madsys

Phrack author, member of Team Hardcore Matrix
UAP Researcher

[madsys @madsys1]

3/ when programs are launched from a trusted medium;
3. Unlike Volatility’s offline image analysis, it performs real-time online inspection without requiring a system shutdown for forensics. It fully covers the “online but not pre-installed” gap in the “online-offline” spectrum.

[madsys @madsys1]

🚨Huge ALIRT (ex-AIRT) upgrade! Detect Linux kernel rootkits.
✅Zero signatures (pairs w/ rkhunter)
✅Post-incident: finds hidden modules even if logs wiped (vs LKRG)
✅Online IR: no shutdown needed (vs Volatility)
#InfoSec #Linux #Rootkit #backdoor https://t.co/WjWI9Sin2s

[madsys @madsys1]

2/ 1. No signatures required; complements signature-based tools (such as the rkhunter family);
2. Unlike the “proactive, resident” approach of LKRG/Tracee, it focuses on post-incident response: even after an attacker has wiped logs and hidden modules, traces can still be detected

[madsys @madsys1]

1/ ALIRT(Advanced Linux incident response toolkit, formerly known as AIRT) is a Linux-based suite for incident response, specifically designed to detect kernel backdoors on the Linux box.
Compared to other kernel-based malware detection systems, ALIRT occupies a unique position:

[madsys @madsys1]

@UAPWatchers Awesome! hope the document can be made public so that more people can see it

[madsys @madsys1]

@cryshlee @ArtL7 @LuAngeles @StevenCambian @LuReviews13 @nbtboj This analysis is very convincing

[madsys @madsys1]

@MickWest Optical stabilization modules are usually available on reconnaissance satellites, but not necessarily with stabilization algorithms, but are added by default for ground processing. There are different stabilization levels for different scenarios

[madsys @madsys1]

key re-signing and capsule update re-signing to demonstrate the seriousness of such supply chain threats. the video: https://t.co/DrfPNv1yqu. Facts have proven that the supply chain threat posed by the MSI data breach is real, serious, and actionable. 3/3

[madsys @madsys1]

In March 2023, the Money Message ransomware gang leaked some internal information of MSI, including sensitive data such as BootGuard private keys. The BootGuard security mechanism is an important component of Intel RoT, and the leakage of its private key indicates that 1/3

[madsys @madsys1]

BootGuard, this major security mechanism, will be bypassed for some models of devices.
After in-depth research and rewriting some missing internal vendor tools, the HardcoreMatrix team successfully implemented a complete attack chain (Post exploit) such as Boot Guard private 2/3

[Dominic White 👾 @singe]

This is an excellent deep dive into request smuggling.

[Samuel Groß @5aelo]

https://t.co/lo7rcvoEoO wohoo!

[Evan Kohlmann @IntelTweet]

Reuters: "Putin says Russia would accept conditional handover of cyber criminals to U.S." https://t.co/jFRCcRrtyE

[Zaolin @_zaolin_]

Interested in transparent #TPM measurements at firmware level with @TrustedComputin technology?! Take a peek at @coreboot_org firmware with the new trusted boot integration (https://t.co/CeoTiy1V4T). Feel free to get in contact with us via @9eSec

[madsys @madsys1]

@ChineseWSJ 又要印这么多钱 中国取消了锚定汇率，美国这是要大通胀

[Mark Ermolov @_markel___]

It seems on newest Big Core platforms (Cannon Lake+) CSME has an access to CPU complex's devices via IOSF-SB. It's necessary to figure out what it is doing there...

[madsys @madsys1]

@bbcchinese 世界会记住这个名字：袁隆平。
袁老为全人类做出了贡献，重于泰山
袁老一路走好！🙏🏻🙏🏻🙏🏻

[Alex Ionescu @aionescu]

Hmm, the original 2009 Intel patent on SGX covered "XuCode" (eXtended MicroCode -- Intel's version of PALcode) and MCHECK in pretty good detail (they both called it an "uVMM", "extended microcode", and "XuCode").
Why the announcment today?
https://t.co/UOwMNel4QX

[madsys @madsys1]

RT @wikileaks Simple and sleek app to browse, search and read all released cables -- wikileaks wlfind wlmir http://t.co/P9MOCPi