Technical

Asyn · 2019-05-05T08:34:35.000Z

Double blow to dark web marketplaces
https://www.europol.europa.eu/newsroom/news/double-blow-to-dark-web-marketplaces
https://www.justice.gov/opa/pr/three-germans-who-allegedly-operated-dark-web-marketplace-over-1-million-users-face-us

Asyn · 2019-05-07T09:25:49.000Z

Buckeye: Espionage Outfit Used Equation Group Tools Prior to Shadow Brokers Leak
https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit

Asyn · 2019-05-09T06:16:08.000Z

Dharma Ransomware Uses AV Tool to Distract from Malicious Activities
https://blog.trendmicro.com/trendlabs-security-intelligence/dharma-ransomware-uses-av-tool-to-distract-from-malicious-activities/

Asyn · 2019-05-10T05:30:38.000Z

North Korean Tunneling Tool: ELECTRICFISH
https://www.us-cert.gov/ncas/analysis-reports/AR19-129A

Asyn · 2019-05-11T06:30:39.000Z

Hackers breached 3 US antivirus companies, researchers reveal
https://arstechnica.com/information-technology/2019/05/hackers-breached-3-us-antivirus-companies-researchers-reveal/

bob3160 · 2019-05-11T12:33:57.000Z

Asyn post:2545:

Hackers breached 3 US antivirus companies, researchers reveal
https://arstechnica.com/information-technology/2019/05/hackers-breached-3-us-antivirus-companies-researchers-reveal/

I hate vague reports. (Gossip.)

Asyn · 2019-05-11T19:03:01.000Z

bob3160 post:2546:

Asyn post:2545:

Hackers breached 3 US antivirus companies, researchers reveal
https://arstechnica.com/information-technology/2019/05/hackers-breached-3-us-antivirus-companies-researchers-reveal/

I hate vague reports. (Gossip.)

More details here: https://www.advanced-intel.com/blog/top-tier-russian-hacking-collective-claims-breaches-of-three-major-anti-virus-companies

bob3160 · 2019-05-11T19:45:31.000Z

Asyn post:2547:

bob3160 post:2546:

Asyn post:2545:

Hackers breached 3 US antivirus companies, researchers reveal
https://arstechnica.com/information-technology/2019/05/hackers-breached-3-us-antivirus-companies-researchers-reveal/

I hate vague reports. (Gossip.)

More details here: https://www.advanced-intel.com/blog/top-tier-russian-hacking-collective-claims-breaches-of-three-major-anti-virus-companies

Same information just posted on a different platform. Still no particulars. 3 Major American AV companies doesn’t really give any specifics.

Asyn · 2019-05-11T20:13:08.000Z

bob3160 post:2548:

Still no particulars. 3 Major American AV companies doesn’t really give any specifics.

Only a handful major AV companies in the US, so take your best guess.
Anyway, as we’re running Avast (non US), there’s nothing to worry about.

Asyn · 2019-05-12T13:11:13.000Z

Technical Analysis: Pacha Group Competing against Rocke Group for Cryptocurrency Mining Foothold on the Cloud
https://www.intezer.com/blog-technical-analysis-cryptocurrency-mining-war-on-the-cloud/

Asyn · 2019-05-13T05:44:12.000Z

Blocking Hyperlink Auditing Tracking Pings with Extensions
https://www.bleepingcomputer.com/news/security/blocking-hyperlink-auditing-tracking-pings-with-extensions/

Asyn · 2019-05-14T05:29:37.000Z

Israeli Firm Tied to Tool That Uses WhatsApp Flaw to Spy on Activists
https://www.nytimes.com/2019/05/13/technology/nso-group-whatsapp-spying.html

Asyn · 2019-05-14T09:12:13.000Z

bob3160 post:2548:

Asyn post:2547:

bob3160 post:2546:

Asyn post:2545:

Hackers breached 3 US antivirus companies, researchers reveal
https://arstechnica.com/information-technology/2019/05/hackers-breached-3-us-antivirus-companies-researchers-reveal/

I hate vague reports. (Gossip.)

More details here: https://www.advanced-intel.com/blog/top-tier-russian-hacking-collective-claims-breaches-of-three-major-anti-virus-companies

Same information just posted on a different platform. Still no particulars. 3 Major American AV companies doesn’t really give any specifics.

Fxmsp Chat Logs Reveal the Hacked Antivirus Vendors, AVs Respond
https://www.bleepingcomputer.com/news/security/fxmsp-chat-logs-reveal-the-hacked-antivirus-vendors-avs-respond/

bob3160 · 2019-05-14T13:06:02.000Z

Asyn post:2553:

bob3160 post:2548:

Asyn post:2547:

bob3160 post:2546:

Asyn post:2545:

Hackers breached 3 US antivirus companies, researchers reveal
https://arstechnica.com/information-technology/2019/05/hackers-breached-3-us-antivirus-companies-researchers-reveal/

I hate vague reports. (Gossip.)

More details here: https://www.advanced-intel.com/blog/top-tier-russian-hacking-collective-claims-breaches-of-three-major-anti-virus-companies

Same information just posted on a different platform. Still no particulars. 3 Major American AV companies doesn’t really give any specifics.

Fxmsp Chat Logs Reveal the Hacked Antivirus Vendors, AVs Respond
https://www.bleepingcomputer.com/news/security/fxmsp-chat-logs-reveal-the-hacked-antivirus-vendors-avs-respond/

Thanks for the link. The opriginal post stated that it effected 3 US security Companies.
Now the statement is 3 companies with offices in the US. Big difference since many Security companies have offices in the US.

Asyn · 2019-05-15T05:53:36.000Z

ZombieLoad: Cross Privilege-Boundary Data Leakage
https://www.cyberus-technology.de/posts/2019-05-14-zombieload.html
https://zombieloadattack.com/
https://cpu.fail/

Pondus · 2019-05-15T11:17:49.000Z

RIDL and Fallout: MDS attacks
Attacks on the newly-disclosed “MDS” hardware vulnerabilities in Intel CPUs

https://mdsattacks.com/

https://www.intel.com/content/www/us/en/architecture-and-technology/mds.html

https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

https://zombieloadattack.com/#attack

bob3160 · 2019-05-15T12:06:53.000Z

Pondus post:2556:

RIDL and Fallout: MDS attacks
Attacks on the newly-disclosed “MDS” hardware vulnerabilities in Intel CPUs

https://mdsattacks.com/

https://www.intel.com/content/www/us/en/architecture-and-technology/mds.html

https://www.intel.com/content/dam/www/public/us/en/documents/corporate-information/SA00233-microcode-update-guidance_05132019.pdf

https://zombieloadattack.com/#attack

So according to the tool offered here, https://mdsattacks.com/ my system is vulnerable.

https://screencast-o-matic.com/screenshots/u/Lh/1557921874568-73818.png

So the next logical question is how dangerous is this for the average user and,
probably more important, when will there be an actual fix outside of purchasing AMD ???

Asyn · 2019-05-15T12:36:03.000Z

bob3160 post:2557:

So the next logical question is how dangerous is this for the average user and,
probably more important, when will there be an actual fix outside of purchasing AMD ???

According to Intel, medium to low, see: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html

bob3160 · 2019-05-15T12:45:20.000Z

Asyn post:2558:

bob3160 post:2557:

So the next logical question is how dangerous is this for the average user and,
probably more important, when will there be an actual fix outside of purchasing AMD ???

According to Intel, medium to low, see: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html

Since it’s their chip, income and reputation, I’ll be just a bit sceptical with anything they have to say till verifies by a third independent source.

Asyn · 2019-05-15T13:29:19.000Z

bob3160 post:2559:

Asyn post:2558:

bob3160 post:2557:

So the next logical question is how dangerous is this for the average user and,
probably more important, when will there be an actual fix outside of purchasing AMD ???

According to Intel, medium to low, see: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html

Since it’s their chip, income and reputation, I’ll be just a bit sceptical with anything they have to say till verifies by a third independent source.

Hi Bob, agreed. Here’s an overview of the currently available updates/fixes. Hope it helps. (German site)
https://www.heise.de/ct/artikel/Updates-gegen-die-Intel-Prozessorluecken-ZombieLoad-Co-4422413.html

Announcements