Share this page!

J. A. Guerrero-Saade Profile picture
Twitter logo
22 Jul, 4 tweets, 1 min read
The new cybertruthers have come out the play.
Please beware the false parity of 'experts'. Random technical ppl aren't sources on difficult threat intel topics. Open speculation isn't substantiation for denials ('More details plz'). And neither is technical solipsism ('Everything can be faked! I'd do better than this!').
This uncoordinated flailing is being used to substantiate state interests that would rather not have the spotlight shined on them. We'll all do well to display sound judgement.
For a relevant discussion from half a decade ago-

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with J. A. Guerrero-Saade

J. A. Guerrero-Saade Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @juanandres_gs

J. A. Guerrero-Saade Profile picture
22 Jul
Alright, let's add some substance to this Pegasus discussion. Contrary to what you might read, research into NSO has been going on for years and has involved a lot of great research groups (@citizenlab, @kaspersky, @Lookout, to name a few). It has also included leaks.
Folks are speculating about how we might know about the targets of Pegasus customers. NSO simultaneously claims that they don't know their customers targets but at the same time they know that none of the @AmnestyTech infections are real. Two obviously incompatible statements.
Assuming NSO doesn't have access to their customers targets, a list of targets of interest would have to come from a structural fault in the agent/exploit delivery infrastructure that NSO uses. We have a high-level view of how that system is architected.
Read 17 tweets
J. A. Guerrero-Saade Profile picture
18 Jul
As to NSO’s blanket denial of having any access to how their customers use their software, that’s not entirely true by design —they manage the exploit delivery infrastructure for their clients. This is a hard-earned lesson from the HackingTeam days—
HT had a lot of woes attempting to idiotproof their payload building and exploit delivery process. The former was characterized by a prompt urging operators NOT to upload to VT (aimed primarily at dim Saudi operators). Exploits were handled more carefully via support portal—
The support portal required a backdoor created with the HT masternode and a lure document of the customer’s choosing. HT would create the exploit-laced file and host it via a one-time link that the operators could deliver in the method of their choosing.
Read 5 tweets
J. A. Guerrero-Saade Profile picture
18 Jul
Unbelievable work by @AmnestyTech, done in spite of @Apple’s reticence to provide means to verify the integrity of iOS devices. What’s it going to take for Apple to stop burying its head in the sand?
These remarks on the limitations when inspecting iOS devices should give us pause… there’s a mistaken belief that privacy is protected by limiting checks on system integrity and correlation of anomalies. What privacy is protected in these cases? (@tim_cook @radian)
I love Apple products. Wonderful things are regularly done under the hood to increase the cost of attack. But it’s clearly not enough to tinker with security engineering alone. Plenty of unscrupulous actors are finding it affordable and we can’t even tell how big that iceberg is.
Read 5 tweets
J. A. Guerrero-Saade Profile picture
31 Dec 19
Ok, I have to admit this @Apple vs. @CorelliumHQ business just doesn’t sit right with me. Let me @ @tim_cook and pretend to have some meaningful engagement regarding Apple’s larger security dilemma. #Thread
Everyone knows I’m a huge Apple fanboy. Until the cheese grater Mac Pro came out, I more or less had one of every apple product in my house (with some wiggle room). While I may gripe about missing function keys, there’s no system I’d rather use than MacOS and iOS.
I’ve also, at diverse points in my career, had the privilege to report ongoing APT campaigns directly to Apple alongside colleagues (h/t @craiu) and was treated kindly by folks invested in securing the Apple ecosystem within the means available to them.
Read 14 tweets
J. A. Guerrero-Saade Profile picture
29 Oct 19
Now that we’ve had some time to reflect, let’s break down the @NCSC & @NSAGov Turla advisory #thread ncsc.gov.uk/news/turla-gro…
1st point is that we (private sector threat intel researchers) mistook the provenance of Neuron and Nautilus. NCSC’s previous advisory denounced the use of both tools alongside Turla’s staple rootkit and we assumed new tools from the Turla devs but it seems they’d been stolen. Image
Keep in mind that the advisory is hinting at some dev access, some infrastructure access, but perhaps not complete access to Iran’s full operational stack. Turla first deploys the tool to their rootkit victims for testing and further functionality. Image
Read 17 tweets
J. A. Guerrero-Saade Profile picture
26 Mar 19
Those non-existent norms were originally shattered by Flame subverting the actual Windows Update mechanism via an unheard of md5 collision to impersonate signing certs (implemented in its GADGET module).
For the curious:
@alexsotirov 's slides on the MD5 collision in Flame: speakerdeck.com/asotirov/analy…
And Kaspersky's analysis of the GADGET module:
securelist.com/gadget-in-the-…
Flame really doesn't get the credit it deserves as the first public harbinger of so many trends we'd come to know all too well in cyberespionage over the following 7 years.
Read 5 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!

Like this author's thread?

Get emails when @juanandres_gs has new unrolls!

Check out other threads from @juanandres_gs!

Read all threads by @juanandres_gs

:(