire ‎drills‏ ‎help ‎promote‏ ‎a ‎culture ‎of ‎security ‎within‏ ‎the‏ ‎organization.‏ ‎They ‎reinforce‏ ‎the ‎importance‏ ‎of ‎security‏ ‎awareness‏ ‎and ‎preparedness‏ ‎among ‎employees.

📌Encouraging ‎Reporting: These ‎exercises ‎encourage‏ ‎employees ‎to‏ ‎report‏ ‎suspicious ‎activities ‎and‏ ‎potential ‎security‏ ‎incidents, ‎fostering ‎a ‎proactive‏ ‎security‏ ‎environment.


Читать: 3+ мин
logo Snarky Security

Why Spies Need AI: Because Guesswork is Overrated

Microsoft ‎has‏ ‎developed ‎a ‎generative ‎AI ‎model‏ ‎specifically ‎for‏ ‎U.S.‏ ‎intelligence ‎agencies ‎to‏ ‎analyze ‎top-secret‏ ‎information.

Key ‎Points

📌Development ‎and ‎Purpose: Microsoft‏ ‎has‏ ‎developed ‎a‏ ‎generative ‎AI‏ ‎model ‎based ‎on ‎GPT-4 ‎technology‏ ‎specifically‏ ‎for ‎U.S.‏ ‎intelligence ‎agencies‏ ‎to ‎analyze ‎top-secret ‎information. ‎The‏ ‎AI‏ ‎model‏ ‎operates ‎in‏ ‎an ‎«air-gapped»‏ ‎environment, ‎completely‏ ‎isolated‏ ‎from ‎the‏ ‎internet, ‎ensuring ‎secure ‎processing ‎of‏ ‎classified ‎data.

📌Security‏ ‎and‏ ‎Isolation: This ‎is ‎the‏ ‎first ‎instance‏ ‎of ‎a ‎large ‎language‏ ‎model‏ ‎functioning ‎independently‏ ‎of ‎the‏ ‎internet, ‎addressing ‎major ‎security ‎concerns‏ ‎associated‏ ‎with ‎generative‏ ‎AI. ‎The‏ ‎model ‎is ‎accessible ‎only ‎through‏ ‎a‏ ‎special‏ ‎network ‎exclusive‏ ‎to ‎the‏ ‎U.S. ‎government,‏ ‎preventing‏ ‎any ‎external‏ ‎data ‎breaches ‎or ‎hacking ‎attempts.

📌Development‏ ‎Timeline ‎and‏ ‎Effort: The‏ ‎project ‎took ‎18‏ ‎months ‎to‏ ‎develop, ‎involving ‎the ‎modification‏ ‎of‏ ‎an ‎AI‏ ‎supercomputer ‎in‏ ‎Iowa. ‎The ‎model ‎is ‎currently‏ ‎undergoing‏ ‎testing ‎and‏ ‎accreditation ‎by‏ ‎the ‎intelligence ‎community.

📌Operational ‎Status: The ‎AI‏ ‎model‏ ‎has‏ ‎been ‎operational‏ ‎for ‎less‏ ‎than ‎a‏ ‎week‏ ‎and ‎is‏ ‎being ‎used ‎to ‎answer ‎queries‏ ‎from ‎approximately‏ ‎10,000‏ ‎members ‎of ‎the‏ ‎U.S. ‎intelligence‏ ‎community.

📌Strategic ‎Importance: The ‎development ‎is‏ ‎seen‏ ‎as ‎a‏ ‎significant ‎advantage‏ ‎for ‎the ‎U.S. ‎intelligence ‎community,‏ ‎potentially‏ ‎giving ‎the‏ ‎U.S. ‎a‏ ‎lead ‎in ‎the ‎race ‎to‏ ‎integrate‏ ‎generative‏ ‎AI ‎into‏ ‎intelligence ‎operations.


Potential‏ ‎Impacts

Intelligence ‎and‏ ‎National‏ ‎Security

📌Enhanced ‎Analysis: Provides‏ ‎U.S. ‎intelligence ‎agencies ‎with ‎a‏ ‎powerful ‎tool‏ ‎to‏ ‎process ‎and ‎analyze‏ ‎classified ‎data‏ ‎more ‎efficiently ‎and ‎comprehensively,‏ ‎potentially‏ ‎improving ‎national‏ ‎security ‎and‏ ‎decision-making.

📌Competitive ‎Edge: Positions ‎the ‎U.S. ‎ahead‏ ‎of‏ ‎other ‎countries‏ ‎in ‎the‏ ‎use ‎of ‎generative ‎AI ‎for‏ ‎intelligence‏ ‎purposes,‏ ‎as ‎highlighted‏ ‎by ‎CIA‏ ‎officials.

Cybersecurity ‎and‏ ‎Data‏ ‎Protection

📌Security ‎Assurance: The‏ ‎air-gapped ‎environment ‎ensures ‎that ‎classified‏ ‎information ‎remains‏ ‎secure,‏ ‎setting ‎a ‎new‏ ‎standard ‎for‏ ‎handling ‎sensitive ‎data ‎with‏ ‎AI.

📌Precedent‏ ‎for ‎Secure‏ ‎AI: Demonstrates ‎the‏ ‎feasibility ‎of ‎developing ‎secure, ‎isolated‏ ‎AI‏ ‎systems, ‎which‏ ‎could ‎influence‏ ‎future ‎AI ‎deployments ‎in ‎other‏ ‎sensitive‏ ‎sectors.

Technology‏ ‎and ‎Innovation

📌Groundbreaking‏ ‎Achievement: ‎Marks‏ ‎a ‎significant‏ ‎milestone‏ ‎in ‎AI‏ ‎development, ‎showcasing ‎the ‎ability ‎to‏ ‎create ‎large‏ ‎language‏ ‎models ‎that ‎operate‏ ‎independently ‎of‏ ‎the ‎internet.

📌Future ‎Developments: ‎Encourages‏ ‎further‏ ‎advancements ‎in‏ ‎secure ‎AI‏ ‎technologies, ‎potentially ‎leading ‎to ‎new‏ ‎applications‏ ‎in ‎various‏ ‎industries ‎such‏ ‎as ‎healthcare, ‎finance, ‎and ‎critical‏ ‎infrastructure.

Government‏ ‎and‏ ‎Public ‎Sector

📌Government‏ ‎Commitment: Reflects ‎the‏ ‎U.S. ‎government’s‏ ‎dedication‏ ‎to ‎leveraging‏ ‎advanced ‎AI ‎technology ‎for ‎national‏ ‎security ‎and‏ ‎intelligence.

📌Broader‏ ‎Adoption: May ‎spur ‎increased‏ ‎investment ‎and‏ ‎adoption ‎of ‎AI ‎technologies‏ ‎within‏ ‎the ‎public‏ ‎sector, ‎particularly‏ ‎for ‎applications ‎involving ‎sensitive ‎or‏ ‎classified‏ ‎data.


Читать: 5+ мин
logo Overkill Security

Firmware Overwrite: The New Trend in Router Fashion

The ‎Chalubo‏ ‎RAT ‎malware ‎campaign ‎targeted ‎specific‏ ‎models ‎of‏ ‎Actiontec‏ ‎and ‎Sagemcom ‎routers,‏ ‎primarily ‎affecting‏ ‎Windstream’s ‎network. ‎The ‎malware‏ ‎used‏ ‎brute-force ‎attacks‏ ‎to ‎gain‏ ‎access, ‎executed ‎payloads ‎in ‎memory‏ ‎to‏ ‎avoid ‎detection,‏ ‎and ‎communicated‏ ‎with ‎C2 ‎servers ‎using ‎encrypted‏ ‎channels.‏ ‎The‏ ‎attack ‎led‏ ‎to ‎a‏ ‎significant ‎outage,‏ ‎requiring‏ ‎the ‎replacement‏ ‎of ‎over ‎600,000 ‎routers, ‎highlighting‏ ‎the ‎need‏ ‎for‏ ‎robust ‎security ‎measures‏ ‎and ‎regular‏ ‎updates ‎to ‎prevent ‎such‏ ‎incidents.

Targets

ISP‏ ‎Impact:

📌Windstream: The ‎primary‏ ‎ISP ‎affected,‏ ‎with ‎over ‎600,000 ‎routers ‎rendered‏ ‎inoperable‏ ‎between ‎October‏ ‎25 ‎and‏ ‎October ‎27, ‎2023.

📌Affected ‎Models: Actiontec ‎T3200,‏ ‎T3260,‏ ‎and‏ ‎Sagemcom ‎F5380.

📌Impact: Approximately‏ ‎49% ‎of‏ ‎the ‎ISP’s‏ ‎modems‏ ‎were ‎taken‏ ‎offline, ‎requiring ‎hardware ‎replacements.

Global ‎Impact:

📌Botnet‏ ‎Activity: From ‎September‏ ‎to‏ ‎November ‎2023, ‎Chalubo‏ ‎botnet ‎panels‏ ‎interacted ‎with ‎up ‎to‏ ‎117,000‏ ‎unique ‎IP‏ ‎addresses ‎over‏ ‎a ‎30-day ‎period.

📌Geographic ‎Distribution: Most ‎infections‏ ‎were‏ ‎in ‎the‏ ‎US, ‎Brazil,‏ ‎and ‎China.

📌Operational ‎Silos: 95% of ‎bots ‎communicated‏ ‎with‏ ‎only‏ ‎one ‎control‏ ‎panel, ‎indicating‏ ‎distinct ‎operational‏ ‎silos.


Affected‏ ‎Routers

📌Targeted ‎Models: End-of-life‏ ‎business-grade ‎routers.

📌Actiontec ‎T3200 ‎and ‎T3260‏ ‎are ‎VDSL2‏ ‎wireless‏ ‎AC ‎gateway ‎routers‏ ‎approved ‎by‏ ‎Windstream.

📌Sagemcom ‎F5380 ‎is ‎a‏ ‎WiFi6‏ ‎(802.11ax) ‎router.

📌DrayTek‏ ‎Vigor ‎Models‏ ‎2960 ‎and ‎3900


Malware: ‎Chalubo ‎RAT

📌First‏ ‎Spotted: August‏ ‎2018 ‎by‏ ‎Sophos ‎Labs.

📌Primary‏ ‎Functions: DDoS ‎attacks, ‎execution ‎of ‎Lua‏ ‎scripts,‏ ‎and‏ ‎evasion ‎techniques‏ ‎using ‎ChaCha20‏ ‎encryption.

Technical ‎Details:

📌Initial‏ ‎Infection: Uses‏ ‎brute-force ‎attacks‏ ‎on ‎SSH ‎servers ‎with ‎weak‏ ‎credentials ‎(e.g.,‏ ‎root:‏ ‎admin).

📌Payload ‎Delivery:

📌First ‎Stage: A‏ ‎bash ‎script‏ ‎(«get_scrpc») ‎fetches ‎a ‎second‏ ‎script‏ ‎(«get_strtriiush») ‎which‏ ‎retrieves ‎and‏ ‎executes ‎the ‎primary ‎bot ‎payload‏ ‎(«Chalubo»‏ ‎or ‎«mips.elf»).

📌Execution: The‏ ‎malware ‎runs‏ ‎in ‎memory, ‎wipes ‎files ‎from‏ ‎the‏ ‎disk,‏ ‎and ‎changes‏ ‎the ‎process‏ ‎name ‎to‏ ‎avoid‏ ‎detection.

📌Communication:

📌C2 ‎Servers: Cycles‏ ‎through ‎hardcoded ‎C2s, ‎downloads ‎the‏ ‎next ‎stage,‏ ‎and‏ ‎decrypts ‎it ‎using‏ ‎ChaCha20.

📌Persistence: The ‎newer‏ ‎version ‎does ‎not ‎maintain‏ ‎persistence‏ ‎on ‎infected‏ ‎devices.


HiatusRAT ‎Malware

📌Port‏ ‎8816: HiatusRAT ‎checks ‎for ‎existing ‎processes‏ ‎on‏ ‎port ‎8816,‏ ‎kills ‎any‏ ‎existing ‎service, ‎and ‎opens ‎a‏ ‎listener‏ ‎on‏ ‎this ‎port.

📌Information‏ ‎Collection: Collects ‎host-based‏ ‎information ‎and‏ ‎sends‏ ‎it ‎to‏ ‎the ‎C2 ‎server ‎to ‎track‏ ‎the ‎infection‏ ‎status‏ ‎and ‎log ‎information‏ ‎about ‎the‏ ‎compromised ‎host.

📌Initial ‎Access: Through ‎exploiting‏ ‎vulnerabilities‏ ‎in ‎router‏ ‎firmware ‎or‏ ‎using ‎weak ‎credentials.

📌Persistence: Uses ‎a ‎bash‏ ‎script‏ ‎to ‎download‏ ‎and ‎execute‏ ‎HiatusRAT ‎and ‎the ‎packet-capture ‎binary

📌Prebuilt‏ ‎Functions:

📌config: Loads‏ ‎new‏ ‎configuration ‎values‏ ‎from ‎the‏ ‎C2 ‎node.

📌shell: Spawns‏ ‎a‏ ‎remote ‎shell‏ ‎on ‎the ‎infected ‎host.

📌file: Allows ‎reading,‏ ‎deleting, ‎or‏ ‎uploading‏ ‎files ‎to ‎the‏ ‎C2.

📌executor: Downloads ‎and‏ ‎executes ‎files ‎from ‎the‏ ‎C2.

📌script: Executes‏ ‎scripts ‎supplied‏ ‎by ‎the‏ ‎C2.

📌tcp_forward: Forwards ‎TCP ‎data ‎from ‎a‏ ‎specified‏ ‎port ‎to‏ ‎another ‎IP‏ ‎address ‎and ‎port.

📌socks5: Sets ‎up ‎a‏ ‎SOCKS5‏ ‎proxy‏ ‎on ‎the‏ ‎compromised ‎router.

📌quit: Ceases‏ ‎execution ‎of‏ ‎the‏ ‎malware.

📌Packet ‎Capture: A‏ ‎variant ‎of ‎tcpdump ‎is ‎deployed‏ ‎to ‎capture‏ ‎and‏ ‎monitor ‎router ‎traffic‏ ‎on ‎ports‏ ‎associated ‎with ‎email ‎and‏ ‎file-transfer‏ ‎communications



Black ‎Lotus‏ ‎Labs ‎Uncovers‏ ‎New ‎Router ‎Malware ‎Campaigns

📌Black ‎Lotus‏ ‎Labs,‏ ‎the ‎threat‏ ‎research ‎team‏ ‎at ‎Lumen ‎Technologies ‎(formerly ‎CenturyLink),‏ ‎has‏ ‎recently‏ ‎uncovered ‎two‏ ‎major ‎malware‏ ‎campaigns ‎targeting‏ ‎routers‏ ‎and ‎networking‏ ‎devices ‎from ‎different ‎manufacturers. ‎These‏ ‎discoveries ‎highlight‏ ‎the‏ ‎increasing ‎threats ‎faced‏ ‎by ‎internet‏ ‎infrastructure ‎and ‎the ‎need‏ ‎for‏ ‎better ‎security‏ ‎practices.

The ‎Hiatus‏ ‎Campaign

📌In ‎March ‎2023, ‎Black ‎Lotus‏ ‎Labs‏ ‎reported ‎on‏ ‎a ‎complex‏ ‎campaign ‎called ‎«Hiatus» ‎that ‎had‏ ‎been‏ ‎targeting‏ ‎business-grade ‎routers,‏ ‎primarily ‎DrayTek‏ ‎Vigor ‎models‏ ‎2960‏ ‎and ‎3900,‏ ‎since ‎June ‎2022.

📌The ‎threat ‎actors‏ ‎exploited ‎end-of-life‏ ‎DrayTek‏ ‎routers ‎to ‎establish‏ ‎long-term ‎persistence‏ ‎without ‎detection.

📌Around ‎4,100 ‎vulnerable‏ ‎DrayTek‏ ‎models ‎were‏ ‎exposed ‎on‏ ‎the ‎internet, ‎with ‎Hiatus ‎compromising‏ ‎approximately‏ ‎100 ‎of‏ ‎them ‎across‏ ‎Latin ‎America, ‎Europe, ‎and ‎North‏ ‎America.

📌Upon‏ ‎infection,‏ ‎the ‎malware‏ ‎intercepts ‎data‏ ‎transiting ‎the‏ ‎infected‏ ‎router ‎and‏ ‎deploys ‎a ‎Remote ‎Access ‎Trojan‏ ‎(RAT) ‎called‏ ‎«HiatusRAT»‏ ‎that ‎can ‎proxy‏ ‎malicious ‎traffic‏ ‎to ‎additional ‎networks.

📌Black ‎Lotus‏ ‎Labs‏ ‎has ‎null-routed‏ ‎the ‎Hiatus‏ ‎command-and-control ‎(C2) ‎servers ‎across ‎Lumen’s‏ ‎global‏ ‎backbone ‎and‏ ‎added ‎the‏ ‎indicators ‎of ‎compromise ‎(IoCs) ‎to‏ ‎their‏ ‎Rapid‏ ‎Threat ‎Defense‏ ‎system ‎to‏ ‎block ‎threats‏ ‎before‏ ‎reaching ‎customer‏ ‎networks.

The ‎Pumpkin ‎Eclipse ‎Campaign

📌In ‎late‏ ‎October ‎2023,‏ ‎Black‏ ‎Lotus ‎Labs ‎investigated‏ ‎a ‎massive‏ ‎outage ‎affecting ‎specific ‎ActionTec‏ ‎(T3200s‏ ‎and ‎T3260s)‏ ‎and ‎Sagemcom‏ ‎(F5380) ‎gateway ‎models ‎within ‎a‏ ‎single‏ ‎internet ‎service‏ ‎provider’s ‎network.

📌Over‏ ‎600,000 ‎devices ‎displayed ‎a ‎static‏ ‎red‏ ‎light,‏ ‎indicating ‎a‏ ‎likely ‎firmware‏ ‎corruption ‎issue.

📌The‏ ‎attack‏ ‎was ‎confined‏ ‎to ‎a ‎specific ‎Autonomous ‎System‏ ‎Number ‎(ASN),‏ ‎impacting‏ ‎around ‎49% ‎of‏ ‎exposed ‎devices‏ ‎in ‎that ‎network.

📌Black ‎Lotus‏ ‎Labs‏ ‎discovered ‎a‏ ‎multi-stage ‎infection‏ ‎mechanism ‎that ‎installed ‎the ‎Chalubo‏ ‎RAT,‏ ‎a ‎botnet‏ ‎targeting ‎SOHO‏ ‎gateways ‎and ‎IoT ‎devices.

📌Black ‎Lotus‏ ‎Labs‏ ‎has‏ ‎added ‎the‏ ‎IoCs ‎from‏ ‎this ‎campaign‏ ‎and‏ ‎the ‎Chalubo‏ ‎malware ‎to ‎their ‎threat ‎intelligence‏ ‎feed, ‎fueling‏ ‎Lumen’s‏ ‎Connected ‎Security ‎portfolio.


Читать: 2+ мин
logo Snarky Security

Zscaler hacked by IntelBroker

IntelBroker ‎claims‏ ‎to ‎have ‎breached ‎Zscaler ‎and‏ ‎sold ‎access‏ ‎to‏ ‎its ‎systems, ‎Zscaler‏ ‎maintains ‎that‏ ‎there ‎has ‎been ‎no‏ ‎compromise‏ ‎of ‎its‏ ‎main ‎environments‏ ‎and ‎that ‎only ‎an ‎isolated‏ ‎test‏ ‎environment ‎was‏ ‎affected. ‎The‏ ‎situation ‎continues ‎to ‎develop ‎as‏ ‎investigations‏ ‎proceed.

IntelBroker’s‏ ‎Claims:

📌IntelBroker, ‎a‏ ‎known ‎threat‏ ‎actor, ‎claimed‏ ‎to‏ ‎have ‎breached‏ ‎Zscaler’s ‎systems.

📌The ‎actor ‎allegedly ‎accessed‏ ‎confidential ‎logs‏ ‎packed‏ ‎with ‎credentials, ‎including‏ ‎SMTP ‎access,‏ ‎PAuth ‎access, ‎and ‎SSL‏ ‎passkeys‏ ‎and ‎certificates.

📌IntelBroker‏ ‎offered ‎to‏ ‎sell ‎this ‎access ‎for ‎$20,000‏ ‎in‏ ‎cryptocurrency.

Zscaler’s ‎Response‏ ‎and ‎Findings:

📌Zscaler‏ ‎has ‎consistently ‎denied ‎any ‎impact‏ ‎or‏ ‎compromise‏ ‎to ‎its‏ ‎customer, ‎production,‏ ‎and ‎corporate‏ ‎environments.

📌The‏ ‎company ‎acknowledged‏ ‎the ‎exposure ‎of ‎an ‎isolated‏ ‎test ‎environment‏ ‎on‏ ‎a ‎single ‎server,‏ ‎which ‎was‏ ‎not ‎connected ‎to ‎Zscaler’s‏ ‎infrastructure‏ ‎or ‎hosting‏ ‎any ‎customer‏ ‎data.

📌This ‎test ‎environment ‎was ‎exposed‏ ‎to‏ ‎the ‎internet‏ ‎and ‎subsequently‏ ‎taken ‎offline ‎for ‎forensic ‎analysis.

Investigative‏ ‎Measures:

📌Zscaler‏ ‎engaged‏ ‎a ‎reputable‏ ‎incident ‎response‏ ‎firm ‎to‏ ‎conduct‏ ‎an ‎independent‏ ‎investigation.

📌The ‎company ‎has ‎been ‎providing‏ ‎regular ‎updates,‏ ‎asserting‏ ‎the ‎security ‎of‏ ‎its ‎main‏ ‎operational ‎environments.

📌Zscaler ‎emphasized ‎that‏ ‎the‏ ‎exposure ‎of‏ ‎the ‎test‏ ‎environment ‎does ‎not ‎affect ‎the‏ ‎security‏ ‎of ‎its‏ ‎primary ‎systems‏ ‎and ‎data.

IntelBroker’s ‎Background ‎and ‎Credibility:

📌IntelBroker‏ ‎has‏ ‎a‏ ‎history ‎of‏ ‎making ‎bold‏ ‎claims ‎about‏ ‎breaches,‏ ‎including ‎previous‏ ‎allegations ‎against ‎high-profile ‎targets ‎like‏ ‎the ‎US‏ ‎State‏ ‎Department ‎and ‎various‏ ‎corporate ‎entities.

📌The‏ ‎threat ‎actor ‎is ‎also‏ ‎known‏ ‎for ‎previous‏ ‎breaches ‎involving‏ ‎companies ‎like ‎PandaBuy ‎and ‎HomeDepot,‏ ‎and‏ ‎claims ‎of‏ ‎stealing ‎data‏ ‎from ‎General ‎Electric.

Root ‎Cause ‎of‏ ‎the‏ ‎Alleged‏ ‎Hack:

📌The ‎root‏ ‎cause, ‎as‏ ‎claimed ‎by‏ ‎IntelBroker,‏ ‎centers ‎on‏ ‎the ‎exploitation ‎of ‎the ‎isolated‏ ‎test ‎environment‏ ‎that‏ ‎was ‎inadvertently ‎exposed‏ ‎to ‎the‏ ‎internet.

📌Zscaler’s ‎investigation ‎discovered ‎only‏ ‎this‏ ‎exposure, ‎which‏ ‎did ‎not‏ ‎involve ‎any ‎customer ‎data ‎or‏ ‎connection‏ ‎to ‎its‏ ‎main ‎infrastructure.

Contradictions‏ ‎and ‎Ongoing ‎Developments:

📌IntelBroker’s ‎assertion ‎that‏ ‎the‏ ‎access‏ ‎sold ‎was‏ ‎not ‎to‏ ‎a ‎testing‏ ‎environment‏ ‎contradicts ‎Zscaler’s‏ ‎findings.

📌Zscaler ‎maintains ‎that ‎there ‎has‏ ‎been ‎no‏ ‎compromise‏ ‎of ‎its ‎main‏ ‎systems ‎and‏ ‎has ‎taken ‎steps ‎to‏ ‎ensure‏ ‎the ‎continued‏ ‎security ‎of‏ ‎its ‎environments.

Читать: 4+ мин
logo Overkill Security

ICSpector: Solving Forensics Problems You Didn’t Know You Had

The ‎Microsoft‏ ‎ICS ‎Forensics ‎Tools ‎framework, known ‎as‏ ‎ICSpector, ‎is‏ ‎an‏ ‎open-source ‎tool ‎designed‏ ‎to ‎facilitate‏ ‎the ‎forensic ‎analysis ‎of‏ ‎Industrial‏ ‎Control ‎Systems‏ ‎(ICS), ‎particularly‏ ‎focusing ‎on ‎Programmable ‎Logic ‎Controllers‏ ‎(PLCs).

Key‏ ‎Technical ‎Points‏ ‎of ‎ICSpector

Framework‏ ‎Composition ‎and ‎Architecture

📌Modular ‎Design: ICSpector ‎is‏ ‎composed‏ ‎of‏ ‎several ‎components‏ ‎that ‎can‏ ‎be ‎developed‏ ‎and‏ ‎executed ‎separately,‏ ‎allowing ‎for ‎flexibility ‎and ‎customization‏ ‎based ‎on‏ ‎specific‏ ‎needs. ‎Users ‎can‏ ‎also ‎add‏ ‎new ‎analyzers

📌Network ‎Scanner: Identifies ‎devices‏ ‎communicating‏ ‎via ‎supported‏ ‎OT ‎protocols‏ ‎and ‎ensures ‎they ‎are ‎responsive.‏ ‎It‏ ‎can ‎work‏ ‎with ‎a‏ ‎provided ‎IP ‎subnet ‎or ‎a‏ ‎specific‏ ‎IP‏ ‎list ‎exported‏ ‎from ‎OT‏ ‎security ‎products.

📌Data‏ ‎Extraction‏ ‎& ‎Analyzer: Extracts‏ ‎PLC ‎project ‎metadata ‎and ‎logic,‏ ‎converting ‎raw‏ ‎data‏ ‎into ‎a ‎human-readable‏ ‎form ‎to‏ ‎highlight ‎areas ‎that ‎may‏ ‎indicate‏ ‎malicious ‎activity.

Forensic‏ ‎Capabilities

📌Identification ‎of‏ ‎Compromised ‎Devices: Helps ‎in ‎identifying ‎compromised‏ ‎devices‏ ‎through ‎manual‏ ‎verification, ‎automated‏ ‎monitoring, ‎or ‎during ‎incident ‎response.

📌Snapshot‏ ‎Creation: Allows‏ ‎for‏ ‎the ‎creation‏ ‎of ‎snapshots‏ ‎of ‎controller‏ ‎projects‏ ‎to ‎compare‏ ‎changes ‎over ‎time, ‎aiding ‎in‏ ‎the ‎detection‏ ‎of‏ ‎tampering ‎or ‎anomalies.

📌Support‏ ‎for ‎Siemens‏ ‎PLCs: Currently ‎supports ‎Siemens ‎SIMATIC‏ ‎S7-300‏ ‎and ‎S7-400‏ ‎families, ‎with‏ ‎plans ‎to ‎support ‎other ‎PLC‏ ‎families‏ ‎in ‎the‏ ‎future.

Integration ‎with‏ ‎Other ‎Tools

📌Microsoft ‎Defender ‎for ‎IoT: Can‏ ‎be‏ ‎used‏ ‎alongside ‎Microsoft‏ ‎Defender ‎for‏ ‎IoT, ‎which‏ ‎provides‏ ‎network-layer ‎security,‏ ‎continuous ‎monitoring, ‎asset ‎discovery, ‎threat‏ ‎detection, ‎and‏ ‎vulnerability‏ ‎management ‎for ‎IoT/OT‏ ‎environments.

Use ‎Cases

📌Incident‏ ‎Response: Useful ‎for ‎incident ‎response‏ ‎operations‏ ‎to ‎detect‏ ‎compromised ‎devices‏ ‎and ‎understand ‎if ‎PLC ‎code‏ ‎was‏ ‎tampered ‎with.

📌Proactive‏ ‎Security: Helps ‎in‏ ‎proactive ‎incident ‎response ‎by ‎comparing‏ ‎PLC‏ ‎programs‏ ‎on ‎engineering‏ ‎workstations ‎with‏ ‎those ‎on‏ ‎the‏ ‎actual ‎devices‏ ‎to ‎detect ‎unauthorized ‎changes.

Industries

📌Nuclear, ‎Thermal,‏ ‎and ‎Hydroelectric‏ ‎Power‏ ‎Plants: Power ‎plants ‎rely‏ ‎heavily ‎on‏ ‎Industrial ‎Control ‎Systems ‎(ICS)‏ ‎to‏ ‎manage ‎critical‏ ‎operations. ‎ICSpector‏ ‎can ‎be ‎used ‎to ‎ensure‏ ‎the‏ ‎integrity ‎of‏ ‎Programmable ‎Logic‏ ‎Controllers ‎(PLCs) ‎that ‎control ‎these‏ ‎processes.‏ ‎By‏ ‎detecting ‎any‏ ‎anomalous ‎indicators‏ ‎or ‎compromised‏ ‎configurations,‏ ‎ICSpector ‎helps‏ ‎prevent ‎disruptions ‎that ‎could ‎lead‏ ‎to ‎power‏ ‎outages‏ ‎or ‎safety ‎hazards.

📌Water‏ ‎Treatment ‎Plants: These‏ ‎facilities ‎use ‎ICS ‎to‏ ‎control‏ ‎the ‎treatment‏ ‎processes ‎that‏ ‎ensure ‎water ‎safety. ‎ICSpector ‎can‏ ‎help‏ ‎in ‎monitoring‏ ‎and ‎verifying‏ ‎the ‎integrity ‎of ‎PLCs, ‎ensuring‏ ‎that‏ ‎the‏ ‎water ‎treatment‏ ‎processes ‎are‏ ‎not ‎tampered‏ ‎with,‏ ‎which ‎is‏ ‎crucial ‎for ‎public ‎health ‎and‏ ‎safety.

📌Industrial ‎Manufacturing: In‏ ‎manufacturing‏ ‎environments, ‎ICS ‎are‏ ‎used ‎to‏ ‎control ‎machinery ‎and ‎production‏ ‎lines.‏ ‎ICSpector ‎can‏ ‎be ‎used‏ ‎to ‎detect ‎any ‎unauthorized ‎changes‏ ‎or‏ ‎anomalies ‎in‏ ‎the ‎PLCs,‏ ‎ensuring ‎consistent ‎product ‎quality ‎and‏ ‎preventing‏ ‎costly‏ ‎downtimes ‎due‏ ‎to ‎equipment‏ ‎failure.

📌Critical ‎Infrastructure‏ ‎Sectors: This‏ ‎includes ‎sectors‏ ‎like ‎energy, ‎water, ‎transportation, ‎and‏ ‎communication ‎systems.‏ ‎ICSpector‏ ‎can ‎be ‎used‏ ‎to ‎safeguard‏ ‎the ‎ICS ‎that ‎control‏ ‎these‏ ‎critical ‎infrastructures‏ ‎from ‎cyberattacks,‏ ‎ensuring ‎their ‎continuous ‎and ‎secure‏ ‎operation.

📌Chemical‏ ‎Processing ‎Plants: These‏ ‎plants ‎use‏ ‎ICS ‎to ‎manage ‎complex ‎chemical‏ ‎processes.‏ ‎ICSpector‏ ‎can ‎help‏ ‎in ‎ensuring‏ ‎that ‎the‏ ‎PLCs‏ ‎controlling ‎these‏ ‎processes ‎are ‎secure ‎and ‎have‏ ‎not ‎been‏ ‎tampered‏ ‎with, ‎which ‎is‏ ‎vital ‎for‏ ‎preventing ‎hazardous ‎incidents.

📌Oil ‎and‏ ‎Gas‏ ‎Industry: ICS ‎are‏ ‎used ‎extensively‏ ‎in ‎the ‎oil ‎and ‎gas‏ ‎sector‏ ‎for ‎drilling,‏ ‎refining, ‎and‏ ‎distribution ‎processes. ‎ICSpector ‎can ‎be‏ ‎used‏ ‎to‏ ‎monitor ‎and‏ ‎verify ‎the‏ ‎integrity ‎of‏ ‎these‏ ‎systems, ‎preventing‏ ‎disruptions ‎that ‎could ‎lead ‎to‏ ‎significant ‎financial‏ ‎losses‏ ‎and ‎environmental ‎damage


Читать: 3+ мин
logo Snarky Security

Europol hacked by IntelBroker

The ‎breach‏ ‎at ‎Europol ‎by ‎the ‎hacker‏ ‎known ‎as‏ ‎IntelBroker,‏ ‎which ‎occurred ‎on‏ ‎May ‎10,‏ ‎2024, ‎has ‎resulted ‎in‏ ‎a‏ ‎significant ‎data‏ ‎breach ‎exposing‏ ‎highly ‎sensitive ‎and ‎classified ‎information.‏ ‎This‏ ‎incident ‎has‏ ‎raised ‎serious‏ ‎concerns ‎about ‎the ‎security ‎measures‏ ‎at‏ ‎Europol‏ ‎and ‎the‏ ‎potential ‎exploitation‏ ‎of ‎the‏ ‎exposed‏ ‎data ‎by‏ ‎other ‎malicious ‎actors.

📌Details ‎of ‎the‏ ‎Breach

IntelBroker, ‎a‏ ‎key‏ ‎member ‎of ‎the‏ ‎CyberNiggers ‎threat‏ ‎group, ‎has ‎been ‎involved‏ ‎in‏ ‎various ‎high-profile‏ ‎cyber ‎incidents,‏ ‎including ‎earlier ‎breaches ‎at ‎HSBC‏ ‎and‏ ‎Zscaler. ‎The‏ ‎compromised ‎data‏ ‎from ‎the ‎Europol ‎breach ‎includes‏ ‎sensitive‏ ‎materials‏ ‎such ‎as‏ ‎alliance ‎employee‏ ‎information, ‎For‏ ‎Official‏ ‎Use ‎Only‏ ‎(FOUO) ‎source ‎code, ‎PDFs, ‎documents‏ ‎for ‎reconnaissance,‏ ‎and‏ ‎operational ‎guidelines. ‎This‏ ‎breach ‎poses‏ ‎immediate ‎security ‎risks ‎to‏ ‎Europol’s‏ ‎operations ‎and‏ ‎highlights ‎the‏ ‎vulnerabilities ‎within ‎Europol’s ‎cybersecurity ‎infrastructure.

📌Affected‏ ‎Europol‏ ‎Entities

The ‎breach‏ ‎has ‎impacted‏ ‎several ‎entities ‎within ‎Europol, ‎including‏ ‎the‏ ‎CCSE,‏ ‎EC3, ‎Europol‏ ‎Platform ‎for‏ ‎Experts, ‎Law‏ ‎Enforcement‏ ‎Forum, ‎and‏ ‎SIRIUS. ‎The ‎infiltration ‎of ‎these‏ ‎entities ‎could‏ ‎disrupt‏ ‎ongoing ‎investigations ‎and‏ ‎compromise ‎sensitive‏ ‎intelligence ‎shared ‎among ‎international‏ ‎law‏ ‎enforcement ‎agencies.

📌Europol’s‏ ‎Response

As ‎of‏ ‎the ‎latest ‎updates, ‎Europol ‎has‏ ‎not‏ ‎made ‎any‏ ‎public ‎announcements‏ ‎regarding ‎the ‎breach. ‎However, ‎they‏ ‎have‏ ‎confirmed‏ ‎a ‎separate‏ ‎incident ‎involving‏ ‎their ‎Europol‏ ‎Platform‏ ‎for ‎Experts‏ ‎(EPE) ‎portal, ‎stating ‎that ‎no‏ ‎operational ‎data‏ ‎was‏ ‎stolen ‎in ‎that‏ ‎specific ‎incident.

📌Broader‏ ‎Implications

This ‎incident ‎underscores ‎the‏ ‎need‏ ‎for ‎enhanced‏ ‎security ‎measures‏ ‎to ‎safeguard ‎against ‎future ‎incidents.‏ ‎The‏ ‎breach ‎not‏ ‎only ‎threatens‏ ‎the ‎integrity ‎of ‎Europol’s ‎operations‏ ‎but‏ ‎also‏ ‎has ‎broader‏ ‎implications ‎for‏ ‎international ‎law‏ ‎enforcement‏ ‎cooperation ‎and‏ ‎data ‎security.

📌Monitoring ‎and ‎Future ‎Actions

To‏ ‎track ‎activities‏ ‎of‏ ‎threat ‎actors ‎like‏ ‎IntelBroker, ‎monitoring‏ ‎dark ‎web ‎sources ‎such‏ ‎as‏ ‎hacker ‎forums‏ ‎and ‎private‏ ‎Telegram ‎channels ‎is ‎crucial. ‎These‏ ‎platforms‏ ‎often ‎serve‏ ‎as ‎venues‏ ‎for ‎cyber ‎threats ‎to ‎originate‏ ‎and‏ ‎proliferate.

📌Root‏ ‎of ‎Cause

The‏ ‎breach ‎of‏ ‎Europol’s ‎Europol‏ ‎Platform‏ ‎for ‎Experts‏ ‎(EPE) ‎portal ‎by ‎IntelBroker ‎was‏ ‎primarily ‎facilitated‏ ‎through‏ ‎the ‎exploitation ‎of‏ ‎vulnerabilities ‎within‏ ‎the ‎system. ‎IntelBroker’s ‎method‏ ‎typically‏ ‎involves ‎identifying‏ ‎and ‎exploiting‏ ‎these ‎vulnerabilities ‎to ‎gain ‎unauthorized‏ ‎access‏ ‎to ‎systems.‏ ‎In ‎the‏ ‎case ‎of ‎the ‎EPE ‎breach,‏ ‎the‏ ‎hacker‏ ‎managed ‎to‏ ‎access ‎sensitive‏ ‎data, ‎including‏ ‎For‏ ‎Official ‎Use‏ ‎Only ‎(FOUO) ‎documents ‎and ‎classified‏ ‎data, ‎which‏ ‎were‏ ‎then ‎claimed ‎to‏ ‎be ‎up‏ ‎for ‎sale. ‎This ‎incident‏ ‎highlights‏ ‎the ‎critical‏ ‎need ‎for‏ ‎robust ‎cybersecurity ‎measures ‎and ‎regular‏ ‎system‏ ‎updates ‎to‏ ‎patch ‎any‏ ‎vulnerabilities ‎that ‎could ‎be ‎exploited‏ ‎by‏ ‎malicious‏ ‎actors

Читать: 3+ мин
logo Snarky Security

Ascension hacked

Ascension, ‎one‏ ‎of ‎the ‎largest ‎non-profit ‎Catholic‏ ‎health ‎systems‏ ‎in‏ ‎the ‎United ‎States,‏ ‎has ‎recently‏ ‎suffered ‎a ‎significant ‎cyberattack‏ ‎impacting‏ ‎its ‎operations‏ ‎across ‎140‏ ‎hospitals ‎in ‎19 ‎states. ‎The‏ ‎attack‏ ‎was ‎detected‏ ‎on ‎Wednesday,‏ ‎and ‎it ‎has ‎caused ‎widespread‏ ‎disruptions‏ ‎to‏ ‎clinical ‎operations‏ ‎and ‎patient‏ ‎care.

📌Overview ‎of‏ ‎the‏ ‎Cyberattack

The ‎cyberattack‏ ‎on ‎Ascension ‎was ‎first ‎noticed‏ ‎due ‎to‏ ‎«unusual‏ ‎activity» ‎on ‎select‏ ‎technology ‎systems.‏ ‎It ‎has ‎led ‎to‏ ‎the‏ ‎shutdown ‎of‏ ‎electronic ‎health‏ ‎records, ‎patient ‎communication ‎portals ‎like‏ ‎MyChart,‏ ‎and ‎various‏ ‎systems ‎used‏ ‎for ‎ordering ‎tests, ‎procedures, ‎and‏ ‎medications.‏ ‎This‏ ‎disruption ‎has‏ ‎forced ‎the‏ ‎healthcare ‎provider‏ ‎to‏ ‎revert ‎to‏ ‎manual ‎systems ‎for ‎patient ‎care,‏ ‎reminiscent ‎of‏ ‎pre-digital‏ ‎times.

📌Impact ‎on ‎Patient‏ ‎Care

The ‎cyberattack‏ ‎has ‎severely ‎impacted ‎patient‏ ‎care‏ ‎across ‎Ascension’s‏ ‎network. ‎Ambulances‏ ‎have ‎been ‎diverted, ‎and ‎non-emergent‏ ‎elective‏ ‎procedures ‎have‏ ‎been ‎temporarily‏ ‎suspended ‎to ‎prioritize ‎urgent ‎care.‏ ‎Patients‏ ‎have‏ ‎been ‎advised‏ ‎to ‎bring‏ ‎detailed ‎notes‏ ‎about‏ ‎their ‎symptoms‏ ‎and ‎a ‎list ‎of ‎medications‏ ‎to ‎their‏ ‎appointments.

📌Root‏ ‎cause

The ‎type ‎of‏ ‎cyberattack ‎has‏ ‎been ‎identified ‎as ‎a‏ ‎ransomware‏ ‎attack, ‎specifically‏ ‎linked ‎to‏ ‎the ‎Black ‎Basta ‎ransomware ‎group.‏ ‎Black‏ ‎Basta ‎ransomware‏ ‎typically ‎infiltrates‏ ‎networks ‎through ‎methods ‎such ‎as‏ ‎phishing‏ ‎emails,‏ ‎exploiting ‎software‏ ‎vulnerabilities, ‎or‏ ‎using ‎compromised‏ ‎credentials.

📌RaaS

Black‏ ‎Basta ‎is‏ ‎a ‎ransomware-as-a-service ‎(RaaS) ‎group ‎that‏ ‎emerged ‎in‏ ‎early‏ ‎2022 ‎and ‎has‏ ‎been ‎linked‏ ‎to ‎several ‎high-profile ‎attacks.‏ ‎The‏ ‎group ‎is‏ ‎known ‎for‏ ‎its ‎double ‎extortion ‎tactics, ‎which‏ ‎involve‏ ‎encrypting ‎the‏ ‎victim’s ‎data‏ ‎and ‎threatening ‎to ‎release ‎it‏ ‎publicly‏ ‎if‏ ‎the ‎ransom‏ ‎is ‎not‏ ‎paid. ‎This‏ ‎group‏ ‎has ‎targeted‏ ‎various ‎sectors, ‎including ‎healthcare, ‎indicating‏ ‎a ‎pattern‏ ‎of‏ ‎attacks ‎against ‎organizations‏ ‎with ‎critical‏ ‎infrastructure.

📌Entry ‎Points

Entry ‎point ‎or‏ ‎vulnerability‏ ‎exploited ‎by‏ ‎the ‎attackers‏ ‎includes ‎initial ‎access ‎through ‎phishing,‏ ‎exploitation‏ ‎of ‎public-facing‏ ‎applications, ‎the‏ ‎use ‎of ‎previously ‎compromised ‎credentials‏ ‎to‏ ‎gain‏ ‎deeper ‎access‏ ‎to ‎the‏ ‎network.

📌Broader ‎Implications

This‏ ‎incident‏ ‎is ‎part‏ ‎of ‎a ‎larger ‎trend ‎of‏ ‎increasing ‎cyberattacks‏ ‎on‏ ‎healthcare ‎systems, ‎which‏ ‎are ‎particularly‏ ‎vulnerable ‎due ‎to ‎the‏ ‎critical‏ ‎nature ‎of‏ ‎their ‎services‏ ‎and ‎the ‎valuable ‎data ‎they‏ ‎hold.‏ ‎The ‎attack‏ ‎on ‎Ascension‏ ‎highlights ‎the ‎ongoing ‎challenges ‎and‏ ‎the‏ ‎need‏ ‎for ‎robust‏ ‎cybersecurity ‎measures‏ ‎in ‎the‏ ‎healthcare‏ ‎sector.

📌Response ‎to‏ ‎the ‎Cyberattack

Ascension ‎has ‎engaged ‎Mandiant,‏ ‎a ‎cybersecurity‏ ‎firm‏ ‎and ‎Google ‎subsidiary,‏ ‎to ‎assist‏ ‎in ‎the ‎investigation ‎and‏ ‎remediation‏ ‎process. ‎The‏ ‎focus ‎is‏ ‎on ‎investigating ‎the ‎breach, ‎containing‏ ‎it,‏ ‎and ‎restoring‏ ‎the ‎affected‏ ‎systems. ‎However, ‎there ‎is ‎currently‏ ‎no‏ ‎timeline‏ ‎for ‎when‏ ‎systems ‎will‏ ‎be ‎fully‏ ‎operational‏ ‎again.

Читать: 2+ мин
logo Overkill Security

Raytracing on a ZX Spectrum: Who Needs Modern GPUs When You Can Spend a Weekend Rendering a Single Frame to Prove That Masochism Can Be a Hobby?

ZX ‎Raytracer is‏ ‎project ‎not ‎only ‎demonstrates ‎the‏ ‎feasibility ‎of‏ ‎implementing‏ ‎a ‎raytracer ‎on‏ ‎the ‎ZX‏ ‎Spectrum ‎but ‎also ‎serves‏ ‎as‏ ‎an ‎educational‏ ‎resource, ‎a‏ ‎celebration ‎of ‎computing ‎history, ‎and‏ ‎an‏ ‎inspiration ‎for‏ ‎future ‎projects‏ ‎in ‎retro ‎computing, ‎embedded ‎systems,‏ ‎and‏ ‎optimization‏ ‎techniques

Key ‎Points‏ ‎& ‎Potential‏ ‎Uses

📌Implementing ‎a‏ ‎Raytracer‏ ‎on ‎Legacy‏ ‎Hardware: ‎The ‎project ‎demonstrates ‎the‏ ‎possibility ‎of‏ ‎implementing‏ ‎a ‎raytracer, ‎a‏ ‎computationally ‎intensive‏ ‎graphics ‎rendering ‎technique, ‎on‏ ‎the‏ ‎ZX ‎Spectrum,‏ ‎a ‎home‏ ‎computer ‎from ‎the ‎1980s ‎with‏ ‎very‏ ‎limited ‎hardware‏ ‎capabilities ‎(3.5MHz‏ ‎Z80A ‎CPU ‎and ‎often ‎only‏ ‎16KB‏ ‎RAM).

📌Overcoming‏ ‎Hardware ‎Limitations:‏ ‎Despite ‎the‏ ‎severe ‎hardware‏ ‎constraints,‏ ‎the ‎project‏ ‎overcame ‎challenges ‎like ‎attribute ‎clash‏ ‎(color ‎limitations),‏ ‎low‏ ‎resolution ‎(256×176 ‎pixels),‏ ‎and ‎slow‏ ‎performance ‎(initial ‎render ‎time‏ ‎of‏ ‎17 ‎hours‏ ‎per ‎frame)‏ ‎through ‎clever ‎optimizations ‎and ‎approximations.

📌Educational‏ ‎Tool: The‏ ‎project ‎could‏ ‎be ‎used‏ ‎as ‎a ‎teaching ‎aid ‎in‏ ‎computer‏ ‎science‏ ‎courses, ‎particularly‏ ‎those ‎focused‏ ‎on ‎computer‏ ‎graphics,‏ ‎optimization ‎techniques,‏ ‎or ‎low-level ‎programming.

📌Retro ‎Gaming ‎and‏ ‎Demoscene ‎Exhibitions:‏ ‎The‏ ‎raytracer ‎could ‎be‏ ‎showcased ‎at‏ ‎retro ‎computing ‎events, ‎demoscene‏ ‎parties,‏ ‎or ‎exhibitions‏ ‎celebrating ‎the‏ ‎achievements ‎of ‎vintage ‎hardware ‎and‏ ‎programming.

📌Embedded‏ ‎Systems ‎Development:‏ ‎The ‎optimization‏ ‎techniques ‎and ‎approximations ‎used ‎in‏ ‎this‏ ‎project‏ ‎could ‎inspire‏ ‎developers ‎working‏ ‎on ‎embedded‏ ‎systems‏ ‎or ‎resource-constrained‏ ‎devices, ‎where ‎efficient ‎use ‎of‏ ‎limited ‎resources‏ ‎is‏ ‎crucial.

📌Appreciation ‎of ‎Computing‏ ‎History: ‎The‏ ‎project ‎could ‎be ‎featured‏ ‎in‏ ‎museums ‎or‏ ‎exhibitions ‎dedicated‏ ‎to ‎the ‎history ‎of ‎computing,‏ ‎showcasing‏ ‎the ‎ingenuity‏ ‎and ‎creativity‏ ‎of ‎early ‎programmers ‎working ‎with‏ ‎limited‏ ‎hardware‏ ‎resources.

📌Inspiration ‎for‏ ‎Future ‎Projects:‏ ‎The ‎success‏ ‎of‏ ‎this ‎project‏ ‎could ‎motivate ‎others ‎to ‎explore‏ ‎the ‎limits‏ ‎of‏ ‎legacy ‎hardware ‎or‏ ‎undertake ‎similar‏ ‎challenging ‎projects, ‎pushing ‎the‏ ‎boundaries‏ ‎of ‎what‏ ‎is ‎possible‏ ‎on ‎vintage ‎systems.


Читать: 2+ мин
logo Snarky Security

Dell Hacked

📌Dell ‎Announces‏ ‎Security ‎Breach: Dell ‎Technologies ‎has ‎confirmed‏ ‎a ‎significant‏ ‎data‏ ‎breach ‎involving ‎a‏ ‎database ‎used‏ ‎to ‎store ‎information ‎about‏ ‎customer‏ ‎purchases. ‎The‏ ‎breach, ‎which‏ ‎was ‎disclosed ‎on ‎May ‎10,‏ ‎2024,‏ ‎affected ‎approximately‏ ‎49 ‎million‏ ‎customers. ‎The ‎stolen ‎data ‎includes‏ ‎customer‏ ‎names,‏ ‎physical ‎addresses,‏ ‎and ‎details‏ ‎about ‎Dell‏ ‎equipment‏ ‎but ‎does‏ ‎not ‎include ‎sensitive ‎information ‎like‏ ‎payment ‎details.‏ ‎Dell‏ ‎has ‎initiated ‎an‏ ‎investigation, ‎notified‏ ‎law ‎enforcement, ‎and ‎hired‏ ‎a‏ ‎third-party ‎forensic‏ ‎firm ‎to‏ ‎further ‎investigate ‎the ‎incident.

📌Details ‎of‏ ‎the‏ ‎Breach: The ‎breach‏ ‎was ‎executed‏ ‎by ‎exploiting ‎an ‎unsecured ‎API‏ ‎attached‏ ‎to‏ ‎a ‎partner‏ ‎portal. ‎The‏ ‎threat ‎actor,‏ ‎known‏ ‎as ‎Menelik,‏ ‎claimed ‎to ‎have ‎scraped ‎information‏ ‎of ‎49‏ ‎million‏ ‎customer ‎records ‎using‏ ‎this ‎method.‏ ‎The ‎data ‎includes ‎a‏ ‎wide‏ ‎range ‎of‏ ‎hardware ‎details,‏ ‎such ‎as ‎service ‎tags, ‎item‏ ‎descriptions,‏ ‎order ‎dates,‏ ‎and ‎warranty‏ ‎details. ‎Dell ‎was ‎reportedly ‎notified‏ ‎about‏ ‎the‏ ‎vulnerability ‎by‏ ‎the ‎threat‏ ‎actor ‎before‏ ‎the‏ ‎data ‎was‏ ‎put ‎up ‎for ‎sale ‎on‏ ‎a ‎hacking‏ ‎forum,‏ ‎but ‎the ‎breach‏ ‎was ‎not‏ ‎contained ‎until ‎approximately ‎two‏ ‎weeks‏ ‎later.

📌Customer ‎Notification‏ ‎and ‎Response: Dell‏ ‎has ‎sent ‎out ‎notifications ‎to‏ ‎its‏ ‎customers ‎warning‏ ‎them ‎about‏ ‎the ‎breach. ‎The ‎company ‎has‏ ‎downplayed‏ ‎the‏ ‎significance ‎of‏ ‎the ‎stolen‏ ‎data, ‎stating‏ ‎that‏ ‎it ‎does‏ ‎not ‎include ‎financial ‎or ‎highly‏ ‎sensitive ‎customer‏ ‎information.‏ ‎However, ‎Dell ‎has‏ ‎advised ‎customers‏ ‎to ‎be ‎vigilant ‎against‏ ‎potential‏ ‎tech ‎support‏ ‎scams ‎that‏ ‎could ‎use ‎the ‎stolen ‎hardware‏ ‎details‏ ‎to ‎impersonate‏ ‎Dell ‎support‏ ‎technicians.

📌Legal ‎and ‎Regulatory ‎Implications: This ‎incident‏ ‎adds‏ ‎to‏ ‎a ‎series‏ ‎of ‎data‏ ‎breaches ‎that‏ ‎Dell‏ ‎has ‎experienced‏ ‎over ‎the ‎years, ‎raising ‎concerns‏ ‎about ‎the‏ ‎company’s‏ ‎data ‎protection ‎measures‏ ‎and ‎cybersecurity‏ ‎practices. ‎Previous ‎breaches ‎have‏ ‎led‏ ‎to ‎class-action‏ ‎lawsuits ‎and‏ ‎investigations ‎by ‎privacy ‎commissioners, ‎highlighting‏ ‎the‏ ‎legal ‎and‏ ‎regulatory ‎implications‏ ‎for ‎Dell.

📌Cybersecurity ‎Measures ‎and ‎Recommendations: In‏ ‎response‏ ‎to‏ ‎the ‎breach,‏ ‎Dell ‎has‏ ‎emphasized ‎its‏ ‎commitment‏ ‎to ‎cybersecurity,‏ ‎offering ‎various ‎services ‎and ‎solutions‏ ‎aimed ‎at‏ ‎enhancing‏ ‎IT ‎security ‎and‏ ‎cyber ‎resiliency.‏ ‎The ‎company ‎provides ‎a‏ ‎range‏ ‎of ‎products‏ ‎and ‎advisory‏ ‎services ‎designed ‎to ‎improve ‎threat‏ ‎detection,‏ ‎threat ‎response,‏ ‎and ‎cyber‏ ‎recovery ‎capabilities

Читать: 3+ мин
logo Overkill Security

FIDO2: Phishing-Resistant, But Not Token-Resistant

The ‎article‏ ‎on ‎Silverfort’s ‎blog ‎explores ‎how‏ ‎MITM ‎attacks‏ ‎can‏ ‎bypass ‎FIDO2's ‎phishing-resistant‏ ‎protections. ‎It‏ ‎details ‎the ‎FIDO2 ‎authentication‏ ‎flow,‏ ‎highlights ‎vulnerabilities‏ ‎in ‎session‏ ‎token ‎handling, ‎and ‎provides ‎real-world‏ ‎examples‏ ‎involving ‎Entra‏ ‎ID ‎SSO,‏ ‎PingFederate, ‎and ‎Yubico ‎Playground, ‎concluding‏ ‎with‏ ‎mitigation‏ ‎strategies ‎to‏ ‎enhance ‎security.


FIDO2‏ ‎Background

📌FIDO2 ‎is‏ ‎a‏ ‎modern ‎passwordless‏ ‎authentication ‎standard ‎developed ‎by ‎the‏ ‎FIDO ‎Alliance‏ ‎to‏ ‎replace ‎passwords

📌It ‎aims‏ ‎to ‎protect‏ ‎against ‎phishing, ‎man-in-the-middle ‎(MITM),‏ ‎and‏ ‎session ‎hijacking‏ ‎attacks

📌The ‎authentication‏ ‎flow ‎involves ‎device ‎registration ‎and‏ ‎authentication‏ ‎steps ‎using‏ ‎public ‎key‏ ‎cryptography

FIDO2 ‎Security ‎Features

📌FIDO2 ‎is ‎designed‏ ‎to‏ ‎prevent‏ ‎phishing, ‎MITM,‏ ‎and ‎session‏ ‎hijacking ‎attacks

📌However,‏ ‎the‏ ‎research ‎found‏ ‎that ‎FIDO2 ‎implementations ‎often ‎do‏ ‎not ‎protect‏ ‎session‏ ‎tokens ‎after ‎successful‏ ‎authentication

Attacking ‎FIDO2‏ ‎with ‎MITM

📌The ‎author ‎investigated‏ ‎MITM‏ ‎attacks ‎on‏ ‎identity ‎providers‏ ‎(IdPs) ‎that ‎relay ‎communications ‎between‏ ‎devices

📌While‏ ‎MITM ‎is‏ ‎more ‎difficult‏ ‎with ‎TLS, ‎methods ‎like ‎DNS‏ ‎spoofing,‏ ‎ARP‏ ‎poisoning, ‎and‏ ‎certificate ‎theft‏ ‎can ‎achieve‏ ‎it

📌By‏ ‎performing ‎MITM‏ ‎on ‎the ‎IdP, ‎the ‎attacker‏ ‎can ‎hijack‏ ‎the‏ ‎session ‎token ‎after‏ ‎FIDO2 ‎authentication


Entra‏ ‎ID ‎SSO ‎(Microsoft)

📌Overview: Entra ‎ID‏ ‎SSO‏ ‎is ‎a‏ ‎single ‎sign-on‏ ‎solution ‎that ‎supports ‎various ‎SSO‏ ‎protocols‏ ‎and ‎modern‏ ‎authentication ‎methods,‏ ‎including ‎FIDO2.

📌Vulnerability: The ‎research ‎demonstrated ‎that‏ ‎an‏ ‎attacker‏ ‎could ‎hijack‏ ‎sessions ‎by‏ ‎exploiting ‎the‏ ‎way‏ ‎Entra ‎ID‏ ‎handles ‎session ‎tokens.

📌Attack ‎Method: The ‎attacker‏ ‎does ‎not‏ ‎need‏ ‎to ‎relay ‎the‏ ‎entire ‎authentication‏ ‎process. ‎Instead, ‎they ‎can‏ ‎use‏ ‎a ‎signed‏ ‎token ‎provided‏ ‎by ‎the ‎IdP, ‎which ‎has‏ ‎an‏ ‎expiration ‎time‏ ‎of ‎one‏ ‎hour. ‎This ‎token ‎can ‎be‏ ‎reused‏ ‎within‏ ‎the ‎valid‏ ‎time ‎frame‏ ‎to ‎generate‏ ‎state‏ ‎cookies ‎for‏ ‎a ‎longer ‎period.

📌Example: The ‎native ‎Azure‏ ‎Management ‎portal‏ ‎application‏ ‎does ‎not ‎validate‏ ‎the ‎token‏ ‎granted ‎by ‎the ‎SSO,‏ ‎allowing‏ ‎an ‎attacker‏ ‎to ‎use‏ ‎a ‎stolen ‎token ‎to ‎gain‏ ‎unauthorized‏ ‎access.

PingFederate

📌Overview: PingFederate ‎is‏ ‎an ‎SSO‏ ‎solution ‎that ‎uses ‎third-party ‎adapters‏ ‎to‏ ‎perform‏ ‎authentication. ‎These‏ ‎adapters ‎can‏ ‎be ‎chained‏ ‎into‏ ‎an ‎authentication‏ ‎policy ‎flow.

📌Vulnerability: The ‎research ‎found ‎that‏ ‎if ‎the‏ ‎relying‏ ‎party ‎developer ‎does‏ ‎not ‎validate‏ ‎the ‎OIDC ‎token ‎(or‏ ‎SAML‏ ‎Response), ‎the‏ ‎MITM ‎attack‏ ‎can ‎be ‎successful.

📌Attack ‎Method: The ‎attack‏ ‎exploits‏ ‎the ‎weakest‏ ‎link ‎in‏ ‎the ‎authentication ‎chain. ‎Since ‎the‏ ‎SSO‏ ‎protocols‏ ‎rely ‎on‏ ‎granting ‎tokens‏ ‎that ‎can‏ ‎be‏ ‎reused ‎by‏ ‎different ‎devices, ‎an ‎attacker ‎can‏ ‎hijack ‎the‏ ‎session‏ ‎by ‎stealing ‎these‏ ‎tokens.

📌Example: The ‎PingOne‏ ‎adapter ‎can ‎be ‎used‏ ‎with‏ ‎FIDO2 ‎capabilities.‏ ‎If ‎the‏ ‎OIDC ‎token ‎is ‎not ‎validated,‏ ‎an‏ ‎attacker ‎can‏ ‎bypass ‎FIDO2‏ ‎protections ‎and ‎gain ‎unauthorized ‎access.

Yubico‏ ‎Playground

📌Overview: Yubico‏ ‎Playground‏ ‎is ‎a‏ ‎testing ‎environment‏ ‎for ‎FIDO‏ ‎security‏ ‎features ‎and‏ ‎keys.

📌Vulnerability: The ‎research ‎showed ‎that ‎a‏ ‎simple ‎session‏ ‎cookie‏ ‎generated ‎after ‎FIDO2‏ ‎authentication ‎can‏ ‎be ‎exploited.

📌Attack ‎Method: There ‎is‏ ‎no‏ ‎validation ‎on‏ ‎the ‎device‏ ‎that ‎requested ‎the ‎session ‎cookie.‏ ‎Any‏ ‎device ‎can‏ ‎use ‎this‏ ‎cookie ‎until ‎it ‎expires, ‎allowing‏ ‎an‏ ‎attacker‏ ‎to ‎bypass‏ ‎the ‎authentication‏ ‎step.

📌Example: ‎By‏ ‎acquiring‏ ‎the ‎session‏ ‎cookie, ‎an ‎attacker ‎can ‎access‏ ‎the ‎user’s‏ ‎private‏ ‎area ‎and ‎remove‏ ‎the ‎security‏ ‎key ‎from ‎the ‎user’s‏ ‎profile,‏ ‎demonstrating ‎a‏ ‎straightforward ‎session‏ ‎hijacking ‎scenario

Читать: 5+ мин
logo Snarky Security

The U.S. Sanctions Spree: A Masterclass in Global Bullying

The ‎recent‏ ‎actions by ‎the ‎U.S. ‎Department ‎of‏ ‎the ‎Treasury’s‏ ‎Office‏ ‎of ‎Foreign ‎Assets‏ ‎Control ‎(OFAC)‏ ‎on ‎June ‎12, ‎2024,‏ ‎reflect‏ ‎a ‎desperate‏ ‎attempt ‎by‏ ‎a ‎once-dominant ‎global ‎power ‎to‏ ‎maintain‏ ‎its ‎waning‏ ‎influence. ‎U.S.‏ ‎is ‎in ‎a ‎manic ‎panic,‏ ‎flailing‏ ‎about‏ ‎with ‎new‏ ‎sanctions ‎in‏ ‎a ‎futile‏ ‎attempt‏ ‎to ‎regain‏ ‎control ‎and ‎influence. ‎It’s ‎a‏ ‎classic ‎case‏ ‎of‏ ‎a ‎lost ‎hegemon‏ ‎trying ‎to‏ ‎assert ‎dominance ‎through ‎increasingly‏ ‎desperate‏ ‎measures.

📌Russia-related ‎Designations:‏ ‎The ‎U.S.‏ ‎has ‎added ‎more ‎names ‎to‏ ‎its‏ ‎ever-growing ‎list‏ ‎of ‎sanctioned‏ ‎Russian ‎entities ‎and ‎individuals. ‎Because,‏ ‎you‏ ‎know,‏ ‎if ‎the‏ ‎first ‎4,000‏ ‎sanctions ‎didn’t‏ ‎work,‏ ‎surely ‎the‏ ‎next ‎300 ‎will ‎do ‎the‏ ‎trick.

📌Targeting ‎Chinese‏ ‎Firms: The‏ ‎U.S. ‎is ‎now‏ ‎going ‎after‏ ‎Chinese ‎companies ‎that ‎dare‏ ‎to‏ ‎do ‎business‏ ‎with ‎Russia.‏ ‎It’s ‎almost ‎as ‎if ‎the‏ ‎U.S.‏ ‎believes ‎that‏ ‎bullying ‎other‏ ‎countries ‎into ‎compliance ‎will ‎somehow‏ ‎restore‏ ‎its‏ ‎lost ‎hegemony.

📌Secondary‏ ‎Sanctions: Foreign ‎financial‏ ‎institutions ‎are‏ ‎now‏ ‎at ‎risk‏ ‎of ‎sanctions ‎if ‎they ‎deal‏ ‎with ‎any‏ ‎of‏ ‎the ‎newly ‎sanctioned‏ ‎Russian ‎entities.‏ ‎Because ‎nothing ‎says ‎«global‏ ‎leadership»‏ ‎like ‎threatening‏ ‎the ‎entire‏ ‎world’s ‎banking ‎system.

📌Expanding ‎Definitions: The ‎Treasury‏ ‎has‏ ‎broadened ‎the‏ ‎definition ‎of‏ ‎Russia’s ‎«military-industrial ‎base» ‎to ‎include‏ ‎just‏ ‎about‏ ‎anyone ‎and‏ ‎anything ‎remotely‏ ‎connected ‎to‏ ‎Russia.‏ ‎It’s ‎a‏ ‎classic ‎move: ‎when ‎in ‎doubt,‏ ‎just ‎make‏ ‎the‏ ‎net ‎wider.

📌Restricting ‎IT‏ ‎Services: The ‎U.S.‏ ‎is ‎restricting ‎the ‎supply‏ ‎of‏ ‎IT ‎services‏ ‎and ‎software‏ ‎to ‎Russia. ‎Because ‎clearly, ‎cutting‏ ‎off‏ ‎access ‎to‏ ‎Microsoft ‎Office‏ ‎will ‎bring ‎the ‎Russian ‎war‏ ‎machine‏ ‎to‏ ‎its ‎knees.

📌Global‏ ‎Networks: The ‎sanctions‏ ‎also ‎target‏ ‎transnational‏ ‎networks ‎in‏ ‎countries ‎like ‎China, ‎Turkey, ‎and‏ ‎the ‎UAE.‏ ‎It’s‏ ‎almost ‎as ‎if‏ ‎the ‎U.S.‏ ‎is ‎trying ‎to ‎pick‏ ‎a‏ ‎fight ‎with‏ ‎half ‎the‏ ‎world ‎at ‎once.

📌G7 ‎Summit: These ‎actions‏ ‎come‏ ‎just ‎in‏ ‎time ‎for‏ ‎the ‎G7 ‎summit, ‎where ‎world‏ ‎leaders‏ ‎will‏ ‎undoubtedly ‎pat‏ ‎themselves ‎on‏ ‎the ‎back‏ ‎for‏ ‎their ‎«tough‏ ‎stance» ‎on ‎Russia. ‎Meanwhile, ‎Russia‏ ‎continues ‎to‏ ‎adapt‏ ‎and ‎find ‎new‏ ‎ways ‎to‏ ‎circumvent ‎these ‎measures.

Affected ‎Industries:

📌Financial‏ ‎Services:‏ ‎Multiple ‎documents‏ ‎highlight ‎sanctions‏ ‎and ‎exemptions ‎related ‎to ‎financial‏ ‎transactions‏ ‎and ‎services.

📌Cyber‏ ‎Operations: Entities ‎involved‏ ‎in ‎cyber ‎activities ‎are ‎specifically‏ ‎targeted.

📌Humanitarian‏ ‎Aid:‏ ‎Exemptions ‎are‏ ‎provided ‎for‏ ‎transactions ‎related‏ ‎to‏ ‎humanitarian ‎aid.

📌Energy‏ ‎Sector: ‎Sanctions ‎target ‎entities ‎in‏ ‎the ‎energy‏ ‎industry.

📌Defense‏ ‎Sector: ‎Entities ‎in‏ ‎the ‎defense‏ ‎industry ‎are ‎affected ‎by‏ ‎the‏ ‎sanctions.

📌Maritime ‎Industry:‏ ‎Vessels ‎added‏ ‎to ‎the ‎SDN ‎List ‎indicate‏ ‎that‏ ‎the ‎maritime‏ ‎industry ‎is‏ ‎also ‎affected. ‎This ‎includes ‎shipping‏ ‎companies‏ ‎and‏ ‎operators ‎of‏ ‎vessels ‎that‏ ‎are ‎involved‏ ‎in‏ ‎activities ‎supporting‏ ‎sanctioned ‎entities ‎or ‎individuals

Full ‎list

These‏ ‎documents ‎collectively‏ ‎provide‏ ‎a ‎comprehensive ‎overview‏ ‎of ‎the‏ ‎recent ‎actions ‎taken ‎by‏ ‎OFAC‏ ‎in ‎relation‏ ‎to ‎Russia,‏ ‎including ‎designations, ‎general ‎licenses, ‎determinations,‏ ‎and‏ ‎guidance ‎on‏ ‎compliance.

Document ‎932921

  • Russia-related‏ ‎Designations: ‎This ‎document ‎lists ‎individuals‏ ‎and‏ ‎entities‏ ‎designated ‎under‏ ‎the ‎Russia-related‏ ‎sanctions ‎program.
  • Sanctions‏ ‎Criteria: It‏ ‎outlines ‎the‏ ‎criteria ‎for ‎these ‎designations, ‎including‏ ‎involvement ‎in‏ ‎destabilizing‏ ‎activities, ‎cyber ‎operations,‏ ‎and ‎support‏ ‎for ‎the ‎Russian ‎government.

Document‏ ‎932926

  • General‏ ‎Licenses: ‎This‏ ‎document ‎details‏ ‎new ‎general ‎licenses ‎issued ‎by‏ ‎OFAC.‏ ‎These ‎licenses‏ ‎provide ‎exemptions‏ ‎for ‎certain ‎transactions ‎and ‎activities‏ ‎that‏ ‎would‏ ‎otherwise ‎be‏ ‎prohibited ‎under‏ ‎the ‎sanctions.
  • Specific‏ ‎Transactions:‏ ‎It ‎specifies‏ ‎the ‎types ‎of ‎transactions ‎allowed‏ ‎under ‎these‏ ‎licenses,‏ ‎such ‎as ‎humanitarian‏ ‎aid ‎and‏ ‎certain ‎financial ‎services.

Document ‎932931

  • Determination‏ ‎on‏ ‎Russian ‎Financial‏ ‎Sector: This ‎document‏ ‎contains ‎a ‎determination ‎related ‎to‏ ‎the‏ ‎Russian ‎financial‏ ‎sector, ‎outlining‏ ‎specific ‎actions ‎and ‎criteria ‎subject‏ ‎to‏ ‎sanctions.
  • Implementation‏ ‎Guidance: ‎It‏ ‎provides ‎guidance‏ ‎on ‎how‏ ‎these‏ ‎determinations ‎will‏ ‎be ‎implemented ‎and ‎enforced.

Document ‎932936

  • Updated‏ ‎FAQs: ‎This‏ ‎document‏ ‎includes ‎updated ‎Frequently‏ ‎Asked ‎Questions‏ ‎(FAQs) ‎to ‎provide ‎additional‏ ‎guidance‏ ‎on ‎the‏ ‎implementation ‎of‏ ‎Russia-related ‎sanctions.
  • Compliance ‎Requirements: It ‎addresses ‎common‏ ‎queries‏ ‎and ‎clarifies‏ ‎compliance ‎requirements‏ ‎for ‎individuals ‎and ‎businesses ‎affected‏ ‎by‏ ‎the‏ ‎sanctions.

Document ‎932941

  • Additional‏ ‎Designations: This ‎document‏ ‎lists ‎additional‏ ‎individuals‏ ‎and ‎entities‏ ‎designated ‎under ‎the ‎Russia-related ‎sanctions‏ ‎program.
  • Rationale ‎for‏ ‎Designations: It‏ ‎explains ‎the ‎rationale‏ ‎behind ‎these‏ ‎designations, ‎focusing ‎on ‎their‏ ‎roles‏ ‎in ‎activities.

Document‏ ‎932946

  • Sectoral ‎Sanctions:‏ ‎This ‎document ‎outlines ‎sectoral ‎sanctions‏ ‎targeting‏ ‎specific ‎sectors‏ ‎of ‎the‏ ‎Russian ‎economy, ‎such ‎as ‎energy,‏ ‎finance,‏ ‎and‏ ‎defense.
  • Prohibited ‎Activities: It‏ ‎details ‎the‏ ‎specific ‎activities‏ ‎and‏ ‎transactions ‎that‏ ‎are ‎prohibited ‎under ‎these ‎sectoral‏ ‎sanctions.


Читать: 2+ мин
logo Snarky Security

U.S. Air Force is asking money again

The ‎U.S.‏ ‎Air ‎Force ‎has ‎outlined ‎its‏ ‎strategic ‎vision‏ ‎for‏ ‎2025, ‎emphasizing ‎an‏ ‎increase ‎in‏ ‎flying ‎operations ‎and ‎a‏ ‎move‏ ‎towards ‎a‏ ‎more ‎streamlined,‏ ‎«flat» ‎workforce ‎structure. ‎This ‎vision‏ ‎is‏ ‎part ‎of‏ ‎its ‎budget‏ ‎request ‎for ‎Fiscal ‎Year ‎2025,‏ ‎where‏ ‎the‏ ‎Air ‎Force‏ ‎is ‎seeking‏ ‎$217.5 ‎billion‏ ‎in‏ ‎funding. ‎This‏ ‎request ‎represents ‎a ‎significant ‎investment‏ ‎in ‎the‏ ‎future‏ ‎capabilities ‎and ‎readiness‏ ‎of ‎the‏ ‎Air ‎Force, ‎aiming ‎to‏ ‎adapt‏ ‎to ‎the‏ ‎rapidly ‎evolving‏ ‎nature ‎of ‎global ‎threats ‎and‏ ‎technological‏ ‎advancements.

Increased ‎Flying‏ ‎Operations

The ‎plan‏ ‎for ‎increased ‎flying ‎operations ‎is‏ ‎a‏ ‎response‏ ‎to ‎the‏ ‎growing ‎need‏ ‎for ‎air‏ ‎superiority‏ ‎in ‎an‏ ‎era ‎where ‎aerial ‎threats ‎and‏ ‎the ‎strategic‏ ‎importance‏ ‎of ‎air ‎dominance‏ ‎are ‎escalating.‏ ‎This ‎includes ‎not ‎only‏ ‎traditional‏ ‎manned ‎aircraft‏ ‎operations ‎but‏ ‎also ‎an ‎increased ‎reliance ‎on‏ ‎unmanned‏ ‎aerial ‎vehicles‏ ‎(UAVs) ‎and‏ ‎remotely ‎piloted ‎aircraft ‎(RPA), ‎reflecting‏ ‎the‏ ‎ongoing‏ ‎shift ‎towards‏ ‎more ‎technologically‏ ‎advanced ‎and‏ ‎versatile‏ ‎air ‎combat‏ ‎capabilities.

Flat ‎Workforce ‎Structure

The ‎move ‎towards‏ ‎a ‎«flat»‏ ‎workforce‏ ‎structure ‎is ‎indicative‏ ‎of ‎the‏ ‎Air ‎Force’s ‎commitment ‎to‏ ‎becoming‏ ‎more ‎agile‏ ‎and ‎efficient.‏ ‎This ‎approach ‎aims ‎to ‎reduce‏ ‎bureaucratic‏ ‎layers, ‎streamline‏ ‎decision-making ‎processes,‏ ‎and ‎foster ‎a ‎culture ‎of‏ ‎innovation‏ ‎and‏ ‎rapid ‎response‏ ‎to ‎challenges.‏ ‎By ‎flattening‏ ‎the‏ ‎organizational ‎structure,‏ ‎the ‎Air ‎Force ‎hopes ‎to‏ ‎enhance ‎its‏ ‎operational‏ ‎effectiveness ‎and ‎adaptability,‏ ‎ensuring ‎that‏ ‎it ‎can ‎quickly ‎respond‏ ‎to‏ ‎new ‎threats‏ ‎and ‎opportunities.

Funding‏ ‎the ‎Future

The ‎$217.5 ‎billion ‎budget‏ ‎request‏ ‎for ‎Fiscal‏ ‎Year ‎2025‏ ‎is ‎a ‎clear ‎indication ‎of‏ ‎the‏ ‎Air‏ ‎Force’s ‎priorities‏ ‎and ‎strategic‏ ‎direction. ‎This‏ ‎funding‏ ‎is ‎intended‏ ‎to ‎support ‎the ‎dual ‎goals‏ ‎of ‎increasing‏ ‎flying‏ ‎operations ‎and ‎implementing‏ ‎a ‎flat‏ ‎workforce ‎structure, ‎alongside ‎other‏ ‎critical‏ ‎initiatives ‎such‏ ‎as ‎modernizing‏ ‎the ‎nuclear ‎triad, ‎advancing ‎space‏ ‎capabilities,‏ ‎and ‎investing‏ ‎in ‎cyber‏ ‎defense.

This ‎budget ‎request ‎also ‎reflects‏ ‎the‏ ‎broader‏ ‎strategic ‎objectives‏ ‎of ‎the‏ ‎Department ‎of‏ ‎Defense,‏ ‎emphasizing ‎readiness,‏ ‎modernization, ‎and ‎innovation ‎to ‎maintain‏ ‎the ‎United‏ ‎States'‏ ‎military ‎edge ‎in‏ ‎an ‎increasingly‏ ‎competitive ‎global ‎landscape.

Читать: 3+ мин
logo Overkill Security

Incident Response Made Easy: Using BucketLoot for Cloud Storage Forensics

BucketLoot’s ‎automated‏ ‎approach, ‎versatility ‎across ‎multiple ‎cloud‏ ‎platforms, ‎and‏ ‎comprehensive‏ ‎feature ‎set ‎make‏ ‎it ‎a‏ ‎valuable ‎addition ‎to ‎the‏ ‎toolbox‏ ‎of ‎security‏ ‎professionals, ‎DevOps‏ ‎teams, ‎and ‎organizations ‎seeking ‎to‏ ‎enhance‏ ‎their ‎cloud‏ ‎security ‎posture‏ ‎and ‎protect ‎sensitive ‎data ‎stored‏ ‎in‏ ‎cloud‏ ‎object ‎storage‏ ‎buckets.

Key ‎Features

📌Automated‏ ‎Cloud ‎Bucket‏ ‎Inspection: BucketLoot‏ ‎can ‎automatically‏ ‎scan ‎and ‎inspect ‎S3-compatible ‎cloud‏ ‎storage ‎buckets‏ ‎across‏ ‎multiple ‎platforms, ‎including‏ ‎Amazon ‎Web‏ ‎Services ‎(AWS), ‎Google ‎Cloud‏ ‎Storage‏ ‎(GCS), ‎DigitalOcean‏ ‎Spaces, ‎and‏ ‎custom ‎domains/URLs.

📌Asset ‎Extraction: ‎The ‎tool‏ ‎can‏ ‎extract ‎valuable‏ ‎assets ‎stored‏ ‎in ‎the ‎buckets, ‎such ‎as‏ ‎URLs,‏ ‎subdomains,‏ ‎and ‎domains,‏ ‎which ‎can‏ ‎be ‎useful‏ ‎for‏ ‎attack ‎surface‏ ‎management ‎and ‎reconnaissance.

📌Secret ‎Exposure ‎Detection: BucketLoot‏ ‎can ‎detect‏ ‎and‏ ‎flag ‎potential ‎secret‏ ‎exposures, ‎such‏ ‎as ‎API ‎keys, ‎access‏ ‎tokens,‏ ‎and ‎other‏ ‎sensitive ‎information,‏ ‎helping ‎organizations ‎identify ‎and ‎mitigate‏ ‎security‏ ‎risks.

📌Custom ‎Keyword‏ ‎and ‎Regex‏ ‎Searching: ‎Users ‎can ‎search ‎for‏ ‎specific‏ ‎keywords‏ ‎or ‎regular‏ ‎expressions ‎within‏ ‎the ‎bucket‏ ‎files,‏ ‎enabling ‎targeted‏ ‎searches ‎for ‎sensitive ‎data ‎or‏ ‎specific ‎types‏ ‎of‏ ‎information.

📌Efficient ‎Scanning: ‎BucketLoot‏ ‎focuses ‎on‏ ‎scanning ‎files ‎that ‎store‏ ‎data‏ ‎in ‎plain-text‏ ‎formats, ‎optimizing‏ ‎the ‎scanning ‎process ‎and ‎improving‏ ‎performance.

📌Flexible‏ ‎Scanning ‎Modes: The‏ ‎tool ‎offers‏ ‎a ‎guest ‎mode ‎for ‎initial‏ ‎scans‏ ‎without‏ ‎requiring ‎credentials,‏ ‎as ‎well‏ ‎as ‎a‏ ‎complete‏ ‎scan ‎mode‏ ‎with ‎platform ‎credentials ‎for ‎more‏ ‎comprehensive ‎analysis.

📌JSON‏ ‎Output: BucketLoot‏ ‎provides ‎its ‎output‏ ‎in ‎a‏ ‎JSON ‎format, ‎making ‎it‏ ‎easy‏ ‎to ‎parse‏ ‎and ‎integrate‏ ‎the ‎results ‎into ‎existing ‎workflows‏ ‎or‏ ‎other ‎security‏ ‎tools.

Usefulness ‎Across‏ ‎Industries ‎and ‎for ‎Security ‎Experts

📌Cybersecurity‏ ‎Professionals: BucketLoot‏ ‎is‏ ‎an ‎invaluable‏ ‎tool ‎for‏ ‎cybersecurity ‎professionals,‏ ‎such‏ ‎as ‎penetration‏ ‎testers, ‎bug ‎hunters, ‎and ‎security‏ ‎researchers, ‎as‏ ‎it‏ ‎aids ‎in ‎identifying‏ ‎potential ‎vulnerabilities‏ ‎and ‎data ‎exposures ‎in‏ ‎cloud‏ ‎storage ‎configurations.

📌Cloud‏ ‎Service ‎Providers: Organizations‏ ‎that ‎offer ‎cloud ‎services ‎can‏ ‎leverage‏ ‎BucketLoot ‎to‏ ‎ensure ‎the‏ ‎security ‎of ‎their ‎customers' ‎data‏ ‎stored‏ ‎in‏ ‎cloud ‎buckets‏ ‎and ‎maintain‏ ‎compliance ‎with‏ ‎industry‏ ‎standards.

📌DevSecOps ‎and‏ ‎DevOps ‎Teams: ‎By ‎integrating ‎BucketLoot‏ ‎into ‎their‏ ‎workflows,‏ ‎DevSecOps ‎and ‎DevOps‏ ‎teams ‎can‏ ‎proactively ‎identify ‎and ‎mitigate‏ ‎security‏ ‎risks ‎associated‏ ‎with ‎cloud‏ ‎storage, ‎promoting ‎secure ‎software ‎development‏ ‎practices.

📌Incident‏ ‎Response ‎and‏ ‎Forensics: ‎In‏ ‎the ‎event ‎of ‎a ‎data‏ ‎breach‏ ‎or‏ ‎security ‎incident,‏ ‎BucketLoot ‎can‏ ‎assist ‎incident‏ ‎response‏ ‎teams ‎and‏ ‎forensic ‎investigators ‎in ‎quickly ‎identifying‏ ‎exposed ‎data‏ ‎and‏ ‎potential ‎attack ‎vectors‏ ‎related ‎to‏ ‎cloud ‎storage ‎misconfigurations.

📌Compliance ‎and‏ ‎Risk‏ ‎Management: ‎Organizations‏ ‎subject ‎to‏ ‎regulatory ‎compliance ‎requirements, ‎such ‎as‏ ‎GDPR,‏ ‎HIPAA, ‎or‏ ‎PCI-DSS, ‎can‏ ‎use ‎BucketLoot ‎to ‎ensure ‎the‏ ‎secure‏ ‎handling‏ ‎of ‎sensitive‏ ‎data ‎stored‏ ‎in ‎cloud‏ ‎buckets‏ ‎and ‎demonstrate‏ ‎adherence ‎to ‎data ‎protection ‎standards.

📌Bug‏ ‎Bounty ‎Programs:‏ ‎Bug‏ ‎bounty ‎hunters ‎and‏ ‎researchers ‎can‏ ‎leverage ‎BucketLoot ‎to ‎uncover‏ ‎potential‏ ‎vulnerabilities ‎and‏ ‎data ‎exposures‏ ‎in ‎cloud ‎storage ‎configurations, ‎contributing‏ ‎to‏ ‎the ‎overall‏ ‎security ‎posture‏ ‎of ‎organizations ‎and ‎earning ‎rewards.

Показать еще

Подарить подписку

Будет создан код, который позволит адресату получить бесплатный для него доступ на определённый уровень подписки.

Оплата за этого пользователя будет списываться с вашей карты вплоть до отмены подписки. Код может быть показан на экране или отправлен по почте вместе с инструкцией.

Будет создан код, который позволит адресату получить сумму на баланс.

Разово будет списана указанная сумма и зачислена на баланс пользователя, воспользовавшегося данным промокодом.

Добавить карту
0/2048