Sorry for the long absence (pfft, who am I kidding? no one reads this). I intended to be back the week after DefCOn but life happened. I was sick and work piled up, but here I am now. Lucky you, imaginary readers and voices in my head.

Anyway...

On the 10th anniversary of the Snowden revelations

https://www.electrospaces.net/2023/06/on-10th-anniversary-of-snowden.html

Microsoft, Google Take on Obsolete TLS Protocols

https://www.darkreading.com/dr-tech/microsoft-google-take-on-obsolete-tls-protocols

Cybersecurity Builds Trust in Critical Infrastructure

https://www.darkreading.com/edge-articles/cybersecurity-builds-trust-in-critical-infrastructure

Cisco security appliance 0-day is under attack by ransomware crooks

https://arstechnica.com/security/2023/09/ransomware-crooks-exploit-unpatched-0-day-in-cisco-security-appliances/

Mystery solved? Microsoft thinks it knows how Chinese hackers stole its signing key

https://cyberscoop.com/microsoft-china-signing-key/

How China gets free intel on tech companies’ vulnerabilities

https://arstechnica.com/security/2023/09/how-china-gets-free-intel-on-tech-companies-vulnerabilities/

Move Over, Software Developers – In The Name Of Cybersecurity, The Government Wants To Drive (the comments are entertaining)

https://www.techdirt.com/2023/09/06/move-over-software-developers-in-the-name-of-cybersecurity-the-government-wants-to-drive/

OWASP Top 10 API Security Risks – 2023

https://owasp.org/API-Security/editions/2023/en/0x11-t10/

‘Five Eyes’ nations release technical details of Sandworm malware ‘Infamous Chisel’

https://cyberscoop.com/sandworm-ukraine-infamous-chisel/

China turns to AI in hopes of creating viral online propaganda, Microsoft researchers say

https://cyberscoop.com/chinese-ai-ops-microsoft/

The International Criminal Court will now prosecute cyberwar crimes

https://arstechnica.com/information-technology/2023/09/the-international-criminal-court-will-now-prosecute-cyberwar-crimes/

Ukraine war: Cyber-teams fight a high-tech war on front lines

https://www.bbc.com/news/world-europe-66686584?at_medium=RSS&at_campaign=KARANGA

Elon Musk says he withheld Starlink over Crimea to avoid escalation

https://www.bbc.com/news/world-europe-66752264?at_medium=RSS&at_campaign=KARANGA

X sues Calif. to avoid revealing how it makes “controversial” content decisions

https://arstechnica.com/tech-policy/2023/09/x-sues-calif-to-avoid-revealing-how-it-makes-controversial-content-decisions/

Appeals Court Rules White House Overstepped 1st Amendment on Social Media

https://www.nytimes.com/2023/09/08/business/appeals-court-first-amendment-social-media.html

The Judgement - https://www.ca5.uscourts.gov/opinions/pub/23/23-30445-CV0.pdf

AI-generated child sex imagery has every US attorney general calling for action

https://arstechnica.com/information-technology/2023/09/ai-generated-child-sex-imagery-has-every-us-attorney-general-calling-for-action/

Weight-loss drugs Ozempic and Wegovy also protect your heart

https://arstechnica.com/health/2023/09/weight-loss-drugs-ozempic-and-wegovy-also-protect-your-heart/

“We’re not ‘gatekeepers,’” Apple and Microsoft tell European Union

https://arstechnica.com/tech-policy/2023/09/were-not-gatekeepers-apple-and-microsoft-tell-european-union/

The demand for hybrid work is only growing, according to a new Deloitte report

https://www.zdnet.com/home-and-office/work-life/the-demand-for-hybrid-work-is-only-growing-according-to-a-new-deloitte-report/#ftag=RSSbaffb68

90% Reduction: Scientists Discover Natural Molecule That Eradicates Plaques and Cavities

https://scitechdaily.com/90-reduction-scientists-discover-natural-molecule-that-eradicates-plaques-and-cavities/

A Senior Engineer's CheckList

https://littleblah.com/post/2019-09-01-senior-engineer-checklist/

Is Google's looming monopoly trial a watershed moment for Big Tech?

https://theweek.com/google/1026299/google-doj-monopoly-antitrust-trial

How to pass the interview for software engineering roles in Big Tech - Handbook

https://www.lambrospetrou.com/articles/big-tech-software-interviews/

When “Punch a Nazi” Goes Wrong

https://tracingwoodgrains.substack.com/p/when-punch-a-nazi-goes-wrong

Tech workers now doubting decision to move from California to Texas

https://www.chron.com/culture/article/california-texas-tech-workers-18346616.php

An effort to ban caste discrimination in California has touched a nerve

https://www.politico.com/news/2023/09/04/ban-caste-discrimination-california-bill-00113817

kurulounge.blogspot.com

Chad @chad@infosec.exchange

· 34mo ago

What I am read 10/18/2023 - Log4J is the gift that keeps on giving

Sorry for the pause, I lost access to the blog for awhile (it was reported as spam and suspended - just got it back this morning)
http://kurulounge.blogspot.com/2023/12/what-i-am-read-10182023-log4j-is-gift.html
#infosec #cybersecurity #reading

China’s cyber army is invading critical U.S. services

https://www.washingtonpost.com/technology/2023/12/11/china-hacking-hawaii-pacific-taiwan-conflict/

National Grid latest UK org to zap Chinese kit from critical infrastructure

https://www.theregister.com/2023/12/18/national_grid_bans_china_equipment/

SSH keys stolen by stream of malicious PyPI and npm packages

https://www.bleepingcomputer.com/news/security/ssh-keys-stolen-by-stream-of-malicious-pypi-and-npm-packages/

Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack

https://arstechnica.com/security/2023/12/just-about-every-windows-and-linux-device-vulnerable-to-new-logofail-firmware-attack/

Stealthy Linux rootkit found in the wild after going undetected for 2 years

https://arstechnica.com/security/2023/12/stealthy-linux-rootkit-found-in-the-wild-after-going-undetected-for-2-years/

Patch Now: Exploit Activity Mounts for Dangerous Apache Struts 2 Bug

https://www.darkreading.com/cloud-security/patch-exploit-activity-dangerous-apache-struts-bug

A new, modern, and secure print experience from Windows

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/a-new-modern-and-secure-print-experience-from-windows/ba-p/4002645

CISA urges vendors to get rid of default passwords

https://cyberscoop.com/cisa-urges-vendors-to-get-rid-of-default-passwords/

MITRE Debuts ICS Threat Modeling for Embedded Systems

https://www.darkreading.com/ics-ot-security/mitre-debuts-ics-cyber-threat-modeling-embedded-systems

North Korean hacking ops continue to exploit Log4Shell

https://cyberscoop.com/north-korea-lazarus-log4j-log4shell/

Two years on, 1 in 4 apps still vulnerable to Log4Shell

https://www.theregister.com/2023/12/11/log4j_vulnerabilities/

Apple admits to secretly giving governments push notification data

https://arstechnica.com/tech-policy/2023/12/apple-admits-to-secretly-giving-governments-push-notification-data/

Adapting to the Post-SolarWinds Era: Supply Chain Security in 2024

https://www.darkreading.com/vulnerabilities-threats/adapting-post-solarwinds-era-supply-chain-security-2024

The quest to turn basalt dust into a viable climate solution

https://arstechnica.com/science/2023/12/the-quest-to-turn-basalt-dust-into-a-viable-climate-solution/

“Renew Home” company brings power grid data to your smart home

https://arstechnica.com/gadgets/2023/12/alphabets-renew-home-company-brings-power-grid-data-to-your-smart-home/

Broadcom ends VMware perpetual license sales, testing customers and partners

https://arstechnica.com/information-technology/2023/12/broadcom-ends-vmware-perpetual-license-sales-testing-customers-and-partners/

As the SEC’s new data breach disclosure rules take effect, here’s what you need to know

https://techcrunch.com/2023/12/18/new-sec-data-breach-disclosure-rules/

Widespread FBI abuse of foreign spy law sets off “alarm bells,” tech group says

https://arstechnica.com/tech-policy/2023/05/fbi-misused-foreign-surveillance-law-280k-times-to-snoop-on-people-in-the-us/

Texas power plants have no responsibility to provide electricity in emergencies, judges rule

https://www.kut.org/energy-environment/2023-12-15/texas-power-plants-have-no-responsibility-to-provide-electricity-in-emergencies-judges-rule

To Revive Portland, Officials Seek to Ban Public Drug Use

https://www.nytimes.com/2023/12/11/us/portland-oregon-drug-laws.html

How to De-Ice Your Windshield Easily and Effectively

https://www.artofmanliness.com/skills/how-to/how-to-de-ice-your-windshield-easily-and-effectively/

kurulounge.blogspot.com

Chad @chad@infosec.exchange

· 34mo ago

According to Slashdot - Google Drive is losing files, so I thought I would throw the cybersecurity reading list out there again before it possibly disappears https://docs.google.com/spreadsheets/d/12z7_8fUwSejPVd6bIosD405mhpLLM_DnTdcIiiKWpqw/edit#gid=713137457 #infosec #cybersecurity #reading

docs.google.com

Chad @chad@infosec.exchange

· 36mo ago

What I'm Reading 9/25/2023
http://kurulounge.blogspot.com/2023/09/what-im-reading-9252023.html
#infosec #cybersecurity #news

Linux gives up on 6-year LTS kernels, says they’re too much work

https://arstechnica.com/gadgets/2023/09/linux-gives-up-on-6-year-lts-thats-fine-for-pcs-bad-for-android/

How network security can save security dollars

https://www.networkworld.com/article/3707308/how-network-security-can-save-security-dollars.html#tk.rss_security

SMEs overestimate their cybersecurity preparedness

https://www.helpnetsecurity.com/2023/09/22/smes-cyber-threats/

How Equifax Was Breached in 2017

https://blog.0x7d0.dev/history/how-equifax-was-breached-in-2017/

Incomplete disclosures by Apple and Google create “huge blindspot” for 0-day hunters

https://arstechnica.com/security/2023/09/incomplete-disclosures-by-apple-and-google-create-huge-blindspot-for-0-day-hunters/

Engineering-Grade OT Protection

https://www.darkreading.com/ics-ot/engineering-grade-ot-protection

Every Network Is Now an OT Network. Can Your Security Keep Up?

https://www.securityweek.com/every-network-is-now-an-ot-network-can-your-security-keep-up/

Chinese hackers have unleashed a never-before-seen Linux backdoor

https://news.hitb.org/content/chinese-hackers-have-unleashed-never-seen-linux-backdoor

DHS Publishes New Recommendations on Cyber Incident Reporting

https://www.securityweek.com/dhs-publishes-new-recommendations-on-cyber-incident-reporting/

2 major tech companies cancel conferences in SF; 2024 projected to be challenging year

https://abc7news.com/san-francisco-conventions-sf-moscone-center-meta-convention-canceled-red-hat/13470290/

China caught – again – with its malware in another nation's power grid

https://www.theregister.com/2023/09/12/china_malware_grid/

Analyst: MGM losing $4.2M-$8.4M a day because of cyberattack

https://www.reviewjournal.com/business/casinos-gaming/analyst-mgm-losing-4-2m-8-4m-a-day-because-of-cyberattack-2906379/

MGM, Caesars Face Regulatory, Legal Maze After Cyber Incidents

https://www.darkreading.com/attacks-breaches/mgm-caesars-regulatory-legal-maze-cyber-incidents

MGM, Caesars Cyberattack Responses Required Brutal Choices

https://www.darkreading.com/application-security/mgm-caesars-incident-responses-required-brutal-choices

Youth hacking ring at the center of cybercrime spree

https://cyberscoop.com/youth-hacking-ring-at-the-center-of-cybercrime-spree/

DHS council seeks to simplify cyber incident reporting rules

https://cyberscoop.com/dhs-cyber-incident-reporting-recommendations/

Solarium Commission wants action on stalled cybersecurity recommendations

https://cyberscoop.com/solarium-commission-implementation-report/

On the Cybersecurity Jobs Shortage

https://www.schneier.com/blog/archives/2023/09/on-the-cybersecurity-jobs-shortage.html

India's biggest tech centers named as cyber crime hotspots

https://www.theregister.com/2023/09/21/india_cybercrime_trends_report/

New Revelations from the Snowden Documents

https://www.schneier.com/blog/archives/2023/09/new-revelations-from-the-snowden-documents.html

Windows Subsystem for Linux gets new 'mirrored' network mode

https://www.bleepingcomputer.com/news/microsoft/windows-subsystem-for-linux-gets-new-mirrored-network-mode/

Keeping Google’s search secrets protects its monopoly, DOJ argues in court

https://arstechnica.com/tech-policy/2023/09/keeping-googles-search-secrets-protects-its-monopoly-doj-argues-in-court

YouTube suspends Russell Brand from advert income
https://www.bbc.com/news/entertainment-arts-66851698?at_medium=RSS&at_campaign=KARANGA

Elon Musk: Social media platform X, formerly Twitter, could go behind paywall

https://www.bbc.com/news/technology-66850821?at_medium=RSS&at_campaign=KARANGA

Ozempic Can Cause Major Loss of Muscle Mass and Reduce Bone Density

https://www.healthline.com/health-news/ozempic-muscle-mass-loss

Medicine is plagued by untrustworthy clinical trials. How many studies are faked or flawed?

https://web.archive.org/web/20230718112821/https://www.nature.com/articles/d41586-023-02299-w

DHS council seeks to simplify cyber incident reporting rules

https://cyberscoop.com/dhs-cyber-incident-reporting-recommendations/

Working Remotely Can More Than Halve an Office Employee’s Carbon Footprint

https://www.scientificamerican.com/article/working-remotely-can-more-than-halve-an-office-employees-carbon-footprint/

Michael Bloomberg Is Throwing $500 Million at Efforts to Shut Down All U.S. Coal Plants

https://gizmodo.com/michael-bloomberg-500-million-shut-down-coal-plants-1850861082

How Cisco is Addressing the Widening Skills Gap

https://www.eweek.com/cloud/how-cisco-is-addressing-the-widening-skills-gap/

Restoration of a dumpster Tektronix 2465B oscilloscope

https://sunestra.fr/posts/repair/scope/

kurulounge.blogspot.com

Chad @chad@infosec.exchange

· 37mo ago

What I'm Reading 9/18/2023
http://kurulounge.blogspot.com/2023/09/what-im-reading-9182023.html
#infosec #cybersecurity #news

How Google Authenticator made one company’s network breach much, much worse

https://arstechnica.com/security/2023/09/how-google-authenticator-gave-attackers-one-companys-keys-to-the-kingdom/

With 0-days hitting Chrome, iOS, and dozens more this month, is no software safe?

https://arstechnica.com/security/2023/09/with-0-days-hitting-chrome-ios-and-dozens-more-this-month-is-no-software-safe/

Will Cyber Security be Replaced by AI?

https://blog.edned.net/will-ai-replace-cyber-security/

DHS warns of malicious AI use against critical infrastructure

https://cyberscoop.com/dhs-homeland-threat-assessment/

DoD: China's ICS Cyber Onslaught Aimed at Gaining Kinetic Warfare Advantage

https://www.darkreading.com/threat-intelligence/dod-china-ics-cyber-onslaught-kinetic-warfare-advantage

CISA Releases Continuous Diagnostics and Mitigation Program: Identity, Credential, and Access Management (ICAM) Reference Architecture

https://www.cisa.gov/news-events/alerts/2023/09/15/cisa-releases-continuous-diagnostics-and-mitigation-program-identity-credential-and-access

Why Identity Management Is the Key to Stopping APT Cyberattacks

https://www.darkreading.com/edge/why-identity-management-key-stopping-apt-cyberattacks

Caesars says cyber-crooks stole customer data as MGM casino outage drags on

https://www.theregister.com/2023/09/14/caesars_mgm_hacks/

The Wachowskis and the Hacker as a progressive archetype

https://www.datagubbe.se/proghack/

America’s Advanced Manufacturing Problem—and How to Fix It

https://americanaffairsjournal.org/2023/08/americas-advanced-manufacturing-problem-and-how-to-fix-it/

Why Resumes Are Dead & How Indeed.com Keeps Killing the Job Market

https://paulfuhr.medium.com/how-indeed-com-keeps-killing-the-job-market-why-resumes-are-dead-a76ab2f5af

The spectacular downfall of a common, useless cold medicine

https://arstechnica.com/health/2023/09/the-spectacular-downfall-of-a-common-useless-cold-medicine/

“Most notorious” illegal shadow library sued by textbook publishers [Updated]

https://arstechnica.com/tech-policy/2023/09/most-notorious-illegal-shadow-library-sued-by-textbook-publishers/

Google hid evidence by training workers to avoid words monopolists use, DOJ says

https://arstechnica.com/tech-policy/2023/09/google-hid-evidence-by-training-workers-to-avoid-words-monopolists-use-doj-says/

Here’s exactly what Google will argue to fight the DOJ’s antitrust claims

https://arstechnica.com/tech-policy/2023/09/heres-exactly-what-google-will-argue-to-fight-the-dojs-antitrust-claims/

Long wave radio fans mourn fading frequencies

https://www.bbc.com/news/business-66644709?at_medium=RSS&at_campaign=KARANGA

Urban oases combine roof gardens and solar panels

https://www.bbc.com/news/business-66054688?at_medium=RSS&at_campaign=KARANGA

Replanting Logged Forests With Diverse Mixtures of Seedlings Accelerates Restoration

https://www.technologynetworks.com/applied-sciences/news/replanting-logged-forests-with-diverse-mixtures-of-seedlings-accelerates-restoration-378916

Study: U.S. dietary recommendations for protein intake are too low

https://bigthink.com/health/us-dietary-protein-recommendations-too-low/

CIA bribed its own COVID-19 origin team to reject lab-leak theory, anonymous whistleblower claims

https://www.science.org/content/article/cia-bribed-its-own-covid-19-origin-team-reject-lab-leak-theory-anonymous-whistleblower

California passes first-in-the-nation data broker deletion tool

https://cyberscoop.com/california-data-broker-deletion/

kurulounge.blogspot.com

Chad @chad@infosec.exchange

· 37mo ago

Hadnagy v. Moss Round 2 https://storage.courtlistener.com/recap/gov.uscourts.nvd.164181/gov.uscourts.nvd.164181.1.1.pdf
#defcon #legal

storage.courtlistener.com

Chad @chad@infosec.exchange

· 37mo ago

This article is worth a read - https://tracingwoodgrains.substack.com/p/when-punch-a-nazi-goes-wrong

tracingwoodgrains.substack.com

Chad @chad@infosec.exchange

· 38mo ago

Pre- #defcon31 cookout today. Steak, Potatoes, Corn, Yay!!!

infosec.exchange

Chad @chad@infosec.exchange

· 38mo ago

Replying to

@chxsec@infosec.exchange @smashingsecurity@mastodon.green @gcluley@mastodon.green thanks

Chad @chad@infosec.exchange

· 38mo ago

Another update to the cybersecurity reading list. Added a few more of my selections - https://docs.google.com/spreadsheets/d/12z7_8fUwSejPVd6bIosD405mhpLLM_DnTdcIiiKWpqw/edit#gid=2079030996 Also thinking about adding a podcast tab @DarknetDiaries
@MaliciousLife
@TenableSecurity
The Hacker Chronicles @thecyberwire
Daily to start. Other suggestions?

Google Docs

cyberreading list2

Chad @chad@infosec.exchange

· 14mo ago

She is Still Looking For Work - Celeste Seberras, Tech Writer / Content Strategist / Developer Relations with a Infosec and entrepreneurial background. http://resume.hakr.gg http://lnkd.in/gYRfjTcB #AI #Blockchain #Infosec #Cybersecurity #TechnicalWriting #developerrelations

resume.hakr.gg

Chad @chad@infosec.exchange

· 30mo ago

Updated Cybersecurity Reading List - Added CSRB Report on Microsoft Exchange Line Intrustion https://docs.google.com/spreadsheets/d/12z7_8fUwSejPVd6bIosD405mhpLLM_DnTdcIiiKWpqw/edit#gid=2079030996 #infosec #cybersecurity

Google Docs

cyberreading list2

Chad @chad@infosec.exchange

· 36mo ago

in a meeting today where it was relayed cybersecurity had unilaterally decided we can't use an app that field personnel rely on heavily. (condensed version) i think the case is still being argued but it makes me question what people think cybersecurity's role is?

to me cybersecurity exists as business enabler whose primary function is to recommend ways to reduce risk to levels the business can tolerate. not to issue edicts. that function seems to be getting lost anymore.