1. Years ago, I did a lot of computer-forensic intensive federal litigation. During that time, I had to become knowledgeable in a number of areas related to data and the internet. I started using tools like the tools Solarwind.com pushes. Some thoughts in this attack.
2. Many software companies write their code to make permanent connections to your computer ports. One that irks me is @nvidia but @zoom_us quickly took over 1st place. I only allow connections that I authorize and limit it to few large cloud firms but I'm still not a cloud fan.
3. If you run a Windows based system and are unaware of the these connections you would be shocked to see just how many there are. I guess they justify it by the fiction they need to park on your ports and be alerted to the need to update your system. It's absurd but If I were
4. someone involved in malicious activity I would hitchhike a ride on these connections. @Akamai used to be a big problem but not so much now. I won't name the tools I use but there are off-the-shelf programs that allow you to view the connections.
5. I don't know how the Russians did it but these vulnerabilities I have been addressing for over a decade are where I would look first. And @zoom_us @Skype and other programs that give communications related port access and are set to establish permanent connections are
6. where I would start. Even if my suspicions are not born-out, these connections are still not necessary and are IMO are a source of possible exploitation. @Microsoft @msftsecurity should issue a patch that allows you to close all these ports without going through
7. the tedious process I go through every time a do a Crazy Ivan and reboot to clear out my baffles. 😎@INDOPACOM @CISAgov @CYBERCOM_DIRNSA
• • •
Missing some Tweet in this thread? You can try to
force a refresh
