CIVHUB

1683 bookmarks
Newest
Elon Musk's DOGE aims to hack the IRS and create a single API for easy access to U.S. taxpayer data - SiliconANGLE
Elon Musk's DOGE aims to hack the IRS and create a single API for easy access to U.S. taxpayer data - SiliconANGLE
Wired cites its sources as saying that Corcos wants the IRS to pause all of its ongoing engineering work and cancel efforts to modernize its existing computer systems. On March 1, The Washington Post reported that Corcos had personally intervened, ordering the IRS to remove restrictions it had placed on Kliger’s access to its systems, and shortly after proposed an agreement that would enable IRS data to be shared across multiple government agencies. However, a March 14 letter from Senator Ron Wyden to the IRS and others suggests that this request was declined. In the letter, Wyden praised the “rightful rejection” of Corcos’ request, and goes on to cite a second Post story that claims Trump administration officials are trying to access IRS data to aid in their immigration crackdown, as well as their government efficiency efforts. With regards to the hackathon, Corcos is believed to be intent on creating “one API to rule them all,” and ensure that IRS data can be easily accessed via cloud platforms, Wired reported.
The API would first be applied to the IRS’ mainframes, and would later be expanded to its other internal systems, which are spread across dozens of on-premises data centers and compartmentalized cloud environments. At present, access to these systems is highly restricted, and IRS workers are only given permission to do so on a “need-to-know” basis.
DOGE wants the API to be built within just 30 days, but according to one IRS employee who spoke to Wired, that deadline is “not technically possible” and would likely “cripple” the IRS’s systems.
Jan 2025 start of investigation OPM emails articleJan 2025 start of investigation OPM emails article#doge#timeline#irs
·siliconangle.com·
Elon Musk's DOGE aims to hack the IRS and create a single API for easy access to U.S. taxpayer data - SiliconANGLE
Top oversight Dem files resolution to demand answers from DOGE on AI use
Top oversight Dem files resolution to demand answers from DOGE on AI use
The resolution of inquiry from Rep. Melanie Stansbury, D-N.M., would make the White House provide Congress with further information about DOGE’s use of federal data and AI.
Stansbury’s resolution would compel the White House to provide Congress with “a copy of any document, record, report, memorandum, correspondence, or other communication” related to DOGE’s use of collected data in AI systems. This information would have to include, in part, details about any AI tools deployed at federal agencies at the direction of Musk or DOGE personnel, “including any associated System of Records Notice, Privacy Impact Assessment, or Authorization to Operate.
Additionally, the resolution would mandate that the administration detail the “federal data and sources of federal data fed into such AI technology, including any reference as to whether such data contains the sensitive, personally identifiable information of American citizens and any data sets or sources downloaded or manipulated by employees of DOGE.”
“The American people demand to know why Elon Musk and DOGE are hacking our private and sensitive data and what they are doing with it,” she added. “This includes Social Security, IRS, Treasury, and other highly sensitive data.”
How are these changes affecting you? Share your experience with us: Eric Katz: ekatz@govexec.com, Signal: erickatz.28 Sean Michael Newhouse: snewhouse@govexec.com, Signal: seanthenewsboy.45 Erich Wagner: ewagner@govexec.com; Signal: ewagner.47
DOGE TimelineDOGE Timeline#doge
·govexec.com·
Top oversight Dem files resolution to demand answers from DOGE on AI use
FamousSparrow: A suspicious hotel guest important
FamousSparrow: A suspicious hotel guest important
Yet another APT group that exploited the ProxyLogon vulnerability in March 2021
The connections could be either through a proxy or not, and they connect to the C&C server over port 443 (HTTPS). So, the communication should be encrypted using TLS. During the first attempt to contact the C&C server, SparrowDoor checks whether a connection can be established without using a proxy, and if it can’t, then the data is sent through a proxy.
SparrowDoor collects the username, computername, RDP session ID, and drive types in the system and sends this data to the C&C server.
SparrowDoor communicates with the C&C server using the HTTPS protocol.
SparrowDoor exfiltrates data over its C&C channel.
Feb-March 2025 China IP Treasury Certs#important#treasury#salttyphoon
·welivesecurity.com·
FamousSparrow: A suspicious hotel guest important
Use cURL with SNI (Server Name Indication)
Use cURL with SNI (Server Name Indication)
Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) protocol that allows a client to specify the hostname it is trying to connect to at the start of the handshaking process.
You can also use the --resolve option to set the SNI hostname explicitly when making the request: curl --resolve example.com:443:192.0.2.1 https://example.com Copy
u can also use the --resolve option to set the SNI hostname explicitly when making the request: curl --resolve example.com:443:192.0.2.1 https://example.com
Feb-March 2025 China IP Treasury Certs#treasury#cert#important
·w3docs.com·
Use cURL with SNI (Server Name Indication)
Strengthening America’s Resilience Against the PRC Cyber Threats | CISA
Strengthening America’s Resilience Against the PRC Cyber Threats | CISA
While PRC cyber actors have attempted to evade detection by using living-off-the-land methods—hiding their activity within the native processes of computer operating systems—our world class team of threat hunters have detected them and assisted critical infrastructure partners in evicting them.
Feb-March 2025 China IP Treasury Certs#important#treasury#cert#salttyphoon
·cisa.gov·
Strengthening America’s Resilience Against the PRC Cyber Threats | CISA
Weathering the storm: In the midst of a Typhoon
Weathering the storm: In the midst of a Typhoon
Cisco Talos has been closely monitoring reports of widespread intrusion activity against several major U.S. telecommunications companies, by a threat actor dubbed Salt Typhoon. This blog highlights our observations on this campaign and identifies recommendations for detection and prevention.
Feb-March 2025 China IP Treasury Certs#important#treasury#cert#salttyphoon
·blog.talosintelligence.com·
Weathering the storm: In the midst of a Typhoon
socat(1): Multipurpose relay - Linux man page
socat(1): Multipurpose relay - Linux man page
Socat is a command line based utility that establishes two bidirectional byte streams and transfers data between them. Because the streams can be ...
E.g., TCP4 requires a server specification (name or address), and a port specification (number or service name).
wo single addresses can be combined with dq!!dq to form a dual type address for one channel. Here, the first address is used by socat for reading data, and the second address for writing data.
CWIP-SENDTO:<host>:<protocol>
Opens a raw IP socket. Depending on host specification or option pf, IP protocol version 4 or 6 is used. It uses <protocol> to send packets to <host> [IP address] and receives packets from host, ignores packets from other hosts. Protocol 255 uses the raw socket with the IP header being part of the data. Option groups: FD,SOCKET,IP4,IP6 Useful options: pf, ttl
IP-RECVFROM
CWOPENSSL:<host>:<port> Tries to establish a SSL connection to <port> [TCP service] on <host> [IP address] using TCP/IP version 4 or 6 depending on address specification, name resolution, or option pf. NOTE: The server certificate is only checked for validity against cafile or capath, but not for match with the servercqs name or its IP address! Option groups: FD,SOCKET,IP4,IP6,TCP,OPENSSL,RETRY Useful options: cipher, method, verify, cafile, capath, certificate, key, compress, bind, pf, connect-timeout, sourceport, retry See also: OPENSSL-LISTEN, TCP
CWresolve
CWfork After establishing a connection, handles its channel in a child process and keeps the parent process attempting to produce more connections, either by listening or by connecting in a loop (example).
SSL-LISTEN forks before the SSL handshake, while SSL-CONNECT forks afterwards
starts a forwarder that accepts connections on port 2022, and directs them through the proxy daemon listening on port 3128 (proxyport) on host proxy, using the CONNECT method, where they are authenticated as dquserdq with dqpassdq (proxyauth). The proxy should establish connections to host www.domain.org on port 22 then.
Feb-March 2025 China IP Treasury Certs#important#treasury#cert
·linux.die.net·
socat(1): Multipurpose relay - Linux man page
Treasury Sanctions China-based Hacker Involved in the Compromise of Sensitive U.S. Victim Networks
Treasury Sanctions China-based Hacker Involved in the Compromise of Sensitive U.S. Victim Networks
WASHINGTON — Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) is designating Zhou Shuai, a Shanghai-based malicious cyber actor and data broker, and his company, Shanghai Heiying Information Technology Company, Limited (Shanghai Heiying). In collaboration with another malicious cyber actor, U.S.-sanctioned Yin Kecheng, Zhou Shuai illegally acquired, brokered, and sold data from highly sensitive U.S. critical infrastructure networks. Malicious cyber actors, particularly those operating in China, continue to be one of the greatest and most persistent threats to U.S. national security, as highlighted in the Office of the Director of National Intelligence’s most recent Annual Threat Assessment.“Today’s action underscores our resolve to hold accountable malicious cyber actors like Zhou who continue to target U.S. government systems, the data of U.S. companies, and our citizens,” said Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence Bradley T. Smith. “The United States is committed to disrupting all aspects of this criminal ecosystem leveraging all our available tools and authorities.”Today’s designation follows a series of recent Treasury designations aimed at combatting increasingly dangerous cyber activity committed by cybercriminals in China. This includes the January 17, 2025 designation of Yin Kecheng and Sichuan Juxinhe Network Technology Company, Ltd. for their roles in the recent Department of the Treasury network compromise and the Salt Typhoon cyber group, respectively; the January 3, 2025 designation of Integrity Technology Group, Inc. for its role in the Flax Typhoon intrusion set; and the December 10, 2024 designation of Sichuan Silence Information Technology Company, Ltd. and one of its employees for their role in compromising firewalls.Today, the Department of Justice is also unsealing indictments charging Yin Kecheng and Zhou Shuai based on their malicious cyber activity. Furthermore, the Department of State is announcing a Transnational Organized Crime Rewards Program offer of up to $2,000,000 for information leading to the arrest and/or conviction of Yin Kecheng or Zhou Shuai. Zhou shuai: chinese Hacker and data brokerSince at least 2018, Zhou Shuai has acted as a data broker, selling illegally exfiltrated data and access to compromised computer networks. At least some of this data was acquired by known China-backed malicious cyber actor and former Shanghai Heiying employee Yin Kecheng.  Yin Kecheng, who was sanctioned by OFAC on January 17, 2025, was involved in the 2024 compromise of the Department of the Treasury’s network. Notable U.S. victims of Yin Kecheng and Zhou Shuai’s partnership include technology companies, a defense industrial base contractor, a communications service provider, an academic health system affiliated with a university, and a government county municipality. In 2020, Zhou Shuai appeared to be working from a set of intelligence requirements that included targets within the United States, Russia, and Western Europe. Data types of interest included telecommunications data, border crossing data, data on personnel in religious research, data on media industry personnel, and data on public servants. These requirements almost certainly originated from the CCP’s intelligence services. In early 2021, Zhou Shuai brokered the sale of documents stolen from a U.S. cleared defense contractor.OFAC is designating Zhou Shuai pursuant to Executive Order (E.O.) 13694, as further amended by E.O. 14144 (“E.O. 13694, as further amended”), for being responsible for or complicit in, or having engaged in, directly or indirectly, activities related to gaining or attempting to gain unauthorized access to a computer or network of computers of a U.S. person, the United States, a U.S. ally or partner or a citizen, national, or entity organized under the laws thereof, where such efforts originate from or are directed by persons located, in whole or substantial part, outside the United States and are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States.Shanghai heiying:  a haven for hackersZhou Shuai established Shanghai Heiying Information Technology Company, Limited (Shanghai Heiying) in 2010 and is still its majority owner. Shanghai Heiying is a Shanghai-based cybersecurity company that has employed numerous known China-backed malicious cyber actors, including Yin Kecheng.OFAC is designating Shanghai Heiying pursuant to E.O. 13694, as further amended, for being owned or controlled by, or having acted or purported to act for or on behalf of, directly or indirectly, Zhou Shuai, a person whose property and interests in property are blocked pursuant to E.O. 13694, as further amended.Sanctions implicationsAs a result of today’s action, all property and interests in property of the designated persons described above that are in the United States or in the possession or control of U.S. persons are blocked and must be reported to OFAC. In addition, any entities that are owned, directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons are also blocked. Unless authorized by a general or specific license issued by OFAC or exempt, U.S. sanctions generally prohibit all transactions by U.S. persons or within (or transiting) the United States that involve any property or interests in property of designated or otherwise blocked persons.Violations of U.S. sanctions may result in the imposition of civil or criminal penalties on U.S. and foreign persons. OFAC may impose civil penalties for sanctions violations on a strict liability basis. OFAC’s Economic Sanctions Enforcement Guidelines provide more information regarding OFAC’s enforcement of U.S. economic sanctions. In addition, financial institutions and other persons may risk exposure to sanctions for engaging in certain transactions or activities with designated or otherwise blocked persons.  The power and integrity of OFAC sanctions derive not only from OFAC’s ability to designate and add persons to the SDN List, but also from its willingness to remove persons from the SDN List consistent with the law. The ultimate goal of sanctions is not to punish, but to bring about a positive change in behavior. For information concerning the process for seeking removal from an OFAC list, including the SDN List, please refer to OFAC’s Frequently Asked Question 897 here and to submit a request for removal, click here.Click here for more information on the individuals and entities designated today. ###
Feb-March 2025 China IP Treasury Certs#treasury#sanctions#cybercrime
·home.treasury.gov·
Treasury Sanctions China-based Hacker Involved in the Compromise of Sensitive U.S. Victim Networks