🇺🇸#TreasonAgainstAmerica 1/12

General Warning: don’t work for or hire @IanMmmm - he’s a zero-integrity-self-serving manipulator. He destroyed an entire org at AWS.

He’s the reason I left @awscloud. He’s not just incompetent, he’s dishonest in the extreme. You’re throwing away your career working with him.

Also, pro-tip: record every call you have with a manager that you suspect is lying to you.

Here's what happened: I lost my shit when I didn't get promoted, because I was a child. That's on me. I had worked my ass off for 3 years and Ian said that if I moved to Seattle and signed a non-compete then I would get my promotion. I did those things - I didn't get promoted.

What does losing my shit mean? I sent a message to Ian and others that said "Fuck you, I'm not moving to the depressive hell hole that is Seattle. I'm not signing a non-compete. I'm going to stop working 100 hours a week for a company that doesn't give a shit about me."

Later, I found out that Ian had never actually reached out to anyone about my promo document. He just lied. He just ignored it until the last second because he was too focused on taking credit for my work for his own promo document. He got promoted.

As part of our commitment to keeping our customers/community protected & informed, we are releasing a blog that shines light on transition between Stage 1 and 2 of #Solorigate/#SUNBURST campaign, custom Cobalt Strike loaders, post-exploit. artifacts, IOCs: https://t.co/b0ReHMa63u

Here are some highlights:
The missing link between the Solorigate backdoor and the custom #CobaltStrike loaders observed during the #Solorigate is an Image File Execution Options (IFEO) Debugger registry value created for the legitimate process dllhost.exe (ATT&CK ID: T1546.012).

Once the registry value is created, the attackers wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped by the SolarWinds backdoor (Stage 1).

The VBScript in turn runs rundll32.exe, activating the Cobalt Strike loader DLL using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution.

On the custom Cobalt Strike Loaders: we identified several second-stage malware, including TEARDROP, Raindrop, and other custom loaders for the Cobalt Strike beacon. During the lateral movement phase, the custom loader DLLs are dropped mostly in existing Windows sub-directories.

1) Let's talk about how Alibaba has achieved the holy grail of big data - a holistic view of the consumer - through a plethora of product offerings and investment.

This is their overarching moat. And Amazon's got nothing on them.

2) To the outsider, Alibaba's product range is confusing af. It's all over the place and there seems to be no core competency they are focusing on.

A few divisions - Taobao (B2C marketplace), Tmall (High-end B2C marketplace), Alibaba (B2B marketplace, Cainiu(logistics)..

3) ...Elema (Food delivery), Autonavi (maps), Youku (streaming) and Feizhu(travel booking)

Also the promotional strategy is weird, In the lead-up to singles day, half the time they were promoting some cat rearing in-app mini game.

Wtf?

4) When we view Alibaba's strategy as working to create a full view of a consumer's life, including their preferences, social network and spending capacity (and ability). Then everything starts to make sense.

4) Whether a consumer buys on Tmall or Taobao tells Ali about their preferences and budget, delivery address for packages and food lets Ali know where they live and where they work (also cross-referenced with property data to infer wealth level + occupation).

There is a world shortage of chocolate. People are dying because they do not eat enough chocolate. A company, AstraChocolate, one of the few companies that knows how to manufacture chocolate bars, enters into contracts with governments worldwide. 1/

Most of these governments agree to fund AstraChocolate's efforts to research and secure production of highly nutritient chocolate bars. In exchange, AC promises it will deliver X chocolate bars per day to governments once they are produced. 2/

Because edible, safe, chocolate bars need to be approved by national and international regulators, their production and manufacturing takes a while. To ensure a smooth supply chain, AC and other similar companies use factories all around the world. 3/

In Europe, AC uses mainly three manufacturing sites: one in the UK, one in Germany and one in Belgium. In its dealings with governments, AC has promised to deliver 500m of chocolate bars to the EU and 100m to the UK by March 2021. 4/

Now this is a mighty task and there are bumps along the way. Nobody has ever produced edible, safe, super-nutrient chocolate bars at that speed and under that much public scrutiny. So AC and other, similar companies, like Cfacao-BionChoc run into some supply problems. 5/

Compliance is fundamentally at odds with innovation and continuous improvement

Compliance tends to constrain operations to narrow sets of approved sequences of tasks as the means to assure the secure attainment of certain business outcomes. But at what cost ?

🧵

Operational practices have an emergent nature to them. They’re affected by people, their expertise, their relationships, their team goals, role perceptions and also member needs as humans and professionals.
In this entangled mess of variables, aspects practice-as-done are

Constantly morphed as a response to economic pressures (deadlines, business demands), workload demands (as people tend to automate or agree patterns to reduce cognitive load of tasks and become more efficient) and understanding of safety and security related barriers.

All of these tend to be fluid and non fixed. In this continuous interaction with the environment and different pressures acting on it, there are numerous opportunities for improvements which have local relevance and emerge out of local needs and interactions of elements. However

In order to do so, and to support innovation and continuous improvement the practices need to have a requisite level of variability so practitioners exercise their Fingerspitzengefühl (fingertip feel) for what works and what doesn’t, within their constraints and pressures