OODA Analysis and Briefs

Home > OODA Analysis and Briefs

Analysis

Now THIS Creeps Me Out

So the other day I tried to use my credit card to buy something, and it was denied even though I knew perfectly well my credit card was just fine. So I called my credit-card company to find out what was up with all this, and it turned out I had made the unpardonable mistake…
Spies in the Shower

From InfoWorld: I don’t want to alarm you, but a reader just sent me evidence showing that a large and secretive organization is tracking some surprising information about us. No, not the National Security Agency. We’re talking about a really secretive organization: Proctor & Gamble. The sender hits the nail on the head: “My privacy…
BOHICA

Personal data, including Social Security numbers of 26.5 million U.S. veterans, was stolen from a Veterans Affairs employee this month after he took the information home without authorization, the department said Monday. The INFOSEC practitioner in me wants to beat some GS-half-wit @$$ . . . the ex-GI in me lowering my trousers and spreading…
Of Privacy and Security

Most of the critics of IC activities fall into one of two camps (with some cross-pollination). The first are almost not worth discussing since the main thrust of their arguments center on the words “Bush” and “lied” and it gets no more robust than that. The second camp likes to play tricks with the language…
WWDD?

Over the last several years we have been fortunate enough to not have been subjected to another September 11th-scale attack. Further more, we have not had the misfortune of suffering anything on a smaller scale like the attacks in London or Madrid. There are a number of potential reasons why we are able live in…
Mid-Hearing Assessment of Hayden Confirmation (Update)

No way I can blog this full-time, but am catching bits and pieces on the radio. Some good, hard questions, very good and solid answers. I am particularly fond of the statement reference the “80-90” people briefed at the start of the terrorism surveillance project; NOT a small cabal of untouchables a’la Graham and crew…
Not Serious XIII

The Homeland Security Department has not yet submitted a strategic plan to Congress on how it intends to improve border security and immigration enforcement, prompting House appropriators to cut funding in the department’s fiscal 2007 budget. I don’t want to be seen as piling-on given the report from Hugh Hewitt on the disconnect between the…
Curiouser and curiouser (Update)

Qwest says they flat-out didn’t oblige NSA’s request for phone records. Bell South and Verizon are now saying “We Never!” That leaves AT&T holding the bag, but probably not for long. So are the phone companies lying? Only if there is an elaborate agreement in place to have each org cover the @ss of the…
Flash traffic for all cell members

Usama says: “don’t forget to opt out of the surveillance program.”
Brilliant

A senior federal law enforcement official tells ABC News the government is tracking the phone numbers we call in an effort to root out confidential sources. Human intelligence (traditional “spying”) is in part successful because people have a sense of trust that the guy (intelligence officer) who is talking you (impending traitor) into doing something…
Telephone Man

(The retooled, recycled version of the earlier post mentioned. Periodical option fell through so baby goes shoeless this month 😉 ) After General Michael Hayden was nominated by President Bush for the directorship of the Central Intelligence Agency, it took mere days for stories about alleged illegalities perpetrated during his tenure at the National Security…
Achtung!

For all the screaming mimis . . . this is how it works in a REAL police state.
Imagine That (NSA Revelations)

From ABC: Americans by nearly a 2-1 ratio call the surveillance of telephone records an acceptable way for the federal government to investigate possible terrorist threats, expressing broad unconcern even if their own calling patterns are scrutinized. Lending support to the administration’s defense of its anti-terrorism intelligence efforts, 63 percent in this ABC News/Washington Post…
NSA Expose

Scary piece on NSA’s supposed evils in USA Today this morning. Will have a more thorough treatment up later today, but in the mean time, allow me to do my bit for the environment and recycle another post that should provide some insights and balance out the hype. Moring coverage from Michelle Malkin, Strata-Sphere, OTB,…
Changing Strategies

Who here ever heard of DOCEX prior to the release of the West Point report? Prior to the IDA study? Prior to Steve Hayes writing about it throughout last year? That’s what I thought. You couldn’t hold a gun to anyone’s head and get them to acknowledge the mission because it was the under-appreciated scut…

Briefs

Irregular EU border crossings hit ‘highest’ level since 2016

The number of irregular border crossing in the European Union increased by 64% last year. This is the highest level since 2016 according to the EU’s border and coast guard agency on Friday. The agency’s preliminary calculations found 330,000 entries, with 45% of these entries in the Western Balkan region. 2021 also had a steep…
Amhara forces withdraw from northern Ethiopia’s Tigray region

Forces from Ethiopia’s Amhara region have withdrawn from the neighboring Tigray region in line with the African-Union backed ceasefire. The troops fought in support of federal troops in the two-year civil war. The withdrawal is a large step towards implementing the agreement from November 2. The disarmament of the Tigrayan forces has been another large…
Royal Mail’s Attackers Linked to Russia-Backed LockBit

The LockBit ransomware group has been tied to another prolific cyberattack targeting the UK’s postal service. The attack occurred in January of this year and severely disrupted Royal Mail’s international deliveries. During the attack, printers located at a distribution site in Belfast begun to print ransom notes stating that the LockBit Black Ransomware had stolen…
Russia claims control of salt mine town Soledar

Russia has stated that it has captured the Ukrainian town of Soledar after a long battle. Claiming the salt-mine town has been called an important step for its offensive. The victory would allow Russian troops to move to Bakhmut to cut off the Ukrainian forces there. Ukrainian officials claim the fight for Soledar is still…
US Family Planning Non-Profit MFHS Confirms Ransomware Attack

Maternal and Family Health Services, a US-based health and human services organization, has reportedly suffered from a ransomware attack. The organization confirmed the attack last week, stating that the breach occurred between August 2021 and April 2022. The healthcare service launched an investigation into the attack last April that determined that sensitive information may have…
UAE names oil chief to lead COP28 talks

The head of the world’s 12th largest oil company has been named to lead the COP28 global climate talks later this year in Dubai. The chief executive officer of the Abu Dhabi National Oil Company will lead the summit. Sultan Ahmed Al Jaber is also the minister for industry and advanced technology for the United…
Arrests ordered for top officials after capital stormed

Judicial authorities in Brazil have called for the arrest of top public officials after rioters overran government buildings. The former commander of the military police is one of the officials that has been arrested. Brazil’s former public security chief Anderson Torres and other officials who were deemed responsible for acts or omissions that lead to…
Gas from faulty heaters kills nearly 20 in Algeria cold snap

At least 17 people have died due to carbon monoxide poisoning in Algeria. The low temperatures in the country have caused people to use crude heaters which emit dangerous fumes. NIne members of the same family died in the city of Bou Saada, another family of six died in the province of Setif and two…
Philippine top court voids old South China Sea energy deal

The Supreme Court in the Philippines on Tuesday stated the country’s 2005 energy exploration agreement with Chinese and Vietnamese firms was illegal. The court declared in the ruling that the constitution does not allow foreign entities to exploit natural resources in the Philippines. The agreement had expired in 2008, but the decision could complicate efforts…
Chinese military stages large-scale military exercises around Taiwan

28 warplanes were sent across the median line of the Taiwan Strait by China on Sunday. This was the first large-scale military exercise of the year around the island.. The planes were among 57 others spotted near Taiwan, including J-10, J-11, J-16 and Su-30 fighters. H-6 bombers, drones and an early warning and reconnaissance aircraft…
Brazil’s state organs slam ‘terrorist’ pro-Bolsonaro riots

The president of Brazil, Luiz Inacio Lula da Silva, along with leaders of both houses of Congress and the chief justice of the Supreme Court condemned the violent actions by the far-right supporters of the former President Jair Bolsonaro over the weekend. A pro-Bolsonaro mob stormed Congress, the Supreme Court and the presidential palace demanding…
Ukraine enhances defenses in east amid relentless Russian attacks

Ukraine has stated that it is strengthening its forces around Bakhmut in the eastern Donbas region to repel attacks there by the Russian mercenary group Wagner. Kyiv has sent reinforcements to Soledar, near Bakhmut, where the situation was difficult. Ukraine revealed that Russia attempted to storm the city from different directions and used the Wagnerites…
Crowd gathers outside prison in bid to stop executions in Iran

Dozens of people gathered to protest outside of a prison in Iran overnight after authorities were reported to be preparing to execute two anti-government protesters. The two protesters were hanged on Saturday, causing international condemnation. The people protesting the executions gathered outside of Rajai Shahr jail in the city of Karaj. The UN human rights office…
Five Guys Discloses Data Breach Affecting Employee PII

Five Guys, a US-based fast food restaurant chain, recently released a statement to its customers disclosing a data breach that occurred in September of 2022 and exposed sensitive customer data. The breach allegedly took place when an unauthorized party was able to access a file server and obtain information belonging to employees such as names,…
Chad says it foiled ‘destabilization’ attempt by officers

Chad’s government stated that its security forces stopped an attempt by a group of army officers to destabilize the country and undermine constitutional order. The plan was created by 11 officers and was led by the president of the Chadian Human Rights Organization. Security forces arrested those responsible after December 8. A formal investigation into…
Deadly riots grip Mexican state after arrest of El Chapo’s son

Three members of the security force have died in conflict in the state of Sinaloa after the arrest of a son of El Chapo, a notorious Mexican drug kingpin. Ovidio Guzmán-López alleged himself to be a leader of his father’s former cartel. He was captured in Culiacán and was transferred to Mexico City. After his…
China to open border with Hong Kong after three years of tight control

On Thursday it was announced that the Chinese government will reopen its border with Hong Kong on January 8, 2023. The border has been largely shut for the past three years in an effort to stop the spread of Covid-19. Up to 60,000 Hong Kong residents will be allowed to cross the border into mainland…
Slack Says Hackers Stole Private Source Code Repositories

On December 31, Slack disclosed an incident in which some private source code repositories were stolen by hackers. Slack stated that it learned of the suspicious activity just a few days earlier on December 29 and has claimed that the attack’s impact was limited. The investigation showed that attackers downloaded private code repositories on December…
Rail Tech Giant Wabtec Discloses Global Data Breach

Wabtec Corporation, a leading rail technology company, has disclosed details of a security incident that occurred last year and resulted in the compromise of highly sensitive information. The company is headquartered in Pittsburgh and operates in over 50 countries within the freight, mining, industrial, marine, and transit sectors. The firm reportedly suffered from a ransomware…
NHS is Most Scammed UK Government “Brand”

In the UK, the National Health Service topped the list of the government organizations most frequently impersonated in email scams, according to a recent report released by the National Cyber Security Centre. The report uses findings from the popular Suspicious Email Reporting Service, which received 6.4 million reports last year. The reporting service resulted in…
Malicious PyTorch Package Downloaded Thousands of Times

The developer behind the open source machine learning framework PyTorch learned of a malicious dependency mimicking one of its own. According to PyTorch, the malicious dependency was available on a leading code repository over the Christmas period and had the same name as a legitimate dependency. However, the malicious version featured code that uploaded sensitive…
Taliban says eight ISIL fighters killed in raids in Afghanistan

The Afghan Taliban has killed eight ISIL fighters and arrested several others in raids. The series of raids targeted key figures in attacks in Kabul. The raids occurred in the capital city and western Nimroz province. The targeted ISIL members organized the recent attacks on the Longan Hotel in Kabul, Pakistan’s embassy and the military…
India Supreme Court stays order on mass evictions

India’s highest court has given temporary relief to thousands of people who were going to be evicted from their homes in Uttarakhand state. The court ruled that a workable solution must be found for the forced evictions. The government officials have alleged that the people facing eviction live on lands that belong to Indian Railways. …
New Phishing Campaign Impersonates Flipper Zero to Target Cyber Professionals

Security researcher Dominic Alvieri raised the alarm on several social media accounts and fake websites claiming to sell the sough after hacking tool Flipper Zero. The fraudulent sites are designed to lure cybersecurity professionals into making cryptocurrency transactions. The type of phishing is known as angler phishing and is a type of attack that involves…
Hacker Selling Data Allegedly Stolen From Volvo Cars Following Ransomware Attack

A hacker listed data for sale on a public hacker forum on December 31 claiming that the data was stolen from Swedish vehicle manufacturer Volvo Cars. The hacker alleges that the data breach was a result of a ransomware attack conducted in late December. The hacker further claims that the ransomware used in the attack…
EU Set to Impose Coordinated Controls on Travelers From China

The European Union member states have begun planning for the implementation of coordinated controls on passengers arriving from China. This could include mandatory pre-travel testing to avoid consequences of China’s sudden reversal of its zero-Covid policy. The decision will likely be finalized on Wednesday and would follow in the path of the US, who has…
South Korea-U.S. Military Drills Could Use Nuclear Assets, President Yoon Suk-yeol Says

South Korea’s president has stated that Washington and Seoul are discussing conducting joint exercises using nuclear assets. US President Biden has since played down the claim. President Yoon Suk-yeol stated that the goal of the drills would be to practice extended deterrence methods. Although South Korea does not possess its own nuclear weapons, it is…
Researchers Discover New Linux Malware Targeting WordPress Sites

Research by cybersecurity firm Dr. Web has found that a new strain of Linux malware is targeting websites based on WordPress. The malware has been named Linux.BackDoor.WordPressExploit.1 and targets 32-bit versions of Linux. The malware is primarily used to hack websites based on content management systems and to inject malicious script onto webpages. The backdoor…
No Major Spike in Reported Ransomware in 2022

Emsisoft has reported that there was no spike in ransomware attacks reported in 2022. The report found that over 200 organizations in the healthcare, government, and education sectors were compromised by ransomware in the past year, representing a similar figure to 2021. Emsisoft published the findings in a recent report that analyzed ransomware incidents in…
CISA Says Two Old JasperReports Vulnerabilities Exploited in Attacks

Two JasperReports flaws have been added to the US Cybersecurity and Infrastructure Security Agency’s (CISA) Exploited Vulnerabilities Catalog. The library is reportedly the world’s most popular open source reporting engine and now includes flaws in the JasperReports software that enable non-technical users to create reports and perform more functions. The CISA allegedly learned about the…
Google to Pay Indiana $20 Million to Resolve Privacy Suit

Indiana Attorney General Todd Rokita has confirmed that Google will pay Indiana roughly $20 million to resolve a lawsuit regarding alleged deceptive location tracking practices. The state of Indiana sued the technology giant due to an investigation that concluded Google continued to track users’ location data after they opted out. Indiana found that the users…
LockBit Hands Ransomware Decryptor to Kids’ Hospital

The prolific LockBit ransomware group has not only apologized to a children’s hospital for conducting a ransomware attack, but has also provided it with a free decryption key. The attack targeted Toronto’s Hospital for Sick Children (SickKids) on December 18, 2022. The facility is Canada’s largest pediatric hospital and admitted that it was suffering from…
Ukrainian Cops Bust Major Vishing Call Center

Ukrainian investigators have taken down a major call center operation blamed for defrauding thousands of Kazakhstani victims. The call center takedown was a collaboration between officers from Ukraine’s Cyber Police Department and the Main Investigative Department of the National Police. Police reported that 40 individuals were arrested in connection with the scheme, including three individuals…
Israeli Missile Strikes Briefly Shut Damascus Airport, Syria Says

On Monday, Syria reported that Israel launches missiles on Damascus’s international airport. The assault killed two military personnel and forced the facility to briefly shut down. The move marks the latest attack that targets a key Iran ally in the region. The strikes occurred at 2 a.m. local time and caused damage to the airport.…
Dozens escape Mexican jail in deadly attack

Dozens of inmates reportedly escaped from a prison located in northern Mexico after suspected cartel members launched an assault on the facility. The gunmen reportedly opened fire outside of the Chihuahua state prison in armored vehicles, targeting guards. Ten individuals were killed, including four prisoners. According to police reports, 24 inmates successfully escaped from the…
Ukraine claims hundreds of Russian troops killed in strike; Moscow says 63 died

Just after midnight on Sunday, New Year’s Day, an apparent Ukrainian strike reportedly killed a large number of Russian troops. The strike targeted Russian-occupied eastern Ukraine at a vocational school housing Russian conscripts. The attack has been confirmed by both Ukrainian and pro-Russian military bloggers and former officials, however, the death toll has been debated.…
Data Breach at Louisiana Healthcare Provider Impacts 270,000 Patients

A healthcare provider located in southwest Louisiana has reportedly suffered from a data breach that compromised patient medical and personal information. The Lake Charles Memorial Health System (LCMHS) is informing patients that their data was exposed during the attack, which was identified on October 25. The healthcare provider began notifying patients on December 23. LCMHS…
EarSpy Spying on Phone Calls via Ear Speaker Vibrations Captured by Accelerometer

Malicious actors are using an attack method named EarSpy to leverage side-channels for eavesdropping on user’s phone communications. The technique was described by researchers in a paper published in December in collaboration between researchers from several universities, including Texas A&M University, Temple University, New Jersey Institute of Technology, Rutgers University, and the University of Dayton.…
Experts Warn ChatGPT Could Democratize Cybercrime

A new artificial intelligence bot that has quickly become very popular could be utilized by cybercriminals for nefarious purposes, including learning how to craft attacks and write ransomware. ChatGPT was released last month and has already surpassed one million users on the platform. The chatbot leverages vast volumes of data spanning the internet to answer…
North Korean Hackers Created 70 Fake Bank, Venture Capital Firm Domains

BlueNoroff hackers, part of the Lazarus hacking group linked to the North Korean government, have been identified deploying new techniques with an updated arsenal in a recent wave of attacks. The campaign is targeting banks and venture capital firms with financial motivations. In the past, the group has been known to target financial institutions, cryptocurrency…
Cybersecurity Leaders Outline Future Trends Ahead of Infosecurity Europe 2023

Infosecurity Europe’s community of cybersecurity leaders predict that the global political unrest from this year will continue to plague 2023 and cause serious issues for the security industry. However, the leaders believe that stricter regulations and new developments in areas such as artificial intelligence, machine learning, and more will mean that the security industry will…
Russia Follows Ukraine Missile Barrage With Wave of Armed Drones

Overnight, Russia launched more than one dozen armed drones targeting Ukrainian cities and infrastructure. The missiles struck and set fire to a district government building in Kyiv, according to Ukrainian authorities. Ukrainian air defenses were successful in mitigating and shooting down at least 16 of the drones, two of which were downed approaching Kyiv and…
Myanmar court extends Aung San Suu Kyi’s prison sentence to 33 years

Myanmar has sentenced Aung San Suu Kyi, the country’s former leader, to seven years in prison for corruption. The sentencing brings the proceedings to an end after months of secrecy regarding the highly-politicized trial against Suu Kyi. Suu Kyi was democratically elected and served as the leader of Myanmar before being forced out of office…
Making Comprehensive Crypto Policy Out of Regulatory Patchwork

Even as cryptocurrency and other digital assets resident on blockchain have increasingly permeated the public consciousness, the question of regulatory authority has largely gone unanswered. Often, seismic events in the financial industry, like the collapse of FTX, lead to clarity. Here, unfortunately, instead of leading to any kind of consensus, the early signs indicate that…
Blockchain analytics unable to prevent FTX-level illicit schemes

Data transparency has been a focal point for the cryptocurrency industry, but the FTX fiasco has shown that centralized exchanges (CEXs) are not transparent enough. So far, crypto analytics firms are apparently not capable of tracking transactions to help prevent collapses like that of FTX. All Bitcoin transactions are available publicly on-chain, which means people can…
3Commas Admits It Was Source of API Leak That Led to Hacks

A group of traders last week said that $22 million worth of crypto had been stolen through compromised API keys from the trading platform 3Commas. On Wednesday, 3Commas admitted it was the source of that API leak. The announcement came after an anonymous Twitter user obtained around 100,000 API keys belonging to 3Commas users and published…
Alameda wallets funnel over $1.7M via crypto mixers overnight

30 cryptocurrency wallets linked to Alameda Research, the bankrupt sister company of crypto exchange FTX, became active on Dec. 28 following four weeks of inactivity. These wallets swapped and mixed over $1.7 million worth of crypto assets through various crypto-mixing services. Crypto mixers are often used by market exploiters and criminals to obscure the transaction path…
Opposition governor’s arrest stirs anger in Bolivia

In Bolivia, violent protests have broken out across the nation in the wake of the arrest of a powerful opposition politician, Luis Fernando Camacho. Camacho is the right-wing governor of the Santa Cruz province and was detained by armed police during an investigation that resembled a kidnapping, according to his supporters. Camacho is responsible for…
At least 19 dead in blaze on Thai border in Casino Fire

Cambodian authorities have confirmed that at least 19 people have died after a fire spread through a Cambodian hotel-casino that lies on the border with Thailand. Hundreds of people were in the building, the Grand Diamond City, when the fire broke out on Wednesday. Videos shared to social media appear to show people jumping or…
UN halts some aid programs in Afghanistan after Taliban’s ban on female NGO workers

On Wednesday, the United Nations announced that it has suspended some of its programs in Afghanistan due to the Taliban’s ban on female NGO workers. The programs were referred to as “time-critical,” especially given the incoming harsh winter weather. UN aid chief Martin Griffiths and other humanitarian groups stated that further activities will likely need…
Russia ready to resume gas supply to Europe via Yamal-Europe gas pipeline

On Sunday, Russia’s Deputy Prime Minister Alexander Novak stated that Russia is preparing to resume gas supplies to Europe via the Yamal-Europe gas pipeline. The gas transport was previously stopped for political reasons, likely arising due to the Ukrainian-Russia conflict Novak stated that the relevancy of the European market in addition with the gas shortage…
Critical Vulnerability in Premium Gift Cards WordPress Plugin Exploited in Attacks

Cybersecurity researchers have identified a critical severity vulnerability that lies in the YITH WooCommerce Gift Cards premium WordPress plugin. According to research, the plug is being exploited in attacks. The plugin has more than 50,000 installations, and allows online merchants to create gift cards for use on their ecommerce stores. The vulnerability was already reported…
Over 50 New CVE Numbering Authorities Announced in 2022

In 2022, more than 50 organizations have been added as a CVE Numbering Authority (CNA), raising the total number of CNA organizations to 260 spanning 35 countries. CNAs have the capability to assign CVE identifiers to vulnerabilities discovered within their own infrastructure, and some can assign CVEs to flaws identified by their researchers in third-party…
BetMGM Confirms Breach as Hackers Offer to Sell Data of 1.5 Million Customers

BetMGM, a MGM Resort company, has suffered from a data breach that exposed personal information such as names, email addresses, postal addresses, phone numbers, dates of birth, hashed Social Security numbers, account identifiers, and transaction information. The online sports betting company confirmed the data breach as hackers threatened to sell a database containing the information,…
Over $3 Billion Stolen In Crypto Heists: Here Are The Eight Biggest

Pretty much everywhere you looked in crypto and blockchain last year there was some glaring problem. But ultimately falling crypto prices or company bankruptcies aren’t the worst problem for digital assets. Beyond the billions of dollars lost from the collapse of the TerraLUNA3 stablecoin and the failures of crypto financial firms CelsiusCEL Network, Voyager Digital…
LastPass attacker stole password vault data, showing Web2’s limitations

Password management service LastPass was hacked in August 2022, and the attacker stole users’ encrypted passwords, according to a Dec. 23 statement from the company. This means that the attacker may be able to crack some website passwords of LastPass users through brute force guessing. LastPass first disclosed the breach in August 2022 but at that…
2023 Should Be the Year of On-Chain User Security

Next year will be a big year for building in “tech crypto.” While the investment side of crypto (aka “money crypto”) struggles to repair grotesque violations of trust in centralized finance (CeFi), tech crypto must focus even more intently on improving user safety on-chain. This issue needs to be addressed now more than ever –…
North Korean Hacking Group Steals Millions Posing as Japanese VCs And Banks

North Korean group BlueNoroff has find a new way to hack into your crypto wallets. Now it resembles banks and Japanese VC firms. This December 27, Kaspersky Lab announced that the North Korean hacking group ‘BlueNoroff’ stole millions of dollars in cryptocurrencies after creating more than 70 fake domains and impersonating banks and venture capital…
Mango Markets Attacker Avraham Eisenberg Arrested, Charged With ‘Market-Manipulation Offenses’

The Department of Justice announced on Tuesday the arrest of Avraham Eisenberg, charging him with “market-manipulation offenses” related to his attack on the Mango Markets crypto exchange. A second filing signed by Assistant U.S. Attorneys Thomas S. Burnett and Noah Solowiejczyk has specifically charged Eisenberg with commodities fraud and commodities manipulation. “Eisenberg engaged in a scheme involving…
Facebook Agrees to Pay $725 Million to Settle Privacy Suit

Meta, Facebook’s parent company, has agreed to pay a $725 million settlement to end a long-running lawsuit that accused the network of allowing third parties to access private data. This includes the notorious Cambridge Analytica issue, one of said third parties accused of accessing users’ private data collected by the platform. The settlement is the…