Prepping for today's thread, the story of the CURRENT CYBERWAR is clearly overwhelming. J.E. Dyer @OptimisticCon links us to this story. Just one quote to

3 December 2020 #MAGAanalysis #RedoTheElection

When You Catch A Thief

The sleeping giant of America sleeps no more. We have awakened. We're nothing more than the same Common Sense Americans we were in 1776. We're feisty. Independent and self-sufficient. Hard working.

14 January 2020 #MAGAanalysis #Overturn

A Man Isolated, Does He Have The Power?

It's Thursday morning and we're not in a globalized war with China, far as I can tell. I was happy to give Simon, Charlie, and Danielle their time from Tuesday to Wednesday. Where to now?

5 January #MAGAanalysis #Overturn

What Will Pence Do Tomorrow?

Both @annvandersteel and @KateScopelliti put forward this story, last night. It is an important story we must consider

A thread on teaching live lessons using @MicrosoftTeams Meet Now function where students follow their normal timetable except online - will go into more detail on every point in a blog post later. Have used Teams for live teaching have supported over 100 live lessons since March

1. If you are using the desktop app, check you have the latest version of Teams so that you should have Breakout rooms enabled. Check by clicking your profile picture, then About - I have version 1.3.00.28779. If you have 1.2..., click on check for updates to get the latest

2. Set your entry routine. I get my students to enter with their microphone muted - you can also not allow attendees to unmute by opening the participants list, clicking the ellipsis and selecting that option.

3. Make sure students arrive as attendees - some organisations have this set up to automatically happen that only meeting organizer is the presenter and others are attendees. Can change this in the manage permissions menu to only me if not already set (opens in a web browser).

4. Classroom routine and expectations - first lesson I share my screen and show the students the raise hand function for when they want to ask questions, how to access the chat function and how to react to questions as opposed to typing answers

Only 1 / 67 antivirus engines list SUNBURST backdoor as malicious - SolarWinds.Orion.Core.BusinessLayer.dll https://t.co/taaiUtSJzR #SUNBURST #UNC2452

SolarWinds' digital certificate hasn't been revoked yet.

The full compromised package is still being hosted online as well 😓 hxxps://downloads.solarwinds[.]com/solarwinds/CatalogResources/Core/2019.4/2019.4.5220.20574/SolarWinds-Core-v2019.4.5220-Hotfix5.msp

Job class within the backdoored #Sunburst DLL is pretty straight forward and aligns with @FireEye's analysis. CollectSystemDescription:

DeleteFile

Yoga employs more Americans than coal. But compare and contrast 1/2

and 2/2

I think many of us carry in our minds an image of the US economy that looks like this

when the reality is this

and this

Linux code injection paint-by-numbers.

Can we launch a process that looks one way to (superficial) auditors but is, in fact, entirely different? (Think process hollowing and the like on Windows).

Firstly, how are processes created and what does related auditing look like?

The most common pattern is fork() → execve(). Where the fork() syscall create a duplicate of the running process context and execve() overlays a copy of the target program onto that context.

After calling fork(), we’ll have two processes, the original one and a new - duplicated - one (with a new pid).

Control will return from fork() to both process instances. In the child process, the return value will simply by 0, in the parent it will hold the pid of the child.

Thus we can determine whether we are running in the child context and call execv() accordingly, while allowing the parent to continue.

Now, let’s take a look at where the auditing hooks lie. From calling execve(), we’ll eventually land up in exec_binrpm().