createdapril24

Oracle collects:

1. Who is staying in which hotels and in which rooms

2. Who is eating at which restaurants and going to which entertainment facilities

3. Who is getting what health services

4. Who is travelling where across travel industry

5. Who is working for which companies in what roles and how much are they paid

This is incredibly powerful intelligence the CIA could not NOT want. Replace "who" in any of the above with a politician in a country of interest, or other person of interest/intelligence target.

<strike> It's sort of like Facebook getting CIA funding. CIA definitely has interest to know intimate details of everyone's lives, who is sharing what information with who, and how social fabric in different countries are organized. They/we would be crazy not to. Taking the converse: The CIA wasn't funding Facebook because they really needed to socialize more with friends and family. </strike> Please see thread below. CIA investment in Facebook has not been established.

1. Ukraine had an antiquated military at the start of the war - old Soviet technology with old Soviet ammunition.

2. Ukraine has used almost all of its ammunition compatible with these weapons, and lost a huge amount of manpower (30000+) including their best troops, and lost 50%+ of its fielded equipment.

3. Prior to the losses and exhaustion detailed in #2, European and NATO backers collected and distributed ammunition and equipment compatible with Ukraine's existing weapon stock.

4. Since exhausting existing equipment and possible sources of Soviet ammunition, Ukraine's backers have switched to supplying Western made weapons. This isn't because they are "better" but because they can be maintained and ammunition will be available for protracted war this is projected to be.

5. Ukraine right now is in a very challenging situation. It has limited equipment of either kind. Their soldiers do not know how to use and maintain the new equipment and don't have much time (due to manpower shortage) to get trained up on completely new equipment and standards.

6. Either way, switching to new weapons platforms is necessary since Russia isn't about to supply Ukraine with more compatible ammunition.

7. Because of the necessity, Ukraine's leadership is "hyping" Western weapons to its people. It's got to tell a story about how victory is around the corner so that morale isn't lost during this transitional period.

8. Western media is picking up on this "hype".

HIMARS aren't going to win the war. This isn't a war of tech superiority. This is a war of grinding attrition. Russia has Ukraine outmanned and outgunned. Western equipment is the only path forward so that Ukraine's force posture doesn't completely atrophy.

The course of the war will be dictated by how either side's logistical, supply, ability to direct and surge force, and the strains on these outlast the other.

Anyone who begins to question some of the facts they have been indoctrinated to memorize: (1) will not have a methodology for coming to a conclusion, past "hypothesis" and anecdote (2) will not have peers and close contacts who are able to refute the hypothesis, outside just insisting on the fact themselves, which itself isn't credible or scientific.

One claim that the author makes is that this is a flaw in Western education systems. It would seem to me that Western education varies significantly. And I am not familiar enough with other types of education to know what alternatives are working better in different cultural contexts.

The article specifies that "Using this technique, researchers claims they could record 100,000 measurement traces from IoT devices infected by genuine malware samples, and predicted three generic and one benign malware class with an accuracy as high as 99.82%"

I'm very skeptical of the material practicality of such a system. I am not sure whether they are correctly measuring the accuracy here (or if they are ignored precision and focused entirely on recall). It is hard to tell on the article content alone. But furthermore you would need to run this routinely to catch malware, which means at its very best it's wrong 1 out of every 500 attempts. How long does 100000 traces take? Is it wrong every 500 milliseconds? 500 seconds? To be useful it would have to be wrong every ~500 days, or at least hours.

Based on the title of the paper, I think the technique is specifically looking for certain kinds of machine code obfuscation, and classifying which was used. If this is the case, the application would NOT be to scan for malware but to use such a system after malware is confirmed as an aide to a forensic analyst attempting to understand the malware better. But if that's the case, the article's central claims around the technique "could help companies thwart these threats without needing any software" would appear to be at best wrong if not outright misleading.

Anyone have a link to the paper without a paywall?

I have not evaluated 2-7.

Using this figure, we could have some parameters around how much time such a project must have taken and its latest start date (assuming its evolved from known or closely-related-to-known viruses).

Using this figure, and a theoretical timetable, we can also specify how close a cousin virus we would need to have for such a process to develop SAR-CoV-2.

This could give us a more specific understanding of the feasibility of such research.

For example, RaTG13 is closest known virus was discovered in 2013. Does the rate of serial passage enable evolution from RaTG13 over ~7 years? If not, this provides a factual argument allowing us to determine even if gain-of-function research was imposed on RaTG13 the moment of its discovery, it could not have been developed into SARS-CoV-2. (I don't know how to evaluate the actual accuracy of this, but provided as a example of how knowing the serial passage rate would be helpful).

"The grant proposal very specifically is concerned with using the WIV1 and SHC014 backbones, nothing related to SARS-CoV-2." The counterargument is "Well, they could have altered the proposal when they pursued funding elsewhere." The takeaway is that it is not likely this specific proposal was funded elsewhere, leading to SARS-CoV-2.

"If they actually carried out the research in this grant proposal you don't get from there to SARS-CoV-2, those are all SARS-1-like." I do not personally know how to evaluate the accuracy of this claim, but if true, it resonates with the first claim: this proposal funded elsewhere would not lead to SARS-CoV-2.

The argument claims about it being hard/expensive I think are less compelling, as there is a lead time of several years with experts in field performing research. A more compelling version of this argument would look like (completely making up numbers): "On average, it takes 4.5 years to develop the first samples of a novel virus using a selected backbone, CRISPR technology, and gain-of-function culturing. Therefore, even if this research was funded in 2018 we would not expect it to have led to SARS-CoV-2". I'm not saying that argument is accurate at all, just saying it's more specific than "it's difficult".

The argument claims about the evidence being missing I think isn't going to be motivating for a person who has a reasonable expectation that secret research is done and does not have trust in government transparency (either US, China, or otherwise). I'm not making a point here that evidence isn't needed (far from it, evidence IS needed). I'm evaluating from a polemic perspective what kinds of claims and arguments are useful for advancing the conversation with someone who holding a dissonant viewpoint.

Thank you by the way for making specific claims that can be fact checked such as the two referenced at the top of this comment.

This is an example of why and how TLS does not authenticate the actual owner of the website - unless you are implementing certificate pinning or another technique - to prevent interception.

This kind of vulnerability seems to be a very difficult one to plug. Ultimately, Wikipedia should be seen as a source of information, but not to be trusted blindly. That's a good stance to take purely out of factual inaccuracy and data incompleteness - but also necessary from the perspective that Wikipedia has, is and will be used to influence because it holds an authoritative position.

2. I agree. Individual employees are not at all to blame. Companies who are blaming their employees for getting phished are doing it wrong. The correct action to take is to inform employees and build the other kinds of mitigations mentioned elsewhere in this topic tree.

I'm usually not testing only whether employees are easy to phish (the answer is pretty much 100% yes). I'm testing end-to-end: can you as a company prevent me from phishing through email protections? Can you detect when I'm phishing your employees? Will your employees report potential phishing emails? Can you figure out (without me telling you) which employees were targeted and which attacks were successful? Can you figure out which credentials/machines would need to be quarantined/rotated/examined?

Also to distinguish between #3 and, XSS in #2 was intended to mean "persistent stored XSS" as opposed to "reflected XSS". In the case of reflected XSS, this can be chained with CSP bypasses and insecure cookies to grab out e.g. bearer tokens.

My overall point is that heap fung shui 0day not required for 1-click ownage. In practice, I've not had to burn browser 0day to compromise organizations or their customers.

1. (Windows specific) Opens up a Windows file share, which causes the person to authenticate to the file share, which through PtH/Responder results in their enterprise credentials being stolen.

2. Exploited a XSS or CSRF attack on an internal/management endpoint. Which in turns allows a pivot from external to internal access.

3. Steals a web session, cached password or authentication token, resulting in compromise of employee credentials to be used elsewhere (e.g. reused to access enterprise VPN).

These are just some not-a-browser-0day examples of a single click being game-over dangerous.

I am a Red Teamer and work with companies to understand how their detective/preventative/recovery controls and processes are working. Here's how you resolve this:

You work with maintainers to get their coordination on the research. You work out a mechanism to prevent submitted patches from being merged (e.g. maintainers are notified before bad patches accepted by code review processes are merged).

You do not tell them when the patches are coming. You do not tell them which identities are going to be used for the patches (e.g. from which email addresses). You do not tell them which area of code will be targeted. You set rules and time bounds for the study.

You wait some amount of time before submitting such patches (weeks to months). Realistically this is all that's needed. If hypersensitive, set this up earlier and let it bake longer.

At this point, you submit patches from a variety of addresses (probably not associated with your university - it is easy to create many such identities). You also can coordinate with other researchers, universities, and companies to submit patches under identities as needed. You also study submitting from yandex, gmail, .cn and other email addresses (because isn't that interesting to know?).

The premise that there's some ultimatum between working with the community and performing the research is on its face incorrect. This is either ignorance or laziness on behalf of the researchers. Clearly, they hadn't taken the time to work with the community to work out an approach that could be mutually acceptable.