BuzzSec

Motherboard obtained and published the technical report on the hack of Jeff Bezos's phone, which is being attributed to Saudi Arabia, specifically to Crown Prince Mohammed bin Salman. ...investigators set up a secure lab to examine the phone and its artifacts and spent two days poring over the device but were unable to find any malware on it. Instead, they only found a suspicious video file sent to Bezos on May 1, 2018 that "appears to be an Arabic language promotional film about telecommunications." That file shows an image of the Saudi Arabian flag and Swedish flags and arrived with an encrypted downloader. Because the downloader was encrypted this delayed or further prevented "study of the code delivered along with the video." Investigators determined the video or downloader were suspicious only because Bezos' phone subsequently began transmitting large amounts of data. "[W]ithin hours of the encrypted downloader being received, a massive and...

Ray Felch // SOFTWARE DEFINED RADIO: RF Signal Replay Techniques Disclaimer: Be sure to use a faraday bag or cage before transmitting any data so you don’t accidentally break any laws by illegally transmitting on regulated frequencies. Additionally, intercepting and decrypting someone else’s data is illegal, so be careful when researching your traffic. Preface: Recently, […] The post How To Replay RF Signals Using SDR appeared first on Black Hills Information Security . from Black Hills Information Security https://www.blackhillsinfosec.com/how-to-replay-rf-signals-using-sdr/

Current Problem When working in an unknown network, some of the most important pieces of information to have are appraisals of current assets and information contained on them. This is important for any security professional, from tester to defender. Given the prevalence of Active Directory (AD) in most Windows environments, gaining a clear inventory of the network has become a priority in information gathering.”. One of the main problems when relying on AD is the bad hygiene of cleaning out machine accounts for hosts that are no longer part of the network. I have seen environments that have stale 10-year-old records in their AD database where half or more of the records are of hosts that no longer exist. This complicates the matter for a consultant conducting attack emulation or for a threat hunter trying to identify assets. I know I can use the LastLogon date of the machine, but since I use the machine’s extracted credentials for other purposes in several scenarios, I prefer to use ...

This is new from Reuters: More than two years ago, Apple told the FBI that it planned to offer users end-to-end encryption when storing their phone data on iCloud, according to one current and three former FBI officials and one current and one former Apple employee. Under that plan, primarily designed to thwart hackers, Apple would no longer have a key to unlock the encrypted data, meaning it would not be able to turn material over to authorities in a readable form even under court order. In private talks with Apple soon after, representatives of the FBI's cyber crime agents and its operational technology division objected to the plan, arguing it would deny them the most effective means for gaining evidence against iPhone-using suspects, the government sources said. When Apple spoke privately to the FBI about its work on phone security the following year, the end-to-end encryption plan had been dropped, according to the six sources. Reuters could not determine why exactly App...

Click here to download the complete analysis as a PDF. This report is based on proprietary Recorded Future network traffic analysis of RAT controllers detected using signatures developed by Insikt Group researchers. The period of analysis covers November 28, 2019 through January 5, 2020. This report will primarily be of interest to SOC analysts and threat intelligence professionals in organizations operating in the energy sector who are conducting threat hunting assignments relating to malware used by Iranian nation-state threat actors. Over the course of the last year, Recorded Future research has demonstrated that Iran-nexus groups, possibly including APT33 (also called Elfin), have been prolific in amassing operational network infrastructure throughout 2019. Additionally, in November 2019, Microsoft disclosed that APT33 had shifted focus from targeting IT networks to physical control systems used in electric utilities, manufacturing, and oil refineries. We also documented sta...

As I promised few days ago, I have aggregated and analyzed the events collected in the cyber attacks timelines for the whole 2019, producing some (hopefully) interesting stats. At the end the total sample is composed of 1802 events, which is a sharp increase in comparison with the 1337 of 2018. Feel free to browse the charts to have an overall idea for the threat landscape of the year just gone. from HACKMAGEDDON https://www.hackmageddon.com/2020/01/23/2019-cyber-attacks-statistics/

Apple is rolling out a new update to its iOS operating system that addresses the location privacy issue on iPhone 11 devices that was first detailed here last month. Beta versions of iOS 13.3.1 include a new setting that lets users disable the “Ultra Wideband” feature, a short-range technology that lets iPhone 11 users share files locally with other nearby phones that support this feature. In December, KrebsOnSecurity pointed out  the new iPhone 11 line queries the user’s location even when all applications and system services are individually set never to request this data. Apple initially said the company did not see any privacy concerns and that the location tracking icon (a small, upward-facing arrow to the left of the battery icon) appears for system services that do not have a switch in the iPhone’s settings menu. Apple later acknowledged the mysterious location requests were related to the inclusion of an Ultra Wideband chip in iPhone 11, Pro and Pro Max devices. Th...