Connect with us

Biz & IT

A white supremacist website got hacked, airing all its dirty laundry

Published

on

Enlarge / Patriot Front members spray painting in Springfield, IL.

Unicornriot.ninja

Chat messages, images, and videos leaked from the server of a white supremicist group called the Patriot Front purport to show its leader and rank-and-file members conspiring in hate crimes, despite their claims that they were a legitimate political organization.

Patriot Front, or PF, formed in the aftermath of the 2017 Unite the Right rally, a demonstration in Charlottesville, Virginia, that resulted in one death and 35 injuries when a rally attendee rammed his car into a crowd of counter-protesters. PF founder Thomas Rousseau, started the group after an image posted online showed the now-convicted killer, James Alex Fields, Jr., posing with members of Vanguard America shortly before the attack. Vanguard America soon dissolved, and Rousseau rebranded it as PF with the goal of hiding any involvement in violent acts.

Since then, PF has strived to present itself as a group of patriots who are aligned with the ideals and values of the founders who defeated the tyranny of British colonists in the 18th century and paved the way for the United States to be born. In announcing the the formation of PF in 2017, Rousseau wrote:

The new name was carefully chosen, as it serves several purposes. It can help inspire sympathy among those more inclined to fence-sitting, and can be easily justified to our ideology [sic] and worldview. The original American patriots were nothing short of revolutionaries. The word patriot itself comes from the same root as paternal and patriarch. It means loyalty to something intrinsically based in blood.

Turbo cans and rubber roofing cement

But a published report and leaked data the report is based on present a starkly different picture. The chat messages, images, and videos purport to show Rousseau and other PF members discussing the defacing of numerous murals and monuments promoting Black Lives Matter, LGBTQ groups, and other social justice causes.

This chat, for instance, appears to show a PF member discussing the targeting of a civil rights mural in Detroit. When a member asks what the best way is to fully cover up a mural with paint, Rousseau is shown replying “It’s in the stencil guide. Turbo cans.” The stencil guide refers to these instructions provided to PF members showing how to effectively use spray paint and not get caught. The PF member also sent Rousseau pictures taken while scouting the mural.

When a different member discussed whether rubber roofing cement was suitable to covering a George Floyd memorial that had been treated with anti-graffiti clear coating, Rousseau allegedly responded: “Keep me posted as to your research and practice with this substance. Orders will be given out at the event.”

The data dump also appears to document the defacing of a monument in Olympia, Washington.

What it looked like before.
Enlarge / What it looked like before.

Unicorn.ninja

What it looked like after.
Enlarge / What it looked like after.

Unicorn.ninja

The leaked data purports to show a range of other illegal activities the group discussed. They include Rousseau informing members planning a rally in Washington DC that one participant will call 911 from a burner phone and make a false report to authorities.

“He will cite that there is a protest, he sees shields BUT NO WEAPONS, and everyone involved appears to be behaving peacefully, waving and handing out flyers, nonetheless he is a concerned citizen and suggests the police take a look into it to ensure everyone’s civil rights are safe,” Rousseau appeared to write. “He will add that it looks like we just arrived from the metro. This will soften the police up before our big visual contact on the bridge, and provide a little confusion and misinfo that’s within the realm of honest dialogue.”

Attempts to reach Rousseau or other PF members didn’t succeed.

Friday’s published report said that the leak comprised about 400 gigabytes of data and came from a self-hosted instance of RocketChat, an open source chat server that’s similar to Slack and Discord. It’s only the latest example of a hate group being hacked and its private discussions being dumped online. In 2019, the breach of the Iron March website revealed, among other things, that many of its members were members of the US Marines, Navy, Army, and military reserves.

Continue Reading

Biz & IT

Twitter deal leaves Elon Musk with no easy way out

Published

on

Enlarge / This illustration photo taken May 13, 2022, displays Elon Musks Twitter account with a Twitter logo in the background in Los Angeles. – Elon Musk sent mixed messages Friday about his proposed Twitter acquisition, pressuring shares of the microblogging platform amid skepticism on whether the deal will close.
In an early morning tweet, Musk said the $44 billion takeover was “temporarily on hold,” pending questions over the social media company’s estimates of the number of fake accounts or “bots.”
That sent Twitter’s stock plunging 25 percent. (Photo by Chris DELMAS / AFP) (Photo by CHRIS DELMAS/AFP via Getty Images)

Since the financial crisis, corporate lawyers have aspired to build the ultimate ironclad merger contract that keeps buyers with cold feet from backing out.

The “bulletproof” modern deal agreement now faces one of its biggest tests, as Elon Musk, the Tesla boss and richest person in the world, openly entertains the possibility of ditching his $44 billion deal for Twitter.

Musk said in a tweet this week that the “deal cannot move forward” until the social media platform provides detailed data about fake accounts, a request that Twitter seems unlikely to meet. Twitter’s board, meanwhile, has stated its commitment “to completing the transaction on the agreed price and terms as promptly as practicable.”

Simply abandoning the deal is not an option. Musk and Twitter have both signed the merger agreement, which states that “the parties… will use their respective reasonable best efforts to consummate and make effective the transactions contemplated by this agreement.”

With tech stocks falling—dragging down the price of the Tesla shares that form the basis of Musk’s fortune and collateral for a margin loan to buy Twitter—all eyes are on the mercurial billionaire’s next move.

Could Musk walk away for $1 billion?

The agreement includes a $1 billion “reverse termination fee” that Musk would owe if he withdrew from the merger agreement. However, if all other closing conditions are met and the only thing left is for Musk to show up at the closing with his $27.25 billion in equity, Twitter can seek to make Musk close the deal. This legal concept, known as “specific performance,” has become a common feature in leveraged buyouts since the financial crisis.

In 2007 and 2008, leveraged buyouts typically included a reverse termination fee that often allowed a company backing the acquisition to pay a modest 2 to 3 percent of a deal’s value to get out. Sellers believed at the time that private equity groups would follow through and close their transactions in order to maintain their reputations. But some did pull the plug on those agreements, leading to several court fights involving prominent companies such as Cerberus, Blackstone, and Apollo.

Since that era, sellers have implemented much higher termination fees as well as specific performance clauses that effectively require buyers to close. Most recently, a Delaware court in 2021 ordered private equity group Kohlberg & Co to close the buyout of a cake decorations business called DecoPac.

Kohlberg had argued it was allowed out of the deal because the DecoPac business had suffered a “material adverse effect” when the pandemic struck between signing and closing. The court rejected that argument and ruled that DecoPac could force Kohlberg to close—which it did.

Continue Reading

Biz & IT

How we learned to break down barriers to machine learning

Published

on

Dr. Sephus discusses breaking down barriers to machine learning at Ars Frontiers 2022. Click here for transcript.

Welcome to the week after Ars Frontiers! This article is the first in a short series of pieces that will recap each of the day’s talks for the benefit of those who weren’t able to travel to DC for our first conference. We’ll be running one of these every few days for the next couple of weeks, and each one will include an embedded video of the talk (along with a transcript).

For today’s recap, we’re going over our talk with Amazon Web Services tech evangelist Dr. Nashlie Sephus. Our discussion was titled “Breaking Barriers to Machine Learning.”

What barriers?

Dr. Sephus came to AWS via a roundabout path, growing up in Mississippi before eventually joining a tech startup called Partpic. Partpic was an artificial intelligence and machine-learning (AI/ML) company with a neat premise: Users could take photographs of tooling and parts, and the Partpic app would algorithmically analyze the pictures, identify the part, and provide information on what the part was and where to buy more of it. Partpic was acquired by Amazon in 2016, and Dr. Sephus took her machine-learning skills to AWS.

When asked, she identified access as the biggest barrier to the greater use of AI/ML—in a lot of ways, it’s another wrinkle in the old problem of the digital divide. A core component of being able to utilize most common AI/ML tools is having reliable and fast Internet access, and drawing on experience from her background, Dr. Sephus pointed out that a lack of access to technology in primary schools in poorer areas of the country sets kids on a path away from being able to use the kinds of tools we’re talking about.

Furthermore, lack of early access leads to resistance to technology later in life. “You’re talking about a concept that a lot of people think is pretty intimidating,” she explained. “A lot of people are scared. They feel threatened by the technology.”

Un-dividing things

One way of tackling the divide here, in addition to simply increasing access, is changing the way that technologists communicate about complex topics like AI/ML to regular folks. “I understand that, as technologists, a lot of times we just like to build cool stuff, right?” Dr. Sephus said. “We’re not thinking about the longer-term impact, but that’s why it’s so important to have that diversity of thought at the table and those different perspectives.”

Dr. Sephus said that AWS has been hiring sociologists and psychologists to join its tech teams to figure out ways to tackle the digital divide by meeting people where they are rather than forcing them to come to the technology.

Simply reframing complex AI/ML topics in terms of everyday actions can remove barriers. Dr. Sephus explained that one way of doing this is to point out that almost everyone has a cell phone, and when you’re talking to your phone or using facial recognition to unlock it, or when you’re getting recommendations for a movie or for the next song to listen to—these things are all examples of interacting with machine learning. Not everyone groks that, especially technological laypersons, and showing people that these things are driven by AI/ML can be revelatory.

“Meeting them where they are, showing them how these technologies affect them in their everyday lives, and having programming out there in a way that’s very approachable—I think that’s something we should focus on,” she said.

Continue Reading

Biz & IT

2 vulnerabilities with 9.8 severity ratings are under exploit. A 3rd looms

Published

on

Getty Images

Malicious hackers, some believed to be state-backed, are actively exploiting two unrelated vulnerabilities—both with severity ratings of 9.8 out of a possible 10—in hopes of infecting sensitive enterprise networks with backdoors, botnet software, and other forms of malware.

The ongoing attacks target unpatched versions of multiple product lines from VMware and of BIG-IP software from F5, security researchers said. Both vulnerabilities give attackers the ability to remotely execute malicious code or commands that run with unfettered root system privileges. The largely uncoordinated exploits appear to be malicious, as opposed to benign scans that attempt to identify vulnerable servers and quantify their number.

First up: VMware

On April 6, VMware disclosed and patched a remote code execution vulnerability tracked as CVE-2022-22954 and a privilege escalation flaw tracked as CVE-2022-22960. According to an advisory published on Wednesday by the Cybersecurity and Infrastructure Security Agency, “malicious cyber actors were able to reverse engineer the updates to develop an exploit within 48 hours and quickly began exploiting the disclosed vulnerabilities in unpatched devices.”

CISA said the actors were likely part of an advanced persistent threat, a term for sophisticated and well-financed hacker groups typically backed by a nation-state. Once the hackers have compromised a device, they use their root access to install a webshell known as Dingo J-spy on the networks of at least three organizations.

“According to trusted third-party reporting, threat actors may chain these vulnerabilities. At one compromised organization, on or around April 12, 2022, an unauthenticated actor with network access to the web interface leveraged CVE-2022-22954 to execute an arbitrary shell command as a VMware user,” Wednesday’s advisory stated. “The actor then exploited CVE-2022-22960 to escalate the user’s privileges to root. With root access, the actor could wipe logs, escalate permissions, and move laterally to other systems.”

Independent security researcher Troy Mursch said in a direct message that exploits he’s captured in a honeypot have included payloads for botnet software, webshells, and cryptominers. CISA’s advisory came the same day VMware disclosed and patched two new vulnerabilities. One of the vulnerabilities, CVE-2022-22972, also carries a severity rating of—you guessed it—9.8. The other one, CVE-2022-22973, is rated 7.8.

Given the exploits already underway for the VMware vulnerabilities fixed last month, CISA said it “expects malicious cyber actors to quickly develop a capability to exploit newly released vulnerabilities CVE-2022-22972 and CVE-2022-22973 in the same impacted VMware products.

BIG-IP also under fire

Meanwhile, enterprise networks are also under attack from hackers exploiting CVE-2022-1388, an unrelated vulnerability with a 9.8 severity rating found in BIG-IP, a software package from F5. Nine days ago, the company disclosed and patched the vulnerability, which hackers can exploit to execute commands that run with root system privileges. The scope and magnitude of the vulnerability prompted marvel and shock in some security circles and earned it a high severity rating.

Within a few days, exploit code became publicly available and almost immediately after that, researchers reported ​​exploit attempts. It wasn’t clear then if blackhats or whitehats carried out the activity.

In more recent days, however, researchers captured thousands of malicious requests that demonstrate a significant portion of the exploits are used for nefarious purposes. In an email, researchers from security firm Greynoise wrote:

Given that the requests involving this exploit require a POST request and result in an unauthenticated command shell on the F5 Big-IP device, we have classified actors using this exploit as malicious. We have observed actors using this exploit through anonymity services such as VPNs or TOR exit nodes in addition to known internet VPS providers.

We expect actors attempting to find vulnerable devices to utilize non-invasive techniques that do not involve a POST request or result in a command shell, which are catalogued in our tag for F5 Big-IP crawlers: https://viz.greynoise.io/tag/f5-big-ip-crawler. This crawler tag did experience a rise in traffic correlated with the release of CVE-2022-1388.

Mursch said that the BIG-IP exploits attempt to install the same trio of webshells, malware for performing distributed denial-of-service attacks, and cryptominers seen in the attacks on unpatched VMware machines. The image below, for instance, shows an attack that attempts to install widely recognized DDoS malware.

Troy Mursch

The following three images show hackers exploiting the vulnerability to execute commands that fish for encryption keys and other types of sensitive data stored on a compromised server.

Troy Mursch

Troy Mursch

Troy Mursch

Given the threat posed by ransomware and nation-state hacking campaigns like the ones used against customers of SolarWinds and Microsoft, the potential damage from these vulnerabilities is substantial. Administrators should prioritize investigating these vulnerabilities on their networks and act accordingly. Advice and guidance from CISA, VMware, and F5 are here,
here, here, and here.

Continue Reading

Trending