Jonas L on Twitter: "https://t.co/unZffFbJXR there is a new trustlet that is used for a cross vm pki hierarchy"

Country	Code	For customers of
United States	40404	(any)
Canada	21212	(any)
United Kingdom	86444	Vodafone, Orange, 3, O2
Brazil	40404	Nextel, TIM
Haiti	40404	Digicel, Voila
Ireland	51210	Vodafone, O2
India	53000	Bharti Airtel, Videocon, Reliance
Indonesia	89887	AXIS, 3, Telkomsel, Indosat, XL Axiata
Italy	4880804	Wind
3424486444	Vodafone
» See SMS short codes for other countries

Sometimes there was invisible cpu devours, and what appeared to be something invisible scanning my files. My pcr4 didnt change even when entering repair mode... Now I finally identified the reason

1 reply 2 retweets 21 likes

Show this thread

Jonas L‏ @jonasLyk Aug 30

Jonas L Retweeted Jonas L

This also explains https://twitter.com/jonasLyk/status/1430311791834370055 …https://twitter.com/jonasLyk/status/1429789146571288580 …

Jonas L added,

Jonas L @jonasLyk

Have you heard about container os? Neither had I- but for some reason its the OS installed on my NUC. It looks like this: pic.twitter.com/HIwGdGeZ7C

Show this thread

1 reply 2 retweets 16 likes

Show this thread

Jonas L‏ @jonasLyk Aug 30

The name of the bootkit is secured core! That is apperently how it works: "Secured-core PCs have both VBS and this secure monitoring agent turned on by default. On the technical side, they’ve added quite a few things into the Hysolate product. For Microsoft Azure admins",

1 reply 6 retweets 23 likes

Show this thread

Jonas L‏ @jonasLyk Aug 30

Hysolate has developed a baked-in higher privileged VM to access Azure in a locked down manner, while a second VM allows for less restrictive use. For networking, they’ve added what they call “virtual Wi-Fi” and host-based VPN.

1 reply 1 retweet 17 likes

Show this thread

Jonas L‏ @jonasLyk Aug 30

Tal explained that for virtual Wi-Fi, when a laptop goes to connect to Wi-Fi, behind the scenes they verify the network to ensure it can be trusted. Until it’s considered a trusted connection, the higher privileged VM cannot access the internet

1 reply 2 retweets 14 likes

Show this thread

Jonas L‏ @jonasLyk Aug 30

The host-based VPN is focused around requiring a VPN for the higher privileged VM if it needs to connect to the internet. For the host-based VPN, Hysolate can run VPN authentication in the hypervisor VM so that the user cannot tamper with the VPN and credentials aren’t exposed.

1 reply 3 retweets 13 likes

Show this thread

Jonas L‏ @jonasLyk Aug 30

This uefi enviroment establishes a vmbus where a complete vm and filesystem can boot of. The following patent describe it: https://uspto.report/patent/app/20210182078 …pic.twitter.com/MQS9x9Q5r6

2 replies 3 retweets 15 likes

Show this thread

Jonas L‏ @jonasLyk Aug 30

This enable a vm to boot up like this:pic.twitter.com/YbgNboZnPI

1 reply 1 retweet 14 likes

Show this thread

Jonas L‏ @jonasLyk Aug 30

The same enviroment used for WDAG/Sandbox. I havent figured out exactly how the boot process works-or maybe I have, I just need to verify.

1 reply 1 retweet 14 likes

Show this thread

Jonas L‏ @jonasLyk Aug 30

So, in the "bootos" we find this: This indicate that there is at minimum capability to deploy shielded VMs. I think they would be deployed using the new TPM 2.0 deployment method.pic.twitter.com/GMGpfMrB5m