Over the years on Twitter you might have seen some infamous Twitter fails where someone who’s working for smartphone company not named Apple, or shilling for said smartphone company not named Apple has Tweeted from an iPhone. Take this example caught by YouTuber MKBHD of Huawei doing all sorts of things from iPhones. Stuff like that is funny to see, but those days are apparently over as Elon Musk has put an end to this:
I’m just spitballing here. But maybe he’s doing this to make Twitter a bit more advertiser friendly? As in he’s taken away the ability for smartphone companies to shoot themselves in the foot? Or maybe he’s doing this as a distraction from the world watching him act like an 8 year old by pushing every button in Twitter HQ to see what happens with disastrous results? Who knows? But it is a curious move because given how messed up Twitter is at present, you’d think he’d have bigger issues to deal with.
Speaking of bigger issues. One of those issues is the fact that advertisers have been recommended by ad agencies to pause advertising on the platform. That directly affects Musk’s bottom line as Twitter relies heavily on advertising revenue. This makes this CNBC story curious. Which is that SpaceX has done a massive ad buy for the Starlink Internet service:
The campaign will promote the SpaceX-owned and -operated satellite internet service called Starlink on Twitter in Spain and Australia, according to internal records from the social media business viewed by CNBC.
The ad campaign SpaceX is buying to promote Starlink is called a Twitter “takeover.” When a company buys one of these packages, they typically spend upwards of $250,000 to put their brand on top of the main Twitter timeline for a full day, according to one current and one former Twitter employee who asked to remain unnamed because they were not authorized to speak on behalf of the company.
Users should see Starlink brand messaging for the first three times that they open the Twitter app on the day or days of the planned takeover campaign in Australia and in Spain. The campaign, which was purchased in the last week, was slated to run in coming days first in Australia then in Spain.
SpaceX has not typically purchased large advertising packages from Twitter, the current and former employees said.
Hours after this story was first published, Musk wrote in a tweet: “SpaceX Starlink bought a tiny – not large – ad package to test effectiveness of Twitter advertising in Australia & Spain. Did same for FB/Insta/Google.”
According to internal documents viewed by CNBC, SpaceX has spent more than $160,000 on the Twitter ad campaign for Starlink in Australia and Spain so far.
Am I the only one that thinks that this is a little “sus“? The Internet of course found this where Musk says he doesn’t buy adversting:
And based on this Tweet, he has an iPhone. But that’s besides the point. What is relevant to this story is the fact that he now says this when called out for being a hypocrite:
I’m sure if that’s true, he can show proof of his ad purchases on Facebook, Instagram, and Google. But my thinking is that it’s not going to happen as it’s not true. But Musk is free to prove yours truly and the rest of the Internet wrong at any time. My thinking is that he’s doing this as part of a larger plan to entice advertisers back onto the platform. It will be interesting to see if this ad buy, regardless has any effect on that. My thinking is that it won’t as the problem that advertisers have with Twitter is Elon Musk.
Ukrainian CERT Discloses New Wiper Malware
Posted in Commentary with tags Security on November 14, 2022 by itnerdThe Ukrainian Computer Emergency Response Team (CERT) has issued a statement on a new attack campaign by suspected Russian threat actors which are compromised victims’ VPN accounts to access and encrypt networked resources. More details are available here:
Initial compromise is achieved by tricking victims into downloading “Advanced IP Scanner” software which actually contains Vidar malware. CERTU-UA believes this was achieved by initial access brokers (IABs) working for the Russians.
“It should be noted that the Vidar stealer, among other things, steals Telegram session data, which, in the absence of configured two-factor authentication and a passcode, allows unauthorized access to the victim’s account,” the statement continued.
“As it turned out, the victim’s Telegram was used to transfer VPN connection configuration files (including certificates and authentication data) to users. Given the lack of two-factor authentication when establishing a VPN connection, attackers were able to gain an unauthorized connection to the corporate network.”
Once inside, attackers conducted reconnaissance work using the Netscan tool and then launched Cobalt Strike Beacon, exfiltrating data using the Rclone program. There are also signs of the threat actors using Anydesk and Ngrok at this stage.
It’s unclear how widespread the campaign was, although “several” Ukrainian organizations are thought to have been impacted since spring 2022.
Most pointedly, CERT-UA confirmed that the end goal is not to generate profits from a ransom but to destroy victim environments.
Dr. Darren Williams, CEO and Founder, BlackFog had this comment:
“This is another great example of a clever phishing technique to disguise the attack vector inside another application. These are very difficult to detect with existing solutions because of the mechanism of action that steals VPN session information to ultimately exfiltrate data from the device. VPN’s have been routinely targeted in the past because they contain a treasure trove of valuable data for extortion and a centralized repository of data from the victim and the organization. Once the attacker has gained access it is very easy to spread laterally within the organization. This emphasizes why companies need to not only provide defense strategies but also proactive ones that protect an organization and its devices from unauthorized data exfiltration.”
This is clearly an attack meant to hurt Ukraine. Hopefully they are doing their best to make sure that attacks like this are not successful going forward. I say that because while they are winning on the the battlefield, the battlefield has changed to being cyberspace. And for the rest of us, I would say that 2FA for your VPN connections is a must to stop this sort of thing from happening to you.
Leave a comment »