BC INTERNET

Saved by @Alex1Powell

Kyle Hanslovan
@KyleHanslovan 4 years, 4 months ago 1120 views

Save to PDF Share See On Twitter

Only 1 / 67 antivirus engines list SUNBURST backdoor as malicious - SolarWinds.Orion.Core.BusinessLayer.dll https://t.co/taaiUtSJzR #SUNBURST #UNC2452

SolarWinds' digital certificate hasn't been revoked yet.

The full compromised package is still being hosted online as well 😓 hxxps://downloads.solarwinds[.]com/solarwinds/CatalogResources/Core/2019.4/2019.4.5220.20574/SolarWinds-Core-v2019.4.5220-Hotfix5.msp

Job class within the backdoored #Sunburst DLL is pretty straight forward and aligns with @FireEye's analysis. CollectSystemDescription:

DeleteFile

DeleteRegistryValue

FileExists

#UNC2452 prefers MD5 for their file hashing routine

#UNC2452's DirList is savvy enough to always expand environment variables. Doesn't appear to have any recursion or depth arguments for DirWalk'ing.

Use of token manipulation was underwhelming. Sets process privilege to SeTakeOwnershipPrivilege, SeRestorePrivilege, and SeShutdownPrivilege.

Domain1 = https://t.co/BGPAyeprMm
(just like the report said). Thus far all analysis has held up (no real surprise there).

One of the anomalous #SUNBURST DLLs from October 2019 that Microsoft highlighted can be found in the SolarWinds Coreinstall.msi for 2019.4.5220.20161 - hxxps://downloads.solarwinds[.]com/solarwinds/CatalogResources/Core/2019.4/2019.4.5220.20161/CoreInstaller.msi

Malicious #SUNBURST DLL CE77D116A074DAB7A22A0FD4F2C1AB475F16EEC42E1DED3C0B0AA8211FE858D6 from May 2020 can be found in CoreInstaller.msi for 2020.2.5320.27438 -hxxps://downloads.solarwinds[.]com/solarwinds/CatalogResources/Core/2020.2/2020.2.5320.27438/CoreInstaller.msi

Malicious #SUNBUST DLL 019085A76BA7126FFF22770D71BD901C325FC68AC55AA743327984E89F4B0134 from April 2020 can be found in CoreInstaller.msi for 2020.2.5220.27327 - hxxps://downloads.solarwinds[.]com/solarwinds/CatalogResources/Core/2020.2/2020.2.5220.27327/CoreInstaller.msi

More from Internet

$Nicola Bidoli \U0001f6e1\U0001f6e1\U0001f6e1$

Nicola Bidoli 🛡🛡🛡...
@BidoliNicola

➡️Found IP address in the Dominion Server,kidnapped in Frankfurt,2020 US elections manipulating actors:
👉Belgrade,Serbia(OSF/Soros)
👉Iran(Edison/BMA)
👉HSBC Bank,Canada(Eric Coomer)
👉DVSCORP(UNICOM China)
👉CTCL(Mark Zuckemberg)
👉Indivisible .org(ACORN,OBAMA Political Group)

1)➡️ Belgrade, Serbia(OSF/Soros)
Esiste un collegamento diretto con Belgrado, in Serbia, e ci sono, o c'erano, numerosi dipendenti Dominion in Serbia. Sempre in Serbia esiste la Open Society Foundation, proprieta' di Soros, che appartiene ad una delle 1/2

5 Fondazioni nell'europa dell'est, facenti capo alla sede madre a Barcellona (stessa citta' della Syct) la sede di Bruxelles per l'advocacy, e le sedi di londra e Berlino per i temi globali. La sede di New York coordina il tutto. 2/2

2)➡️ Dal 2004, in qualità di unico fornitore di dati sui sondaggi del giorno delle elezioni per il National Election Pool, 👉Edison Research ha condotto sondaggi di uscita per proiettare e analizzare i risultati di ogni principale elezione presidenziale US. Edison 1/4

Research fornisce sondaggi di uscita e tabula il voto nazionale in ogni contea degli Stati Uniti per ABC News, CBS News, CNN e NBC News.
I clienti di Edison Research includono Activision,Amazon,AMC Theatres, Apple,Disney,Dolby Laboratories, Facebook,Google,Oracle,The US 2/4

r1es
@midnightride21

***THREAD***

I’ve been on the phone with colleagues about the hack all morning. None of us can figure out why #CISA chose this particular response to the breach. Couple of things struck us as curious.

The agencies targeted are not responding how you might expect...

JUST RELEASED: Emergency Directive 21-01 calls on all federal civilian agencies to review their networks for indicators of compromise and disconnect or power down SolarWinds Orion products immediately. Read more: https://t.co/VFZ81W2Ow7
— Cybersecurity and Infrastructure Security Agency (@CISAgov) December 14, 2020

Advertisement

Fidato
@tequieremos

Whatsapp will start forcing users to share personal data with Facebook which is it's parent company. It doesn't come as a surprise since all the major giants of Silicon valley; Google, Amazon, Facebook, Microsoft etc are deeply integrated with US intelligence agencies.

THREAD

In 2013, Edward Snowden, an employee of National Security Agency, revealed that the US govt was running a vast Internet surveillance program and tapping every major Silicon Valley platform and company— Facebook, Google, Apple, Amazon including mobile games like Angry Birds.

[1]

The most astonishing program revealed by Snowden’s disclosures is called PRISM, which involves a sophisticated on-demand data tap housed within the datacenters of the biggest and most respected names in Silicon Valley: Google, Apple, Facebook, Yahoo!, and Microsoft.

[2]

These devices allow the National Security Agency (NSA) to extract whatever the agency requires, including emails, attachments, chats, address books, files, photographs, audio files, search activity, and mobile phone location history.

[3]

Edward Snowden also revealed the Mass Metadata Surveillance System of America's National Security Agency (NSA) in his documents. Let's suppose if NSA had found someone dialing number of an al Qaeda member, and assume that this person had phoned 100 other people over the...

[4]

Amarnath Amarasingam
@AmarAmarasingam

1. (THREAD) So, it seems like the deplatforming debate is once again kicking off, so I thought I would introduce some of the earlier work that was done in this area back when ISIS was buck wild on social media. What have we learned over the last six years might be useful today:

2. One of the earliest studies that discussed the impact of suspensions of ISIS accounts was @intelwire and Morgan's piece: The ISIS Twitter Consensus.

They found that suspensions did have an impact on replies and retweets and overall dissemination.

3. After suspensions, the die-hard supporters dedicated themselves to creating new accounts, but others whittled away: “it appears the pace of account creation has lagged behind the pace of suspensions”

4. On the specific question of how suspensions impact the Twitter network, see this piece by @intelwire and @IntelGirl111, which explores how suspensions impact these groups, including major disruptions to dissemination and decline in follower count:

5. Another study by @Aud_Alexander similarly found that ISIS supporters were finding it hard to “gain traction” after Twitter took a harder stance on the group.

$\xf828$

ø28
@AndrewMurphie

Here's why Twitter/Facebook/other platforms are publishers. Neither electricity nor phone companies actively curate content, that, is, choose what content will go where and why (like a newspaper, that is, a publisher). Just cause algorithms are involved not really a difference.

Neither do electricity nor phone companies (usually) deliver advertising based on the curation of content and vice versa. Neither do they as companies foster discussion. Etc etc.

In fact, this goes back to a basic confusion. Not even the web is the same as the internet, and social media is certainly not the internet. Neither are apps or platforms. The utility, if there is one, is the internet, the rest is increasingly some equivalent to publishers.

this is before you get to 1 the over-fetishization of content/representations and 2 the out of date characterisation of both media in general and the divisions within it on all sides, based on a media "age" that's now perhaps passing

per McLuhan but also Whitehead, Langer maybe, a lot of media ecology, Lovelace, Deleuze, Hopper, Virilio, Harney, and many many more.

You May Also Like

UN Watch
@UNWatch

The UN just voted to condemn Israel 9 times, and the rest of the world 0.

View the resolutions and voting results here:

The resolution titled "The occupied Syrian Golan," which condemns Israel for "repressive measures" against Syrian citizens in the Golan Heights, was adopted by a vote of 151 - 2 - 14.

Israel and the U.S. voted 'No' https://t.co/HoO7oz0dwr

The resolution titled "Israeli practices affecting the human rights of the Palestinian people..." was adopted by a vote of 153 - 6 - 9.

Australia, Canada, Israel, Marshall Islands, Micronesia, and the U.S. voted 'No' https://t.co/1Ntpi7Vqab

The resolution titled "Israeli settlements in the Occupied Palestinian Territory, including East Jerusalem, and the occupied Syrian Golan" was adopted by a vote of 153 – 5 – 10.

Canada, Israel, Marshall Islands, Micronesia, and the U.S. voted 'No'
https://t.co/REumYgyRuF

The resolution titled "Applicability of the Geneva Convention... to the
Occupied Palestinian Territory..." was adopted by a vote of 154 - 5 - 8.

Canada, Israel, Marshall Islands, Micronesia, and the U.S. voted 'No'
https://t.co/xDAeS9K1kW

$Billy Bostickson \U0001f3f4\U0001f441&\U0001f441 \U0001f193$

Billy Bostickson 🏴👁&👁 ...
@BillyBostickson

1. Project 1742 (EcoHealth/DTRA)
Risks of bat-borne zoonotic diseases in Western Asia

Duration: 24/10/2018-23 /10/2019

Funding: $71,500
@dgaytandzhieva
https://t.co/680CdD8uug

2. Bat Virus Database
Access to the database is limited only to those scientists participating in our ‘Bats and Coronaviruses’ project
Our intention is to eventually open up this database to the larger scientific community
https://t.co/mPn7b9HM48

3. EcoHealth Alliance & DTRA Asking for Trouble
One Health research project focused on characterizing bat diversity, bat coronavirus diversity and the risk of bat-borne zoonotic disease emergence in the region.
https://t.co/u6aUeWBGEN

4. Phelps, Olival, Epstein, Karesh - EcoHealth/DTRA

5, Methods and Expected Outcomes
(Unexpected Outcome = New Coronavirus Pandemic)

Advertisement

Sahil
@sahilypatel

A list of cool websites you might now know about

A thread 🧵

1) Learn Anything - Search tools for knowledge discovery that helps you understand any topic through the most efficient

2) Grad Speeches - Discover the best commencement speeches.

This website is made by me

3) What does the Internet Think - Find out what the internet thinks about anything

4) https://t.co/vuhT6jVItx - Send notes that will self-destruct after being read.

Kentaur Wolf2
@fragma_dia2

Хајде да направимо мали осврт на случај Мика Алексић .

Алексић је жртва енглеске освете преко Оливере Иванчић .
Мика је одбио да снима филм о блаћењу Срба и мењању историје Срба , иза целокупног пројекта стоји дипломатски кор Британаца у Београду и Оливера Иванчић

Оливера Илинчић је иначе мајка једне од његових ученица .
Која је претила да ће се осветити .

Мика се налази у притвору због наводних оптужби глумице Милене Радуловић да ју је наводно силовао човек од 70 година , са три бајпаса и извађеном простатом пре пет година

Иста персона је и обезбедила финансије за филм преко Беча а филм је требао да се бави животом Десанке Максимовић .
А сетите се и ко је иницирао да се Десанка Максимовић избаци из уџбеника и школства у Србији .

И тако уместо романсиране верзије Десанке Максимовић утицај Британаца

У Србији стави на пиједестал и да се Британци у Србији позитивно афирмишу како би се на тај начин усмерила будућност али и мењао ток историје .
Зато Мика са гнушањем и поносно одбија да снима такав филм тада и почиње хајка и претње која потиче из британских дипломатских кругова

Најгоре од свега што је то Мика Алексић изговорио у присуству високих дипломатских представника , а одговор је био да се све неће на томе завршити и да ће га то скупо коштати .
Нашта им је Мика рекао да је он свој живот проживео и да могу да му раде шта хоће и силно их извређао

$\u0100yudhika$

Āyudhika
@Satyamev1310

Dr. Anandibai Joshi

Upon her birth on 31 March 1865 she was named Yamuna, after the holy river. Her parents Gunputrao Amritaswar Joshee & Gungabai Joshee came from a long lineage of wealthy landlord family in Kalyan of Bombay Presidency, whose wealth was now waning.

Anandi was the sixth of 10 children, & had 4 brothers (only two of which survived) & five sisters. Her father was particularly fond of her, as she was a bright child with an inquisitive mind. Being an educated man himself, Ganpatrao assured that his daughter was taught Marathi.

As was common practice she was married at a tender age of 9, to Gopalrao Joshi, a 29 year old widower who worked as a postal clerk in the same city. After marriage her husband named her ‘Anandibai’ (which means ‘Joy of my heart’).

Gopalrao was man ahead of his times with reformist ideas & had married Anandibai on the condition that he would be allowed to educate his wife.

He even tried to enroll Anandi in a missionary school, but did not succeed. Despite being the supportive husband, Gopalrao had his flaws.

He was a strict teacher & would sometimes resort to beating if Anandi slacked in her studies.