Pwn All The Things
If you're interested in the technical aspects of #DNCHack, implant and attribution, here's @Crowdstrike's analysis: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ …
For some reason @CrowdStrike listing IOCs as SHA256, when industry standard is SHA1. Makes it harder to search for.pic.twitter.com/p2BQY92hXz
-
-
.
@CrowdStrike Also for some reason clearly have, but aren't sharing the binaries. Seems optimized to stop people checking their results. -
Btw, if you want to piggyback onto COSYBEAR, its startup module downloaded w/ fixed AES/IV dl-ed over HTTP (port80)pic.twitter.com/HejStU8MWi
-
-
-
@pwnallthethings@CrowdStrike We prefer to use secure hash fns. Happy to provide SHA1/MD5 equivalents but be careful of collisions -
@DAlperovitch@pwnallthethings why not both? . plus collision of Both is strong indicator of state actor (if at all possible) -
@4Dgifts@pwnallthethings We uploaded malware to VirusTotal so researchers can do their own analysis. Happy to share those with others
-
-
@pwnallthethings@CrowdStrike There isn't an industry standard and SHA1 prob worst (and only really used by Asian vendors for some reason)
Dmitri Alperovitch
iarce
InstaCyber
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.