https://t.co/BC6PDOJb6W

»Today Elastic announced that they are changing the license of both Elasticsearch and Kibana from the open source Apache v2 license to Server Side Public License (SSPL). «

Republican North Dakota legislators have introduced #SB2333, a bill that prohibits large tech companies from locking their users into a single app store or payment processor.

https://t.co/PgyhgOhFAl

1/

While his has implications for Android and other large tech platforms, its most immediate and far-reaching effects with be on Apple, whose Ios platform uses lock-in to monopolize both apps and payments (and another domain, not mentioned in the bill: repairs).

2/

Predictably, this has thrown Apple into a fury, with Apple's privacy chief @erikn telling the SD legislature that Apple uses its monopoly over the app store to protect its users' privacy and

Neuenschwander makes a good, but incomplete, point. To the extent that Apple has the same interests as its users, it uses its app store monopoly to lock out bad apps (to the best of its ability).

4/

But when Apple's interests diverge from its users' interests, the prohibition on sideloading apps actively harms those users' privacy and security. Think of how Apple caved to Chinese state demands to remove working VPNs from the Ios app store to facilitate mass surveillance.

5/

A THREAD on how most real estate folks structure deals with outside investors.

Most people utilize the "preferred equity" structure when they raise money from outside investors. They "syndicate" deals.

Here's the basics:

The person (or team of people) putting the deal together is the "sponsor". Also called general parter. Referred to on twitter as the GP.

They find the property, do all the work, hire the management company and take fees. They often co-sign debt and always secure the financing.

The investor is generally passive, doing no work and putting in cash. This is the "limited partner". Referred to on twitter as the LP.

They don't co-sign debt. They simply read reports and ask the sponsors questions and cash checks every month (if the deal is going well).

There are two equity classes.

"Preferred equity" belongs to the LPs. Cash talks, so this is a higher class of shares. They are first in the "capital stack" behind the debt (bank loan).

"Common equity" belongs to the sponsor. They are generally last in the capital stack.

Sponsors generally co-invest. That means they hold both equity classes. A 10% co-invest is standard.

That means the GP has skin in the game. His 10% co-invest makes him both an LP and a GP.

As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

Here are some highlights:
The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).

Once the registry value is created, the attackers wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped by the SolarWinds backdoor (Stage 1).

The VBScript in turn runs rundll32.exe, activating the Cobalt Strike loader DLL using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution.

On the custom Cobalt Strike Loaders: we identified several second-stage malware, including TEARDROP, Raindrop, and other custom loaders for the Cobalt Strike beacon. During the lateral movement phase, the custom loader DLLs are dropped mostly in existing Windows sub-directories.

Lunchtime update from the Grenfell Tower Inquiry:

President of Arconic's French arm accepts customers were 'deliberately and dishonestly misled' over fire classification of cladding panels, as he is asked about email saying failed fire test must be kept 'VERY CONFIDENTIAL'

The most interesting point of this morning's evidence came right at the end of the session when Claude Schmidt was grilled about an email his colleague Claude Wehrle sent regarding the serious failure of polyethylene-cored ACM panels when bent into a cassette form in March 2010

Remember: Arconic in 2004/5 tested its ACM PE panel when bent into cassette and when bolted to a wall with rivets. The cassette version failed spectacularly, burning 10 times as fast. But Arconic dismissed this as a 'rogue result' and drew no distinction in its marketing...

... simply presenting the panel as a 'Class B' (the rating for the rivetted panel, and the required standard for many European countries). Skip forward to 2010, and this email chain.

Mr Wehrle, the firm's senior technical member of staff is told about a trend in Spain and Portugal where clients are demanding more fire resistant panels, and warned that with this type of panel "our prices are no longer in the market"