- cypherpunks - lists.cpunks.org

"Suprise crude build" - "Suprise crude draw" - repeat, ad infinitum - [PEACE] [AND] [RIGGED] [MARKETS]
by Zenaan Harkness 06 Oct '20

06 Oct '20

There is so much cynicism in certain rigged markets, for example the oil cartels, that their media don't even -try- to contain the crap The WTI, West Texas Intermediate, is a primary benchmark used by financial and trader types for the price of black gold: https://en.wikipedia.org/wiki/West_Texas_Intermediate can refer to a grade or a mix of crude oil, and/or the spot price, the futures price, or the assessed price for that oil; colloquially WTI usually refers to the price of the New York Mercantile Exchange (NYMEX) WTI Crude Oil futures contract or the contract itself. The WTI oil grade is also known as Texas light sweet, although oil produced from any location can be considered WTI if the oil meets required qualifications.[1] Spot and futures prices of WTI are used as a benchmark in oil pricing. This grade is described as light crude oil because of its relatively low density, and sweet because of its low sulfur content. And so, year in, year out, week in, week out, we get around 2 news articles per week, one which is titled something like today's: WTI Slides Back Below $40 After Surprise Crude Build https://www.zerohedge.com/energy/wti-slides-back-below-40-after-surprise-cr… and the other which is its inverse, something like "WTI Now Above $45 After Suprise Crude Draw". These tick tock is like clockwork - a literal "surprise crude build" followed by a "surprise crude draw". Every week. Week in, week out. Always both, build and draw, and each is always a "surprise". It's pretty funny actually, and although it's been going on for years, the headlines literally never change, always the same (bar the actual numbers), with around 2 "surprises" a week. Oddly, even after years of seeing these two headlines each week as "new" news articles on Zerohedge, it always brings a wry smile, which is almost certainly due to a sleepy neurone rattling around my head wondering why it's so alone "and surely there's another neurone in here somewhere" - as they say, "simple minds". But I'll have you know -right- now, I experience absolutely NO shame in finding these recurring headlines humorous ;)

1 0

The Verge: Congress releases blockbuster tech antitrust report
by jim bell 06 Oct '20

06 Oct '20

The Verge: Congress releases blockbuster tech antitrust report. https://www.theverge.com/2020/10/6/21504814/congress-antitrust-report-house…

1 0

Kaspersky discovers a China virus, of the UEFI type - :O
by Zenaan Harkness 06 Oct '20

06 Oct '20

Another China virus ("read my lips: Chai-nah vai-russ"), this time going all the way down to the mobo's UEFI: Kaspersky Finds Sophisticated UEFI Malware in the Wild https://www.extremetech.com/computing/315860-kaspersky-finds-sophisticated-… ... MosaicRegressor .. The infection was discovered on just two computers, both belonging to diplomatic officials in Asia. The full exploit chain is long and varied, allowing the attackers to load multiple modules to control the target system and steal data. However, it all starts with the UEFI loader. On each boot, MosaicRegressor checks to see if its malicious “IntelUpdate.exe” file is in the Windows startup folder. If not, it adds the file. ...

1 0

Encrypted postcards ...
by Stefan Claas 06 Oct '20

06 Oct '20

Hi all, while encrypted postcards (if you google for this topic) were popular among couples many decades ago, I thought of a modern way to do that. https://lists.gnupg.org/pipermail/gnupg-users/2020-October/064170.html Regards Stefan -- NaClbox: cc5c5f846c661343745772156a7751a5eb34d3e83d84b7d6884e507e105fd675 The computer helps us to solve problems, we did not have without him.

2 3

From the history of Microsoft (part 1)
by Georgi Guninski 06 Oct '20

06 Oct '20

From my blog: https://j.ludost.net/blog/archives/2020/10/03/from_the_history_of_microsoft… Markdown source follows. >From the history of Microsoft (part 1) by Georgi Guninski Sat 03 Oct 2020 08:51:30 AM UTC, version 1.0 History is written by the winners, so here we write: --- * [Microsoft accidentally distributes virus July 28, 2002](https://www.cnet.com/news/microsoft-accidentally-distributes-virus/) The software giant's Korean-language version of Visual Studio .Net carries the virulent Nimda computer virus to Asia. --- * [Ballmer: 'Linux is a cancer' Sat 2 Jun 2001](https://www.theregister.com/2001/06/02/ballmer_linux_is_a_cancer/) Contaminates all other software with Hippie GPL rubbish. Microsoft CEO and incontinent over-stater of facts Steve Ballmer said that "Linux is a cancer that attaches itself in an intellectual property sense to everything it touches," during a commercial spot masquerading as a interview with the Chicago Sun-Times on June 1, 2001. --- * [Halloween documents: August 1998 - March 2004](https://en.wikipedia.org/w/index.php?title=Halloween_documents&oldid=…. The Halloween documents comprise a series of confidential Microsoft memoranda on potential strategies relating to free software, open-source software, and to Linux in particular, and a series of media responses to these memoranda. Both the leaked documents and the responses were published by Eric S. Raymond in 1998. --- * [Bill Gates is an android user: 26 Sep 2017](https://www.theregister.com/2017/09/26/bill_gates_android_user/) **%**RIP Windows Phone, we are not crying much. --- * [Weird garbled Windows 7 update baffles world – now Microsoft reveals the truth: 30 Sep 2015](https://www.theregister.com/2015/09/30/windows_update_glitch/) Its description mostly contained garbled text. Links for more information, help, and support were filled in with gibberish URLs with ".gov," ".mil," and ".edu" domains. --- * [m$ is linux vendor: 27 Jun 2019](https://www.theregister.com/2019/06/27/microsoft_linux_distro_list/) 2001: Linux is cancer, says Microsoft. 2019: Hey friends, ah, can we join the official linux-distros mailing list, plz? We tried to [speak up](https://seclists.org/oss-sec/2019/q3/8), the oss vendor crowd liked m$. --- * Closed source, source leaked and widely open. Possibly to fit Microsoft better in the so called open source community, unknown forces [leaked m$' sources](https://html.duckduckgo.com/html?q=windows%20source%20leaked). [MS hacked! Russian mafia swipes WinME source? 27 Oct 2000](https://www.theregister.com/2000/10/27/ms_hacked_russian_mafia_swipes…

3 3

FOIA oppo on Bill Clinton convo with Putin re Yugoslavia & Milosevic - [PEACE] [POLITICS]
by Zenaan Harkness 06 Oct '20

06 Oct '20

FOIA opportunity here for USAians re Bill Clinton's 6th September 2000 conversation with Putin re Yugoslavia & Milosevic - large trove of docs released by Russia, almost entirely unredacted except where it might embarrass (in this specific case) Bill Clinton: Trove of Declassified Docs Reveals What Putin Told Clinton About Kursk Sinking, Yugoslavia, Terror https://sputniknews.com/world/202010051080674054-trove-of-declassified-docs…

1 0

Internet: 200 National Nets, Inet Falling Apart
by grarpamp 06 Oct '20

06 Oct '20

https://thehill.com/opinion/technology/518762-is-the-internet-falling-apart And since you refuse to go build it P2P among yourselves, the alternet will be just as controlled censored ID's and useless for freedom as the Inet and 200 nets. Roger Cochetti directed internet public policy for IBM from 1994 through 2000 and later served as Senior Vice-President & Chief Policy Officer for VeriSign and Group Policy Director for CompTIA. This week he warned about signs "that the once open, global internet is slowly being replaced by 200, nationally-controlled, separate internets." And, while these separate American, Chinese, Russian, Australian, European, British, and other "internets" may decide to have some things in common with each other, the laws of political gravity will slowly pull them further apart as interest groups in each country lobby for their own concerns within their own country. Moreover, we will probably see the emergence of a global alternate internet before long... As background, it's important to recognize that — by almost any measure — the global internet is controlled by businesses and non-profits subject to the jurisdiction of the United States government. Within a roughly 1,000-mile strip of land stretching from San Diego to Seattle lie most major internet businesses and network control or standards bodies (and those that aren't there likely lie elsewhere in the United States). So — as the governments of China, Russia and Iran never tire of explaining — while Americans constitute around 310 million out of the world's 4.3 billion internet users (around 8%), the U.S. government exercises influence or control over more than 70% of the internet's controls and services... China's ability to control the internet experience within its bordersx` between roughly 2005 and 2018 taught many other countries that doing so, even if costly, is possible. This lesson was not lost on Russia, Iran, Australia, Turkey, Saudi Arabia, the EU and many other countries, which began developing legal (and sometimes technical) means to control internet content within their borders. This legal/technical nationalization over the past decade was significantly boosted by the realization that it was actually not very difficult for a government to substantially shut down the internet within a territory... The first major step in the introduction of a new, China-centric internet may have taken place last year when China introduced to the UN's International Telecommunications Union a proposal for a new type of protocol that would connect networks in a way comparable to, but different from, the way that the internet protocols have done. This was quickly dubbed China's New IP, and it has been the subject of major controversy as the nations and companies decide how to react. Whether a new Chinese-centric internet is based on a new series of protocols or is simply based on a new set of internet domain names and numbers, it seems likely that this alternate internet will give national governments quite a bit more control over what happens within their territories than does the global, open internet. This feature will attract quite a few national governments to join in — not least Russia, Iran and perhaps Turkey and India. The combined market power of those participating countries would make it difficult for any global internet business to avoid such a new medium. The likely result being two, parallel global computer inter-networking systems... which is pretty much what Google CEO Eric Schmidt predicted.

4 5

Kaspersky: MosaicRegressor: Lurking in the Shadows of UEFI
by coderman 05 Oct '20

05 Oct '20

https://securelist.com/mosaicregressor/98849/ MosaicRegressor: Lurking in the Shadows of UEFI [Part II. Technical details (PDF)](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/202…) UEFI (or Unified Extensible Firmware Interface) has become a prominent technology that is embedded within designated chips on modern day computer systems. Replacing the legacy BIOS, it is typically used to facilitate the machine’s boot sequence and load the operating system, while using a feature-rich environment to do so. At the same time, it has become the target of threat actors to carry out exceptionally persistent attacks. One such attack has become the subject of our research, where we found a compromised UEFI firmware image that contained a malicious implant. This implant served as means to deploy additional malware on the victim computers, one that we haven’t come across thus far. To the best of our knowledge, this is the second known public case where malicious UEFI firmware in use by a threat actor was found in the wild. Throughout this blog we will elaborate on the following key findings: - We discovered rogue UEFI firmware images that were modified from their benign counterpart to incorporate several malicious modules; - The modules were used to drop malware on the victim machines. This malware was part of a wider malicious framework that we dubbed MosaicRegressor; - Components from that framework were discovered in a series of targeted attacks pointed towards diplomats and members of an NGO from Africa, Asia and Europe, all showing ties in their activity to North Korea; - Code artefacts in some of the framework’s components and overlaps in C&C infrastructure used during the campaign suggest that a Chinese-speaking actor is behind these attacks, possibly having connections to groups using the Winnti backdoor; The attack was found with the help of [Firmware Scanner](https://www.kaspersky.com/enterprise-security/wiki-section/product…, which has been integrated into Kaspersky products since the beginning of 2019. This technology was developed to specifically detect threats hiding in the ROM BIOS, including UEFI firmware images. Current State of the Art Before we dive deep into our findings, let us have a quick recap of what UEFI is and how it was leveraged for attacks thus far. In a nutshell, UEFI is a specification that constitutes the structure and operation of low-level platform firmware, so as to allow the operating system to interact with it at various stages of its activity. This interaction happens most notably during the boot phase, where UEFI firmware facilitates the loading of the operating system itself. That said, it can also occur when the OS is already up and running, for example in order to update the firmware through a well-defined software interface. Considering the above, UEFI firmware makes for a perfect mechanism of persistent malware storage. A sophisticated attacker can modify the firmware in order to have it deploy malicious code that will be run after the operating system is loaded. Moreover, since it is typically shipped within SPI flash storage that is soldered to the computer’s motherboard, such implanted malware will be resistant to OS reinstallation or replacement of the hard drive. This type of attack has occurred in several instances in the past few years. A prominent example is the LowJax implant [discovered](https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-root… by our friends at ESET in 2018, in which patched UEFI modules of the LoJack anti-theft software (also known as Computrace) were used to deploy a malicious user mode agent in a number of Sofacy Fancy Bear victim machines. The dangers of Computrace itself [were described](https://securelist.com/absolute-computrace-revisited/58278/) by our colleagues from the Global Research and Analysis Team (GReAT) back in 2014. Another example is source code of a UEFI bootkit named VectorEDK which was discovered in the Hacking Team leaks from 2015. This code consisted of a set of UEFI modules that could be incorporated into the platform firmware in order to have it deploy a backdoor to the system which will be run when the OS loads, or redeploy it if it was wiped. Despite the fact that VectorEDK’s code was made public and [can be found](https://github.com/hackedteam/vector-edk) in Github nowadays, we hadn’t witnessed actual evidence of it in the wild, before our latest finding. Our Discovery During an investigation, we came across several suspicious UEFI firmware images. A deeper inspection revealed that they contained four components that had an unusual proximity in their assigned GUID values, those were two DXE drivers and two UEFI applications. After further analysis we were able to determine that they were based on the leaked source code of HackingTeam’s VectorEDK bootkit, with minor customizations. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Rogue components found within the compromised UEFI firmware The goal of these added modules is to invoke a chain of events that would result in writing a malicious executable named ‘IntelUpdate.exe’ to the victim’s Startup folder. Thus, when Windows is started the written malware would be invoked as well. Apart from that, the modules would ensure that if the malware file is removed from the disk, it will be rewritten. Since this logic is executed from the SPI flash, there is no way to avoid this process other than eliminating the malicious firmware. Following is an outline of the components that we revealed: - SmmInterfaceBase: a DXE driver that is based on Hacking Team’s ‘rkloader’ component and intended to deploy further components of the bootkit for later execution. This is done by registering a callback that will be invoked upon an event of type EFI_EVENT_GROUP_READY_TO_BOOT. The event occurs at a point when control can be passed to the operating system’s bootloader, effectively allowing the callback to take effect before it. The callback will in turn load and invoke the ‘SmmAccessSub’ component. - Ntfs: a driver written by Hacking Team that is used to detect and parse the NTFS file system in order to allow conducting file and directory operations on the disk. - SmmReset: a UEFI application intended to mark the firmware image as infected. This is done by setting the value of a variable named ‘fTA’ to a hard-coded GUID. The application is based on a component from the original Vector-EDK code base that is named ‘ReSetfTA’. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Setting of the fTA variable with a predefined GUID to mark the execution of the bootkit - SmmAccessSub: the main bootkit component that serves as a persistent dropper for a user-mode malware. It is executed by the callback registered during the execution of ‘SmmInterfaceBase’, and takes care of writing a binary embedded within it as a file named ‘IntelUpdate.exe’ to the startup directory on disk. This allows the binary to execute when Windows is up and running. This is the only proprietary component amongst the ones we inspected, which was mostly written from scratch and makes only slight use of code from a Vector-EDK application named ‘fsbg’. It conducts the following actions to drop the intended file to disk: - Bootstraps pointers for the SystemTable, BootServices and RuntimeServices global structures. - Tries to get a handle to the currently loaded image by invoking the HandleProtocol method with the EFI_LOADED_IMAGE_PROTOCOL_GUID argument. - If the handle to the current image is obtained, the module attempts to find the root drive in which Windows is installed by enumerating all drives and checking that the ‘\Windows\System32’ directory exists on them. A global EFI_FILE_PROTOCOL object that corresponds to the drive will be created at this point and referenced to open any further directories or files in this drive. - If the root drive is found in the previous stage, the module looks for a marker file named ‘setupinf.log’ under the Windows directory and proceeds only if it doesn’t exist. In the absence of this file, it is created. - If the creation of ‘setupinf.log’ succeeds, the module goes on to check if the ‘Users’ directory exists under the same drive. - If the ‘Users’ directory exists, it writes the ‘IntelUpdate.exe’ file (embedded in the UEFI application’s binary) under the ‘ProgramData\Microsoft\Windows\Start Menu\Programs\Startup’ directory in the root drive. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Code from ‘SmmAccessSub’ used to write the embedded ‘IntelUpdate.exe’ binary to the Windows Startup directory Unfortunately, we were not able to determine the exact infection vector that allowed the attackers to overwrite the original UEFI firmware. Our detection logs show that the firmware itself was found to be malicious, but no suspicious events preceded it. Due to this, we can only speculate how the infection could have happened. One option is through physical access to the victim’s machine. This could be partially based on Hacking Team’s leaked material, according to which the installation of firmware infected with VectorEDK requires booting the target machine from a USB key. Such a USB would contain a special update utility that can be generated with a designated builder provided by the company. We found a Q-flash update utility in our inspected firmware, which could have been used for such a purpose as well. Furthermore, the leaks reveal that the UEFI infection capability (which is referred to by Hacking Team as ‘persistent installation’) was tested on ASUS X550C laptops. These make use of UEFI firmware by AMI which is very similar to the one we inspected. For this reason we can assume that Hacking Team’s method of patching the firmware would work in our case as well. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Excerpt from a Hacking Team manual for deployment of infected UEFI firmware, also known as ‘persistent installation’ Of course, we cannot exclude other possibilities whereby rogue firmware was pushed remotely, perhaps through a compromised update mechanism. Such a scenario would typically require exploiting vulnerabilities in the BIOS update authentication process. While this could be the case, we don’t have any evidence to support it. The Bigger Picture: Enter MosaicRegressor Framework While Hacking Team’s original bootkit was used to write one of the company’s backdoors to disk, known as ‘Soldier’, ‘Scout’ or ‘Elite’, the UEFI implant we investigated deployed a new piece of malware that we haven’t seen thus far. We decided to look for similar samples that share strings and implementation traits with the dropped binary. Consequently, the samples that we found suggested that the dropped malware was only one variant derived from a wider framework that we named MosaicRegressor. MosaicRegressor is a multi-stage and modular framework aimed at espionage and data gathering. It consists of downloaders, and occasionally multiple intermediate loaders, that are intended to fetch and execute payload on victim machines. The fact that the framework consists of multiple modules assists the attackers to conceal the wider framework from analysis, and deploy components to target machines only on demand. Indeed, we were able to obtain only a handful of payload components during our investigation. The downloader components of MosaicRegressor are composed of common business logic, whereby the implants contact a C&C, download further DLLs from it and then load and invoke specific export functions from them. The execution of the downloaded modules usually results in output that can be in turn issued back to the C&C. Having said that, the various downloaders we observed made use of different communication mechanisms when contacting their C&Cs: - CURL library (HTTP/HTTPS) - BITS transfer interface - WinHTTP API - POP3S/SMTPS/IMAPS, payloads transferred in e-mail messages The last variant in the list is distinct for its use of e-mail boxes to host the requested payload. The payload intended to run by this implant can also generate an output upon invocation, which can be later forwarded to a ‘feedback’ mail address, where it will likely be collected by the attackers. The mail boxes used for this purpose reside on the ‘mail.ru’ domain, and are accessed using credentials that are hard-coded in the malware’s binary. To fetch the requested file from the target inbox, MailReg enters an infinite loop where it tries to connect to the “pop.mail.ru” server every 20 minutes, and makes use of the first pair of credentials that allow a successful connection. The e-mails used for login (without their passwords) and corresponding feedback mail are specified in the table below: Login mail Feedback mail thtgoolnc(a)mail.ru thgetmmun(a)mail.ru thbububugyhb85(a)mail.ru thyhujubnmtt67(a)mail.ru The downloaders can also be split in two distinct types, the “plain” one just fetching the payload, and the “extended” version that also collects system information: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Structure of the log file written by BitsRegEx, strings marked in red are the original fields that appear in that file We were able to obtain only one variant of the subsequent stage, that installs in the autorun registry values and acts as another loader for the components that are supposed to be fetched by the initial downloader. These components are also just intermediate loaders for the next stage DLLs. Ultimately, there is no concrete business logic in the persistent components, as it is provided by the C&C server in a form of DLL files, most of them temporary. We have observed one such library, “load.rem“, that is a basic document stealer, fetching files from the “Recent Documents” directory and archiving them with a password, likely as a preliminary step before exfiltrating the result to the C&C by another component. The following figure describes the full flow and connection between the components that we know about. The colored elements are the components that we obtained and gray ones are the ones we didn’t: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Flow from BitsRegEx to execution of intermediate loaders and final payload Who were the Targets? According to our telemetry, there were several dozen victims who received components from the MosaicRegressor framework between 2017 and 2019. These victims included diplomatic entities and NGOs in Africa, Asia and Europe. Only two of them were also infected with the UEFI bootkit in 2019, predating the deployment of the BitsReg component. Based on the affiliation of the discovered victims, we could determine that all had some connection to the DPRK, be it non-profit activity related to the country or actual presence within it. This common theme can be reinforced through one of the infection vectors used to deliver the malware to some of the victims, which was SFX archives pretending to be documents discussing various subjects related to North Korea. Those were bundled with both an actual document and MosaicRegressor variants, having both executed when the archive is opened. Examples for the lure documents can be seen below. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Examples of lure documents bundled to malicious SFX archives sent to MosaicRegressor victims, discussing DPRK related topics Who is behind the attack? When analyzing MosaicRegressor’s variants, we noticed several interesting artefacts that provided us with clues on the identity of the actor behind the framework. As far as we can tell, the attacks were conducted by a Chinese-speaking actor, who may have previously used the Winnti backdoor. We found the following evidence to support this: - We spotted many strings used in the system information log generated by the BitsRegEx variant that contain the character sequence ‘0xA3, 0xBE’. This is an invalid sequence for a UTF8 string and the LATIN1 encoding translates these symbols to a pound sign followed by a “masculine ordinal indicator” (“£º”). An attempt to iterate over all available iconv symbol tables, trying to convert the sequence to UTF-8, produces possible candidates that give a more meaningful interpretation. Given the context of the string preceding the symbol and line feed symbols following it, the best match is the “FULL-WIDTH COLON” Unicode character translated from either the Chinese or Korean code pages (i.e. CP936 and CP949). https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Figure: The BitsRegEx system information log making use of the character sequence 0xA3, 0xBA, likely used to represent a full-width colon, according to code pages CP936 and CP949. - Another artefact that we found was a file resource found in CurlReg samples that contained a language identifier set to 2052 (“zh-CN”) https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Chinese language artefact in the resource section of a CurlReg sample - We detected an OLE2 object taken out of a document armed with the CVE-2018-0802 vulnerability, which was produced by the so-called ‘Royal Road’ / ‘8.t’ document builder and used to drop a CurlReg variant. To the best of our knowledge, this builder is commonly used by Chinese-speaking threat actors. https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2020/10/0… Excerpt from the OLE2 object found within a ‘Royal Road’ weaponized document, delivering the CurlReg variant - A C&C address (103.82.52[.]18) which was found in one of MosaicRegressor’s variants (MD5:3B58E122D9E17121416B146DAAB4DB9D) was observed in use by the ‘Winnti umbrella and linked groups’, according to a publicly available [report](https://401trg.com/burning-umbrella/). Since this is the only link between our findings and any of the groups using the Winnti backdoor, we estimate with low confidence that it is indeed responsible for the attacks. Conclusion The attacks described in this blog post demonstrate the length an actor can go in order to gain the highest level of persistence on a victim machine. It is highly uncommon to see compromised UEFI firmware in the wild, usually due to the low visibility into attacks on firmware, the advanced measures required to deploy it on a target’s SPI flash chip, and the high stakes of burning sensitive toolset or assets when doing so. With this in mind, we see that UEFI continues to be a point of interest to APT actors, while at large being overlooked by security vendors. The combination of our technology and understanding of the current and past campaigns leveraging infected firmware, helps us monitor and report on future attacks against such targets. The full details of this research, as well as future updates on the underlying threat actor, are available to customers of the APT reporting service through our Threat Intelligence Portal. IoCs The followings IoC list is not complete. If you want more information about the APT discussed here, a full IoC list and YARA rules are available to customers of Kaspersky Threat Intelligence Reports. Contact: intelreports(a)kaspersky.com UEFI Modules F5B320F7E87CC6F9D02E28350BB87DE6 (SmmInterfaceBase) B53880397D331C6FE3493A9EF81CD76E (SmmAccessSub) 91A473D3711C28C3C563284DFAFE926B (SmmReset) DD8D3718197A10097CD72A94ED223238 (Ntfs) RAR SFX droppers 0EFB785C75C3030C438698C77F6E960E 12B5FED367DB92475B071B6D622E44CD 3B3BC0A2772641D2FC2E7CBC6DDA33EC 3B58E122D9E17121416B146DAAB4DB9D 70DEF87D180616406E010051ED773749 7908B9935479081A6E0F681CCEF2FDD9 AE66ED2276336668E793B167B6950040 B23E1FE87AE049F46180091D643C0201 CFB072D1B50425FF162F02846ED263F9 Decoy documents 0D386EBBA1CCF1758A19FB0B25451AFE 233B300A58D5236C355AFD373DABC48B 449BE89F939F5F909734C0E74A0B9751 67CF741E627986E97293A8F38DE492A7 6E949601EBDD5D50707C0AF7D3F3C7A5 92F6C00DA977110200B5A3359F5E1462 A69205984849744C39CFB421D8E97B1F D197648A3FB0D8FF6318DB922552E49E BitsReg B53880397D331C6FE3493A9EF81CD76E AFC09DEB7B205EADAE4268F954444984 (64-bit) BitsRegEx DC14EE862DDA3BCC0D2445FDCB3EE5AE 88750B4A3C5E80FD82CF0DD534903FC0 C63D3C25ABD49EE131004E6401AF856C D273CD2B96E78DEF437D9C1E37155E00 72C514C0B96E3A31F6F1A85D8F28403C CurlReg 9E182D30B070BB14A8922CFF4837B94D 61B4E0B1F14D93D7B176981964388291 3D2835C35BA789BD86620F98CBFBF08B CurlRegEx 328AD6468F6EDB80B3ABF97AC39A0721 7B213A6CE7AB30A62E84D81D455B4DEA MailReg E2F4914E38BB632E975CFF14C39D8DCD WinHTTP Based Downloaders 08ECD8068617C86D7E3A3E810B106DCE 1732357D3A0081A87D56EE1AE8B4D205 74DB88B890054259D2F16FF22C79144D 7C3C4C4E7273C10DBBAB628F6B2336D8 BitsReg Payload (FileA.z) 89527F932188BD73572E2974F4344D46 2nd Stage Loaders 36B51D2C0D8F48A7DC834F4B9E477238 (mapisp.dll) 1C5377A54CBAA1B86279F63EE226B1DF (cryptui.sep) 9F13636D5861066835ED5A79819AAC28 (cryptui.sep) 3rd Stage Payload FA0A874926453E452E3B6CED045D2206 (load.rem) File paths %APPDATA%\Microsoft\Credentials\MSI36C2.dat %APPDATA%\Microsoft\Internet Explorer\%Computername%.dat %APPDATA%\Microsoft\Internet Explorer\FileA.dll %APPDATA%\Microsoft\Internet Explorer\FileB.dll %APPDATA%\Microsoft\Internet Explorer\FileC.dll %APPDATA%\Microsoft\Internet Explorer\FileD.dll %APPDATA%\Microsoft\Internet Explorer\FileOutA.dat %APPDATA%\Microsoft\Network\DFileA.dll %APPDATA%\Microsoft\Network\DFileC.dll %APPDATA%\Microsoft\Network\DFileD.dll %APPDATA%\Microsoft\Network\subst.sep %APPDATA%\Microsoft\WebA.dll %APPDATA%\Microsoft\WebB.dll %APPDATA%\Microsoft\WebC.dll %APPDATA%\Microsoft\Windows\LnkClass.dat %APPDATA%\Microsoft\Windows\SendTo\cryptui.sep %APPDATA%\Microsoft\Windows\SendTo\load.dll %APPDATA%\Microsoft\Windows\load.rem %APPDATA%\Microsoft\Windows\mapisp.dll %APPDATA%\Microsoft\exitUI.rs %APPDATA%\Microsoft\sppsvc.tbl %APPDATA%\Microsoft\subst.tbl %APPDATA%\newplgs.dll %APPDATA%\rfvtgb.dll %APPDATA%\sdfcvb.dll %APPDATA%\msreg.dll %APPDATA\Microsoft\dfsadu.dll %COMMON_APPDATA%\Microsoft\Windows\user.rem %TEMP%\BeFileA.dll %TEMP%\BeFileC.dll %TEMP%\RepairA.dll %TEMP%\RepairB.dll %TEMP%\RepairC.dll %TEMP%\RepairD.dll %TEMP%\wrtreg_32.dll %TEMP%\wrtreg_64.dll %appdata%\dwhost.exe %appdata%\msreg.exe %appdata%\return.exe %appdata%\winword.exe Domains and IPs 103.195.150[.]106 103.229.1[.]26 103.243.24[.]171 103.243.26[.]211 103.30.40[.]116 103.30.40[.]39 103.39.109[.]239 103.39.109[.]252 103.39.110[.]193 103.56.115[.]69 103.82.52[.]18 117.18.4[.]6 144.48.241[.]167 144.48.241[.]32 150.129.81[.]21 43.252.228[.]179 43.252.228[.]252 43.252.228[.]75 43.252.228[.]84 43.252.230[.]180 menjitghyukl.myfirewall[.]org Additional Suspected C&Cs 43.252.230[.]173 185.216.117[.]91 103.215.82[.]161 103.96.72[.]148 122.10.82[.]30 Mutexes FindFirstFile Message Bi set instance state foregrounduu state single UI Office Module process attach Module

1 0

Paper on Assassination Markets
by b. water 05 Oct '20

05 Oct '20

Ever since I've read the Assassination Politics essay, my perspective of the world has changed: at last, a tool to create an anarcho-capitalist society! Alas, I've been dismayed by the lack of progress since it was first published. Little interest, very few serious publications, and still no running assassination market! Since I'm not a developer I can't really create one, but I've written a paper on assassination markets that I think could have some mainstream appeal, by reconciling the AP idea with more palatable concepts such as self defense and the NAP. I'd love to have your feedback on this paper. The draft of the paper (pdf) can be accessed here: https://docdro.id/fTYVUqf If you have any question please let me know.

5 7

Puri.sm Librem 5 Phone Ships, Pine64 Pinephone Coming, Linux and BSD Phones
by grarpamp 05 Oct '20

05 Oct '20

https://www.pine64.org/ https://arstechnica.com/gadgets/2019/09/purisms-librem-5-phone-starts-shipp… https://puri.sm/posts/first-librem-5-smartphones-are-shipping/ https://pureos.net/ https://www.youtube.com/watch?v=AuT2w6BkT-k https://www.youtube.com/watch?v=Gvnt78mK-Ac https://www.youtube.com/watch?v=yHcHi0TBFv4 https://www.youtube.com/channel/UC64-PJ-yoF7aJ9pIHWEbrTQ/videos Support the Digital Rights Movement... Get this phone ! Purism announced their first Librem 5 smartphones were rolling off the assembly line and heading to customers. "Seeing the amazing effort of the Purism team, and holding the first fully functioning Librem 5, has been the most inspirational moment of Purism's five year history," said their founder and CEO Todd Weaver. On Wednesday they posted a video announcing that the phones were now shipping, and Friday they posted a short walk-through video. "The crowdsourced $700 Linux phone is actually becoming a real product," reports Ars Technica: Purism's demand that everything be open means most of the major component manufacturers were out of the question. Perhaps because of the limited hardware options, the internal construction of the Librem 5 is absolutely wild. While smartphones today are mostly a single mainboard with every component integrated into it, the Librem 5 actually has a pair of M.2 slots that house full-size, off-the-shelf LTE and Wi-Fi cards for connectivity, just like what you would find in an old laptop. The M.2 sockets look massive on top of the tiny phone motherboard, but you could probably replace or upgrade the cards if you wanted... [Y]ou're not going to get cutting-edge hardware at a great price with the Librem 5. That's not the point, though. The point is that you are buying a Linux phone, with privacy and open source at the forefront of the design. There are hardware kill switches for the camera, microphone, WiFi/Bluetooth, and baseband on the side of the phone, ensuring none of the I/O turns on unless you want it to. The OS is the Free Software Foundation-endorsed PureOS, a Linux distribution that, in this case, has been reworked with a mobile UI. Purism says it will provide updates for the "lifetime" of the device, which would be a stark contrast to the two years of updates you get with an Android phone. PureOS is a Debian-based Linux distro, and on the Librem 5, you'll get to switch between mobile versions of the Gnome and KDE environments. If you're at all interested in PureOS, Purism's YouTube page is worth picking through. Dozens of short videos show that, yes, this phone really runs full desktop-class Linux. Those same videos show the dev kit running things like the APT package manager through a terminal, a desktop version of Solitaire, Emacs, the Gnome disk utility, DOSBox, Apache Web Server, and more. If it runs on your desktop Linux computer, it will probably run on the Librem 5, albeit with a possibly not-touch-friendly UI. The Librem 5 can even be hooked up to a monitor, keyboard, and mouse, and you can run all these Linux apps with the normal input tools... Selling a smartphone is a cutthroat business, and we've seen dozens of companies try and fail over the years. Purism didn't just survive long enough to ship a product -- it survived in what is probably the hardest way possible, by building a non-Android phone with demands that all the hardware components use open code. Making it this far is an amazing accomplishment.

4 6