Digital Violence: How the NSO Group Enables State Terror

The data for the project is based on fifteen months of open source research that extracted data from hundreds of pages of documents as well as interviews. The Platform offers the most comprehensive database to date (containing over a thousand data points) of the reported infections of the phones using Pegasus.

https://forensic-architecture.org/investigation/digital-violence-how-the-nso-group-enables-state-terror

#digital #violence #nso #pegasus #surveillance #state #terror
📽@cRyPtHoN_INFOSEC_FR
📽@cRyPtHoN_INFOSEC_EN
📽@cRyPtHoN_INFOSEC_DE
📽@BlackBox_Archiv

If you use Audacity, the new owners just updated the terms of service so they can collect data on you, including for very open-ended "legal enforcement"; and then sell it to "potential buyers" all without your consent.

https://nitter.pussthecat.org/KrashHash/status/1411725491581587457

via Twitter

https://appleinsider.com/articles/21/07/04/open-source-audacity-deemed-spyware-over-data-collection-changes

#audacity
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Darknet Diaries - EP 96: The Police Station Incident

Nicole Beckwith wears a lot of hats. She’s a programmer, incident responder, but also a cop and Secret Service agent. In this episode she tells a story which involves all of these roles.

https://darknetdiaries.com/episode/96/

#truecrime #darknetdiaries #podcast
🎙@cRyPtHoN_INFOSEC_FR
🎙@cRyPtHoN_INFOSEC_EN
🎙@cRyPtHoN_INFOSEC_DE
🎙@BlackBox_Archiv

Israel Just Used Fully AI Controlled Drone Swarms in a World First

The system is fed with data from satellites, other reconnaissance drones, aerial vehicles, and intel collected by the ground unit.

In July 2019, unidentified drones swarmed the US Navy destroyers, triggering an alert. In May of 2021, Israel allowed the use of drone swarms to locate, identify, and attack Hamas militants, in what is likely the first-ever use of drone swarms in combat.

Last month, we had reported that Israel deployed a semi-autonomous robot during the recent Gaza conflict. Carrying a machine gun, this robot named Jaguar, was capable of driving to a designated location, returning fire, and even self-destructing when compromised. However, the robot needed a human operator to initiate the firing from the machine gun.

A fully autonomous drone swarm is a different level of technology altogether. It is a networked entity that is not controlled by human operators at all. Operated by artificial intelligence (AI), it can continue its mission, even if loses some drones during its mission. The machine learning system is fed with data sourced from satellites, other reconnaissance drones, and aerial vehicles, as well as intel collected by ground units.

https://telegra.ph/Israel-Just-Used-Fully-AI-Controlled-Drone-Swarms-in-a-World-First-07-06

via interestingengineering.com

#israel #ai #drones
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Cryptocurrency fraud: Brazil's 'Bitcoin King' arrested for allegedly embezzling $300 million

Cláudio Oliveira, a self-proclaimed 'King of Bitcoin', allegedly skimmed the amount from a large number of investors.

Brazil's federal police has arrested Cláudio Oliveira, the president of the Bitcoin Banco Group, for allegedly embezzling 1.5 billion Brazilian reais (about $300 million) through a cryptocurrency scheme, Coindesk reported.

Oliveira, the self-proclaimed 'King of Bitcoin', allegedly skimmed the amount from a large number of investors.

In 2019, the group had reported that 7,000 Bitcoins had gone missing and reportedly applied for judicial recovery -- a special arrangement under the Brazilian law to reorganise its finances -- in a bid to pay its creditors and avoid bankruptcy.

However, at the beginning of 2020, it was found that the group was not complying with the obligations determined at the time of the decree of judicial reorganisation and, to promote its activities and attract new customers, it continued to offer the public collective investment contracts without registration with the market regulator.

Subsequently, the police formed a task force comprising 90 officers and launched 'Operation Daemon' to nab the accused and to further investigate bankruptcy crimes, embezzlement, money laundering and criminal organization, Brazil's federal police said in a press release.

https://telegra.ph/Cryptocurrency-Fraud-Brazils-Bitcoin-King-Arrested-For-Allegedly-Embezzling-300-Million-07-06

via www.moneycontrol.com

#brazil #bitcoin #bbg #skimming
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Methods To Block Program Backdoors/Privacy Violations (Audacity Privacy Policy Example)

You can do this for ALL non internet needing programs to maximize privacy/security. We cover many ways we can restrict ALL non internet using programs from sending your IP address/backdoors (reverse shells?) and then use Audacity's new Privacy Policy and data sharing potential as an example: You should do this with All non internet programs to protect security + privacy.

https://devtube.dev-wiki.de/videos/watch/25321ef1-8663-43c9-926a-678df26c6d5e

https://www.buymeacoffee.com/politictech/block-program-backdoors-privacy-violations-related-ex-use-audacity-your-data-may-now-be-shared

#privacy #security #backdoors #audacity #video
📽@cRyPtHoN_INFOSEC_FR
📽@cRyPtHoN_INFOSEC_EN
📽@cRyPtHoN_INFOSEC_DE
📽@BlackBox_Archiv

NOTHING TO HIDE documentary (Eng, 2017)

NOTHING TO HIDE (2017) deals with the acceptance of mass surveillance through the "I have nothing to hide" narrative. “Eye-opening” (Forbes) “Fascinating” (Les Inrocks).
Support the Creative Commons Non Derivative Non Commercial licence of the film: leetchi.com/c/project-nothing-to-hide allowing the film to be online for free.

💡 More info about Nothing to Hide and its sequel Disappear:
https://deepdocs.eu

https://invidious.fdn.fr/watch?v=M3mQu9YQesk

#snowden #NothingToHide #documentation
📽@cRyPtHoN_INFOSEC_FR
📽@cRyPtHoN_INFOSEC_EN
📽@cRyPtHoN_INFOSEC_DE
📽@BlackBox_Archiv

BREAKING: Binance suspends euro bank transfers amid regulatory heat

As of 8 am UTC on Wednesday, Binance users will no longer be able to make euro deposits through their bank. However, they can still fund their accounts with credit cards and debit cards.

Regulatory constraints facing Binance have forced the popular cryptocurrency exchange to temporarily halt bank transfers denominated in euros, according to an email sent to its customers on Tuesday.

Specifically, euro deposits via the Single Europe Payments Area, or SEPA, have been put on hold indefinitely due to circumstances beyond the exchange’s control, Binance said in the email:

“Due to events beyond our control, we are temporarily suspending EUR deposits via SEPA Bank Transfers from 8 am UTC on July 7, 2021.”

https://cointelegraph.com/news/breaking-binance-suspends-euro-bank-transfers-amid-regulatory-heat

#binance #euro #bank #transfers #regulation
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Kaspersky Password Manager: All your passwords are belong to us

tl;dr: The password generator included in Kaspersky Password Manager had several problems. The most critical one is that it used a PRNG not suited for cryptographic purposes. Its single source of entropy was the current time. All the passwords it created could be bruteforced in seconds. This article explains how to securely generate passwords, why Kaspersky Password Manager failed, and how to exploit this flaw. It also provides a proof of concept to test if your version is vulnerable.

💡 The product has been updated and its newest versions aren’t affected by this issue.

Introduction
Two years ago, we looked at Kaspersky Password Manager (KPM), a password manager developed by Kaspersky. Kaspersky Password Manager is a product that securely stores passwords and documents into an encrypted vault, protected by a password. This vault is protected with a master password, so, as with other password managers, users have to remember a single password to use and manage all their passwords. Product is available for various operating systems (Windows, macOS, Android, iOS, Web…) Encrypted data can then be automatically synchronized between all your devices, always protected by your master password.

The main functionality of KPM is password management. One key point with password managers is that, contrary to humans, these tools are good to generate random, strong passwords. To generate secure passwords, Kaspersky Password Manager must rely on a secure password generation mechanism. We will first see an example of a good password generation method, to explain after why the method used by Kaspersky was flawed, and how we exploited it. As we will see, passwords generated by this tool can be bruteforced in seconds.

After a bit less than two years, this vulnerability has been patched on all versions of KPM. Vulnerability has been assigned CVE-2020-27020.

https://donjon.ledger.com/kaspersky-password-manager/

#kaspersky #password #manager #vulnerability
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

ACE/MPA Seize Dozens Of Pirate Streaming Domains, Demand Data on Dozens More

The Alliance for Creativity and Entertainment and partners the MPA have seized dozens of pirate-streaming related domains. In addition, the anti-piracy giants are demanding information that will allow them to identify the operators of dozens more pirate streaming sites, including the massive Streamtape.com and others involved in the supply of IPTV packages.

The past decade has seen an explosion of illegal streaming sites offering the latest movies and TV shows but despite enforcement efforts in many shapes and sizes, the flood seems never ending.

At the forefront of combating this threat is the Alliance For Creativity and Entertainment (ACE), the world’s largest anti-piracy coalition featuring dozens of the planet’s richest and most powerful entertainment industry groups.

The Motion Picture Association is deeply embedded within ACE and together these groups have shut down a large number of illegal platforms and targeted release groups plus other closely aligned entities.

https://torrentfreak.com/ace-mpa-seize-dozens-of-pirate-streaming-domains-demand-data-on-dozens-more-210706/

#ace #mpa #seized #pirate #domains
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Russian lawmakers prepare legal amendment to confiscate crypto

Russia’s prosecutor general, Igor Krasnov, says new crypto regulations are needed to combat corruption as — in his view — digital assets are often used to facilitate crime.

Russian lawmakers are working on new legislation that would allow the government to confiscate cryptocurrencies, according to a senior official.

Russian Prosecutor General Igor Krasnov claimed that the government is now developing a set of amendments to the country’s criminal code to allow authorities to seize crypto obtained from illegal activity, local news agency TASS reported.

Speaking at a conference of prosecutors’ offices of European countries on Wednesday, Krasnov stressed that cryptocurrencies like Bitcoin (BTC) have been increasingly used for corruption and bribery. The official said that cryptocurrency is also a tool for laundering embezzled budget funds.

“The criminal usage of cryptocurrencies poses a serious challenge in our country,” Krasnov said. He claimed that Russia’s adopted crypto law “On Digital Financial Assets” (DFA) has played a crucial role in tackling this problem, but new criminal code amendments would bring additional protection. “This would allow the application of restrictive measures and confiscation of virtual assets,” Krasnov stated.

According to some local industry experts, no amount of legislation would make it possible for the government to actually seize crypto assets. Nikita Soshnikov, a former senior lawyer at Deloitte CIS and director of Alfacash, told Cointelegraph that it is “obvious that digital assets kept in wallets would be impossible to confiscate like any other type of assets.” “However, there is already one landmark case where FSB officers were found guilty for accepting bribes, and the court formally seized 0.1 and 4.70235 BTC as state revenue,” he noted.

https://cointelegraph.com/news/russian-lawmakers-prepare-legal-amendment-to-confiscate-crypto

#russia #lawmakers #crypto #regulations
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Invites are live on https://cock.li!

Each user has been granted 5 invites, except for accounts over 3 years old which have 15. Invites will be replenished from time to time.

You can create your invites at https://cock.li/invites . Have fun!

https://nitter.pussthecat.org/gexcolo/status/1412682754224017414

via Twitter

#vincent #cockli #email #invites
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Shocking extent of biometric surveillance in Europe

A network of civil rights organizations has studied biometric surveillance systems in Germany, the Netherlands and Poland. The study concludes that the systems are often used unlawfully.

https://edri.org/wp-content/uploads/2021/07/EDRI_RISE_REPORT.pdf

#eu #biometric #surveillance #study #pdf
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

PrintNightmare Hits Windows, REvil Kaseya Ransomware Hits Businesses Worldwide - ThreatWire

3 Vulnerabilities were Found In Netgear Routers, Ransomware Hits Businesses Worldwide, and PrintNightmare Leads to remote code execution attacks! All that coming up now on ThreatWire.

https://www.youtube.com/watch?v=iCGuqW7NL9U

#threatwire #hak5 #video
📽@cRyPtHoN_INFOSEC_FR
📽@cRyPtHoN_INFOSEC_EN
📽@cRyPtHoN_INFOSEC_DE
📽@BlackBox_Archiv

Movie Companies Want U.S. Internet Provider ‘Frontier’ to Block Pirate Sites

A group of independent movie companies want to hold Internet provider Frontier Communications liable for pirating subscribers. In addition to damages, the filmmakers request a site-blocking order, targeting The Pirate Bay, YTS, RARBG, and many others. As a bonus, the movie companies note that the most prolific pirates can be sued directly too.

Over the past two decades, online piracy has proven a massive challenge for the entertainment industries.

It’s a global issue that’s hard to contain, but Hollywood and the major U.S. record labels are at the forefront of this battle.

One of the key strategies they’ve employed in recent years is website blocking. US companies have traveled to courts all over the world to have ISP blockades put in place, with quite a bit of success.

Interestingly, however, site blocking is noticeably absent in the United States, which harbors the most pirates of any country in the world. This can, in part, be explained by legislative backlashes and legal uncertainty. But it’s noteworthy nonetheless.

In recent years, the tide slowly started to turn, with major copyright groups strengthening their calls for blockades. However, the first move in court now comes from a group of smaller movie companies, including Millenium Media and Voltage Pictures, which have built up an impressive anti-piracy track record in recent years.

https://torrentfreak.com/movie-companies-want-u-s-internet-provider-frontier-to-block-pirate-sites-210707/

#usa #isp #block #pirate #sites
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Researchers uncovered the network infrastructure of REVil – The notorious ransomware group that hit Kaseya

Resecurity® HUNTER, cyber threat intelligence and R&D unit, identified a strong connection to a cloud hosting and IoT company servicing the domain belonging to cybercriminals.

According to the recent research published by ReSecurity on Twitter, starting January 2021 REVil leveraged a new domain ‘decoder[.]re’ in addition to a ransomware page available in the TOR network.

https://securityaffairs.co/wordpress/119799/cyber-crime/researchers-infrastructure-revil-ransomware-gang.html

#revil #kaseya #ransomware
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Mozilla Investigation: YouTube Algorithm Recommends Videos that Violate the Platform’s Very Own Policies

Conducted using data donated by thousands of YouTube users, research reveals the algorithm is recommending videos with misinformation, violent content, hate speech, and scams.

Research also finds that people in non-English speaking countries are far more likely to encounter disturbing videos.

(July 7, 2021) -- YouTube’s controversial algorithm is recommending videos considered disturbing and hateful that often violate the platform’s very own content policies, according to a 10-month long, crowdsourced investigation released today by Mozilla. The in-depth study also found that people in non-English speaking countries are far more likely to encounter videos they considered disturbing.

https://foundation.mozilla.org/en/blog/mozilla-investigation-youtube-algorithm-recommends-videos-that-violate-the-platforms-very-own-policies/

👉🏼 The Report (PDF)
https://assets.mofoprod.net/network/documents/Mozilla_YouTube_Regrets_Report.pdf

#mozilla #research #youtube #pdf
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

China’s gene giant harvests data from millions of women

A prenatal test used worldwide sends gene data of pregnant women to the company that developed it with China's military. The U.S. sees a security risk.

A Chinese gene company selling prenatal tests around the world developed them in collaboration with the country's military and is using them to collect genetic data from millions of women for sweeping research on the traits of populations, a Reuters review of scientific papers and company statements found.

U.S. government advisors warned in March that a vast bank of genomic data that the company, BGI Group, is amassing and analyzing with artificial intelligence could give China a path to economic and military advantage. As science pinpoints new links between genes and human traits, access to the biggest, most diverse set of human genomes is a strategic edge. The technology could propel China to dominate global pharmaceuticals, and also potentially lead to genetically enhanced soldiers, or engineered pathogens to target the U.S. population or food supply, the advisors said.

Reuters has found that BGI’s prenatal test, one of the most popular in the world, is a source of genetic data for the company, which has worked with the Chinese military to improve “population quality” and on genetic research to combat hearing loss and altitude sickness in soldiers.

BGI says it stores and re-analyzes left-over blood samples and genetic data from the prenatal tests, sold in at least 52 countries to detect abnormalities such as Down syndrome in the fetus. The tests – branded NIFTY for “Non-Invasive Fetal TrisomY” – also capture genetic information about the mother, as well as personal details such as her country, height and weight, but not her name, BGI computer code viewed by Reuters shows.

So far, more than 8 million women have taken BGI’s prenatal tests globally. BGI has not said how many of the women took the test abroad, and said it only stores location data on women in mainland China.

https://www.reuters.com/investigates/special-report/health-china-bgi-dna/

#china #bgi #dna #security #risk #usa
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

iMessage: End-to-end encryption leveraged by iCloud backup.

Apple itself states that all communication via iMessage is end-to-end encrypted (E2EE). Unfortunately, the messenger is not open source and thus the security cannot be independently confirmed. That being said, messages are only actually E2E encrypted if the iCloud backup feature is disabled for iMessage. By default, iMessage messages that are readable with a private key stored on the local device are namely transmitted to the iCloud.

Before being transferred to the iCloud, the messages are decrypted locally (with the private key) and then transferred to the iCloud via TLS channel. There they are encrypted again with a key that is, however, managed by Apple or is known there. This enables Apple to read all iMessage messages or forward them to the authorities. E2E encryption reduced to absurdity.

So, if you want your iMessage messages to actually remain E2EE, you have to manually deactivate the backup function for iMessages in iOS.

However, this problem does not only apply in connection with iMessage, but also with other messengers whose messages are transferred to the iCloud as a backup.

💡And what do we learn from this:
Manufacturers often advertise security and data protection features in their external presentation, which, on closer inspection, only serve marketing purposes and practically have little to no effect - except under certain conditions. Now you can check whether you have already manually deactivated the backup of iMessage messages on your device.

https://www.kuketz-blog.de/imessage-ende-zu-ende-verschluesselung-durch-icloud-backup-ausgehebelt/

#imessage #icloud #backup #encryption
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Code in huge ransomware attack written to avoid computers that use Russian, says new report

"They don't want to annoy the local authorities, and they know they will be able to run their business much longer if they do it this way," said an expert.

WASHINGTON — The computer code behind the massive ransomware attack by the Russian-speaking hacking ring REvil was written so that the malware avoids systems that primarily use Russian or related languages, according to a new report by a cybersecurity firm.

It's long been known that some malicious software includes this feature, but the report by Trustwave SpiderLabs, obtained exclusively by NBC News, appears to be the first to publicly identify it as an element of the latest attack, which is believed to be the largest ransomware campaign ever.

"They don't want to annoy the local authorities, and they know they will be able to run their business much longer if they do it this way," said Ziv Mador, Trustwave SpiderLabs' vice president of security research.

https://www.nbcnews.com/politics/national-security/code-huge-ransomware-attack-written-avoid-computers-use-russian-says-n1273222

👉🏼 read the report:
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/diving-deeper-into-the-kaseya-vsa-attack-revil-returns-and-other-hackers-are-riding-their-coattails/

#ransomware #revil #usa #russia
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

US offers Julian Assange time in Australian prison instead of American supermax if he loses London extradition fight Appeal against January decision to be heard by High Court

Julian Assange will remain in a British prison for now after the US government won permission to appeal against a January court ruling that freed him from extradition to America.

News of the appeal came as the US Department of Justice offered Assange a deal that would keep him out of the notoriously cruel US supermax prisons, according to The Times.

The High Court this morning granted the US permission to appeal against a ruling by Westminster Magistrates' Court that Assange couldn't be extradited because he would commit suicide if handed over to the Americans. The WikiLeaker-in-chief's legal team lost on every other legal ground against extradition.

US authorities gained that permission on three grounds, including a deal that would rule out his being sent to a federal supermax in Colorado or being automatically subject to extra-harsh punishments within prison.

"The United States has also provided an assurance that the United States will consent to Mr Assange being transferred to Australia to serve any custodial sentence imposed on him," said the High Court's ruling.

https://www.theregister.com/2021/07/08/assange_us_to_appeal_extradition_ruling/

#assange #usa #australia #london
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv