Sendgrid account hack leads to spike in spam levels

For a few weeks now I’ve been noticing increased levels of phishing emails into my personal account from Sendgrid mailers.  Sendgrid is a large, legitimate transactional emailer so at first I chalked this up to a rogue account that would soon be terminated and an isolated incident. They kept coming, however, and I began to wonder.  It’s not like an ISP can block Sendgrid, the collateral damage would be extensive. 

Then I saw a thread on the mailop mailing list about it and finally,  the news via Krebs on Security that Sendgrid is dealing with a significant number of hacked customer accounts which are being used to send spam.  The cracked account credentials are being sold on the dark web, and Sendgrid is looking at forcing multi-factor authentication across all accounts to get in front of the situation.  How the accounts were breached in the first place is not yet known. 

Police increasingly want access to smart speaker recordings

This wired article described quite vividly how police work and evidence gathering has come to include securing data from smarthome devices like speakers, Amazon Echo, smart TVs, etc.

In this particular case, sound recordings of an argument inside a home that ended in a fatality was used by the legal defence team to exonerate their client of a second-degree murder charge (somehow, the victim was impaled by a 12” blade at the end of a bedpost and recordings obtained from a pair of Amazon Echo speakers explained how and cleared the defendant), but more often this data is used to nullify alibis or collect evidence to be used against the accused:

‘Douglas Orr, head of the criminal justice department at the University of North Georgia, says police now look for smart home data as routinely as data from smartphones.  Data on a smartphone often points officers towards other devices, which they then probe as the investigation continues.

By amending a search warrant, police can “keep going to keep collecting data,” Orr says. “That usually leads to an Echo or at least some other device.”’

The article describes how the likes of Amazon, Google and other smarthome device manufacturers now routinely receive requests from Department of Homeland Security, various police forces, and even for civil legal proceedings like divorce cases.  Also how police forces are creating templates for making these data requests and then sharing those templates across other police forces.



Blame Canada: Centurylink outage cascades across major internet providers

Sunday morning I started hearing rumblings of another Cloudflare outage, but that wasn’t accurate.  What actually happened was a US service provider called CenturyLink went down, taking out services from Amazon, Twitter, Microsoft, Namecheap, Discord, and large chunks of Cloudflare. 

While CenturyLink is a US outfit, the outage was attributed to a misconfigured FlowSpec rule in a router in, … wait for it… Mississauga, Canada.  Or as ZD Net put it “the issue originated from CenturyLink’s data center in Mississauga, a city near Ontario, Canada.”  Lol.  Techs were promptly dispatched via dogsled to fix the issue.

The flub resulted in some manner of bad BGP announcement which blew up everything. We’ve written about the scary state of BGP routing tables before and will repeat it here: underneath the veneer of a lean mean algorithmic machine, at the bottom couple layers of the OSI stack that powers the internet, it’s all held together with spit and twist-ties.

More on China hack that contributed to Nortel’s demise

We’ve written about China’s role in the fall of Nortel before. I will reiterate that most, if not all corporate implosions are self-inflicted, but in this case part of that self-infliction may be how Nortel was warned by CSIS that they had been penetrated by Chinese operatives at least two years before things got really out of hand, and the company seems to have ignored it.

Now Global News details the investigation undertaken by Brian Shields, a security advisor to Nortel.

“Shields found that a computer in Shanghai had hacked into the email account of an Ottawa-based Nortel executive. Using passwords stolen from the executive the intruder downloaded more than 450 documents from “Live Link” — a Nortel server used to warehouse sensitive intellectual property”

The further he examined, the worse it got:  this account wasn’t the only one compromised, Shields found at least 7 others.  This wasn’t just some random hackers, it was organized, and the indications were that it was state sponsored actors, originating in China. 

Huawei was said to be a later beneficiary of stolen Nortel IP.

Surveillance firm Palantir unveils details IPO (snowFlake S1)

News emerged last week that the shadowy surveillance firm Palantir’s S1 had been leaked and screen shots of it had been posted to the Internet.  Their S1 has since been duly filed with the SEC. 

It looks like the company posted at $580 million loss on $742 million in revenue – apparently a disappointment, as Palantir was rumoured to be pushing $1 billion in revenues (the disappointment was about the top-line revenue number, not the loss.  In Silicon Valley, all companies are supposed to lose money.  That’s the way the game is played there). 

Most of Palantir’s clients are government agencies, despite trying to move more into the commercial realm.  As per coverage in Zerohedge “Palantir’s client list includes the CIA, the FBI, the NSA, the CDC, the Marine Corps, the Air Force, Special Operations Command, West Point and the IRS”, and from their S-1:  or, in Palantir’s words (from the S-1):

“We build software platforms for large institutions whose work is essential to our way of life. Those institutions must be able to function in times of stability as well as crisis and uncertainty.”

The S-1 here: https://www.sec.gov/Archives/edgar/data/1321655/000119312520230013/0001193125-20-230013-index.htm