Hello and welcome to the regular networking and cybersecurity newsletter brought to you every weekend by Qrator Labs! This time we are looking at the articles and materials published between August 10 and 16, 2020.
"The FBI and NSA have issued a joint report warning that Russian state hackers are using a previously unknown piece of Linux malware to stealthily infiltrate sensitive networks, steal confidential information, and execute malicious commands." - ArsTechnica.
"Per the two agencies, Drovorub is a multi-component system that comes with an implant, a kernel module rootkit, a file transfer tool, a port-forwarding module, and a command-and-control (C2) server." - ZDNet.
And then there's a great story from Binary Defense on EmoCrash: Exploiting A Vulnerability In Emotet Malware For Defense
"For six months, security researchers have secretly distributed an Emotet vaccine across the world." - ZDNet.
Researchers from Ruhr University Bochum and NYU Abu Dhabi found a way to eavesdrop encrypted LTE calls with ReVoLTE: "Call Me Maybe"
"Hackers can eavesdrop on mobile calls with $7,000 worth of equipment." - ArsTechnica.
"There are multiple articles that recommend to disable TCP extensions, such as timestamps or selective acknowledgments (SACK) for various “performance tuning” or “security” reasons.
This article provides background on what these extensions do, why they are enabled by default, how they relate to one another and why it is normally a bad idea to turn them off." - Fedora Magazine.
">23% of the Tor network’s exit capacity has been attacking Tor users".
"How the security features in state-of-the-art TLS inspection solutions can be exploited for covert data exfiltration."
"We present “Machine Function Splitter”, a codegen optimization pass which splits functions into hot and cold parts. This pass leverages the basic block sections feature recently introduced in LLVM from the Propeller project. The pass targets functions with profile coverage, identifies cold blocks and moves them to a separate section. The linker groups all cold blocks across functions together, decreasing fragmentation and improving icache and itlb utilization. Our experiments show >2% performance improvement on clang bootstrap, ~1% improvement on Google workloads and 1.6% mean performance improvement on SPEC IntRate 2017."
"Ookla tests aren't showing the gigabit speeds SpaceX teased, but it's early."
"Criminals use so-called Russian, encrypted, or white SIMs to change their phone number, add voice manipulation to their calls, and try to stay ahead of law enforcement."
Academic paper of the week - Zero Downtime Release: Disruption-free Load Balancing of a Multi-Billion User Website
Thanks for reading and sharing!
For feedback, please write to us at firstname.lastname@example.org.