China targeted and might have held for months access to the infrastructure used to do wiretaps on the AT&T and Verizon networks.

This is a huge "told you so" moment for the cryptographic community that has been saying that such infrastructure does present a huge risk to national security. China reportedly used this capability for intelligence collection, obviously without a warrant ...

https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b?st=C5ywbp&reflink=desktopwebshare_permalink

Revisiting 2 of the 5 docs from the Snowden leaks that mention 'cookies'.

GCHQ 2009 on 'target detection identifiers':
https://snowden.glendon.yorku.ca/items/show/188/

NSA 2011 on 'selector types':
https://snowden.glendon.yorku.ca/items/show/172

...featuring cookie/browser IDs from Google/Doubleclick, Facebook, Microsoft and many more.

It's breathtaking how the surveillance marketing industry has still managed to claim for many years that unique personal identifiers processed in the web browser are 'anonymous', and sometimes still does.

Fantastic work by @amlw - xzbot

Exploration of the xz backdoor (CVE-2024-3094). Includes the following:

* honeypot: fake vulnerable server to detect exploit attempts

* ed448 patch: patch liblzma.so to use our own ED448 public key

* backdoor format: format of the backdoor payload

* backdoor demo: cli to trigger the RCE assuming knowledge of the ED448 private key

https://github.com/amlweems/xzbot