Ryan NaraineCuntas deimhnithe

@ryanaraine

Podcast + newsletter at . Columns at . Previously , , . Co-founder and .

tinyletter.com/naraine
Clárú: Lúnasa 2007
1,135 Pictiúr nó físeán Pictiúir agus físeáin

Tvuíteanna

Chuir tú cosc ar @ryanaraine

An bhfuil tú cinnte gur mhaith leat breathnú ar na Tweetanna seo? Ní bhainfear an cosc de @ryanaraine trí bhreathnú ar Tweetanna.

  1. Rinne Atweetáil
    23 uair an chloig ó shin

    The exploit developer that Kaspersky tracks as "Moses" is Exodus Intelligence... From Kaspersky: "we believe at least six vulnerabilities observed in the wild in the last two years have originated from Moses"¹ ¹

    5 fhreagra 77 d’atweetálacha 243 croí
    Cealaigh
  2. 23 uair an chloig ó shin

    Now we know

    Who is this 'Moses' 0day supplier?
    1 fhreagra amháin 5 atweetáil 4 chroí
    Cealaigh
  3. Rinne Atweetáil
    23 uair an chloig ó shin

    For those following Moses the past year or so...

    SCOOP - An American company’s Windows zero-day hacks were used by India on China and Pakistan. The company is Exodus Intelligence. And it’s now looking into whether exploits using its 0days have leaked.
    2 fhreagra 3 atweetáil 11 croí
    Cealaigh
  4. 17 MFómh

    The Moses exploit supplier is finally outed 👇

    SCOOP - An American company’s Windows zero-day hacks were used by India on China and Pakistan. The company is Exodus Intelligence. And it’s now looking into whether exploits using its 0days have leaked.
    2 fhreagra 2 atweetáil 5 chroí
    Cealaigh
  5. Rinne Atweetáil
    17 MFómh

    Another simple way to check iOS devices for signs of CVE-2021-30860 / FORCEDENTRY exploitation. Run MVT, then simply: cat timeline.csv | grep "Library/SMS/Attachments" | grep -i "\.gif" (thanks for the tip!)

    3 fhreagra 96 d’atweetálacha 236 croí
    Taispeáin an snáithe seo
    Taispeáin an snáithe seo
    Cealaigh
  6. 16 MFómh

    Throwback to Sep 2010: Symantec's inflates a balloon until it popped to show off Stuxnet exploit capabilities

    2 fhreagra 3 atweetáil 16 croí
    Cealaigh
  7. Rinne Atweetáil
    15 MFómh

    Great to be a part of this with , Lena Smart, , and ! Such a fun conversation

    Allstar lineup for today’s CISO Forum closing panel - "Pandemic In-CISOmnia - What Keeps CISOs up at Night?”
    2 atweetáil 5 chroí
    Cealaigh
  8. 15 MFómh

    💣

    NEW: The American company that sold a zero-click iMessage hacking tool to a UAE spying operation was Accuvant, a prolific Denver-based firm that specialized in iOS exploits.
    Taispeáin an snáithe seo
    1 atweetáil amháin 8 gcroí
    Cealaigh
  9. 15 MFómh

    Incredible work 🏆

    Since a number of people have been asking: yes, what Apple patched in 14.8 is the same 0-click vulnerability that we at Amnesty described as "Megalodon" in section 6 of our July report (), and which Citizen Lab later called "FORCEDENTRY".
    1 fhreagra amháin 1 atweetáil amháin 3 chroí
    Cealaigh
  10. Rinne Atweetáil
    15 MFómh
    Ag tabhairt freagra ar

    Just read the article. Ryan's data isn't wrong, it's simply a different scope then what we track. For example, for Apple the difference is PZ doesn't include 0-days against EOL devices. We also track 0-days for different devices.

    1 fhreagra amháin 1 atweetáil amháin 12 croí
    Cealaigh
  11. 15 MFómh

    Source

    2 atweetáil 4 chroí
    Taispeáin an snáithe seo
    Taispeáin an snáithe seo
    Cealaigh
  12. 15 MFómh

    What's going on at Microsoft?

    3 fhreagra 5 atweetáil 61 croí
    Taispeáin an snáithe seo
    Taispeáin an snáithe seo
    Cealaigh
  13. 15 MFómh

    This is the correct take 👇

    I read these articles when originally published them & find myself extremely irritated that Reuters now acts like they’re the first to report & don’t mention her earlier work despite some of it being FOR REUTERS. Women’s contributions are erased too damn often. 🤬
    5 chroí
    Cealaigh
  14. 15 MFómh

    Shoutout to for pwning this story way back in 2016 and 2017, long before the Reuters exclusive investigation

    Just gonna drop this from 2016 right here:
    Taispeáin an snáithe seo
    2 atweetáil 12 croí
    Cealaigh
  15. 15 MFómh

    VPNs

    Ag freagairt @boblord
    They're a flimsy justification for reselling bandwidth, they don't make sense even if every employee is a saint.
    1 fhreagra amháin
    Cealaigh
  16. 15 MFómh

    This is all kinds of bonkers 😱 (via ⁦⁩)

    3 atweetáil 3 chroí
    Cealaigh
  17. Rinne Atweetáil
    14 MFómh

    Everyone’s got a conscience when the Feds come knocking…

    1 fhreagra amháin 4 atweetáil 17 croí
    Cealaigh
  18. Rinne Atweetáil
    14 MFómh

    As the story gets renewed attention today, highly recommend reading the last piece in our 2019 series. How Project Raven was initial built by White House insiders

    2 fhreagra 29 d’atweetálacha 55 croí
    Cealaigh
  19. 14 MFómh

    A supply chain security story 👇🏽

    Between the 3 Sept and 10 Sept, secure env vars of *all* public repositories were injected into PR builds. Signing keys, access creds, API tokens. Anyone could exfiltrate these and gain lateral movement into 1000s of orgs. 1/4
    Taispeáin an snáithe seo
    1 atweetáil amháin 6 chroí
    Cealaigh
  20. 14 MFómh

    Or, alternatively, these brave souls knew the Fed investigation was underway and tried to get ahead of the optics? 🥱

    The Project Raven reporting project was only made possible because of a dozen brave sources who knew the risk and yet decided to do the right thing and blow the whistle.
    Taispeáin an snáithe seo
    1 fhreagra amháin 3 chroí
    Cealaigh

Ní dhearna @ryanaraine Tweetáil fós.

Tá moill ar an lódáil, is cosúil.

Tá Twitter ag cur thar maoil le gníomhaíocht nó tá fadhb eile ann. Bain triail eile as nó tabhair cuairt ar Stádas Twitter chun tuilleadh eolais a fháil.

    Seans, leis, go dtaitneodh seo leat

    ·