ForenSec

Yeni oyuncağımız :) Bakalım neler yapabileceğiz bu oyuncakla ya da bize ne kadar dayanacak 😁

Yeni oyuncağımız :) Bakalım neler yapabileceğiz bu oyuncakla ya da bize ne kadar dayanacak 😁

Kafalar pırıl pırıl. DeepseekAI’ye şirketin access token’ı chate atmışlar :) https://web.archive.org/web/*/http://chat.deepseek.com*

Kafalar pırıl pırıl. DeepseekAI’ye şirketin access token’ı chate atmışlar :) https://web.archive.org/web/*/http://chat.deepseek.com*

QiAnXin XLab warns of active exploitation of 0-day in Cambium Networks ' cnPilot routers to deploy a strain of the AISURU botnet called AIRASHI and engage in DDoS attacks. The observed campaign has been running since June 2024, but any details regarding specific zeros remain undisclosed for now to prevent further abuse. Other vulnerabilities exploited by AIRASHI operators include: CVE-2013-3307 , CVE-2016-20016 , CVE-2017-5259 , CVE-2018-14558 , CVE-2020-25499 , CVE-2020-8515 , CVE-2022-3573 , CVE-2022-40005 , CVE-2022-44149 , CVE-2023-28771 , as well as bugs in AVTECH IP cameras, LILIN DVRs, and Shenzhen TVT devices. According to the results of tests presented by the botnet operators, the DDoS power of AIRASHI is stable and remains at the level of 1–3 Tbit/s. Most of the hacked devices were located in Russia, Brazil, Vietnam and Indonesia, while the main targets of the malicious attacks were China, the United States, Poland and Russia. AIRASHI is a variant of the AISURU (aka NAKOTNE) botnet, which was previously detected by the company in August 2024 as part of an investigation into a DDoS attack targeting Steam, around the launch of Black Myth: Wukong. Frequently updated botnets and individual AIRASHI variations were also discovered that included proxy functionality, indicating that the attackers intend to expand their capabilities beyond DDoS. AISURU temporarily suspended its activity around September 2024, but the botnet returned a month later with updated functionality (called Kitty) and then evolved a second time in late November (aka AIRASHI). The kitty sample began to spread in early October 2024. Compared to previous AISURU samples, it simplified the network protocol and by the end of October began to support SOCKS5 proxy servers for communication with the C2 server. On the other hand, AIRASHI is available in at least two different variants: - AIRASHI-DDoS (first discovered in late October), which is primarily focused on DDoS attacks, but also supports arbitrary command execution and reverse shell access. - AIRASHI-Proxy (first discovered in early December), which is a modified version of AIRASHI-DDoS with proxy functionality. The botnet, in addition to constantly tweaking its methods for obtaining C2 server data via DNS queries, relies on an entirely new network protocol that includes HMAC-SHA256 and CHACHA20 for communication. In addition, AIRASHI-DDoS supports 13 message types, while AIRASHI-Proxy only supports five message types. The results show that attackers continue to effectively exploit IoT device vulnerabilities both as an initial access vector and to create botnets that are used to conduct powerful DDoS attacks.

QiAnXin XLab warns of active exploitation of 0-day in Cambium Networks ' cnPilot routers to deploy a strain of the AISURU botnet called AIRASHI and engage in DDoS attacks. The observed campaign has been running since June 2024, but any details regarding specific zeros remain undisclosed for now to prevent further abuse. Other vulnerabilities exploited by AIRASHI operators include: CVE-2013-3307 , CVE-2016-20016 , CVE-2017-5259 , CVE-2018-14558 , CVE-2020-25499 , CVE-2020-8515 , CVE-2022-3573 , CVE-2022-40005 , CVE-2022-44149 , CVE-2023-28771 , as well as bugs in AVTECH IP cameras, LILIN DVRs, and Shenzhen TVT devices. According to the results of tests presented by the botnet operators, the DDoS power of AIRASHI is stable and remains at the level of 1–3 Tbit/s. Most of the hacked devices were located in Russia, Brazil, Vietnam and Indonesia, while the main targets of the malicious attacks were China, the United States, Poland and Russia. AIRASHI is a variant of the AISURU (aka NAKOTNE) botnet, which was previously detected by the company in August 2024 as part of an investigation into a DDoS attack targeting Steam, around the launch of Black Myth: Wukong. Frequently updated botnets and individual AIRASHI variations were also discovered that included proxy functionality, indicating that the attackers intend to expand their capabilities beyond DDoS. AISURU temporarily suspended its activity around September 2024, but the botnet returned a month later with updated functionality (called Kitty) and then evolved a second time in late November (aka AIRASHI). The kitty sample began to spread in early October 2024. Compared to previous AISURU samples, it simplified the network protocol and by the end of October began to support SOCKS5 proxy servers for communication with the C2 server. On the other hand, AIRASHI is available in at least two different variants: - AIRASHI-DDoS (first discovered in late October), which is primarily focused on DDoS attacks, but also supports arbitrary command execution and reverse shell access. - AIRASHI-Proxy (first discovered in early December), which is a modified version of AIRASHI-DDoS with proxy functionality. The botnet, in addition to constantly tweaking its methods for obtaining C2 server data via DNS queries, relies on an entirely new network protocol that includes HMAC-SHA256 and CHACHA20 for communication. In addition, AIRASHI-DDoS supports 13 message types, while AIRASHI-Proxy only supports five message types. The results show that attackers continue to effectively exploit IoT device vulnerabilities both as an initial access vector and to create botnets that are used to conduct powerful DDoS attacks.

QiAnXin XLab предупреждает об активной эксплуатации 0-day в маршрутизаторах cnPilot компании Cambium Networks для развертывания штамма ботнета AISURU под названием AIRASHI и задействования в DDoS-атаках. Наблюдаемая кампания реализуется с июня 2024 года, однако какие-либо подробные сведения в отношении конкретных нулей пока остаются нераскрытыми для предотвращения дальнейших злоупотреблений. В числе других уязвимостей, используемых операторами AIRASHI: CVE-2013-3307, CVE-2016-20016, CVE-2017-5259, CVE-2018-14558, CVE-2020-25499, CVE-2020-8515, CVE-2022-3573, CVE-2022-40005, CVE-2022-44149, CVE-2023-28771, а также ошибки в IP-камерах AVTECH, видеорегистраторах LILIN и устройствах Shenzhen TVT. Согласно представленных операторами ботнета результатов своих тестов, DDoS-мощность AIRASHI стабильна удерживается на уровне 1–3 Тбит/с. При этом большинство взломанных устройств расположены в России, Бразилии, Вьетнаме и Индонезии, а основными целями вредоносных атак стали Китай, США, Польша и Россия. AIRASHI - это вариант ботнета AISURU (он же NAKOTNE), который ранее был детектировал компанией в августе 2024 года в рамках расследования DDoS-атаки, нацеленной на Steam, примерно в период запуска игры Black Myth: Wukong. Также были обнаружены часто обновляемые ботнеты и отдельные вариации AIRASHI, включающие в себя функциональность прокси, что указывает на то, что злоумышленники намерены расширить свои возможности за пределы DDoS. AISURU временно приостановил свою активность примерно в сентябре 2024 года, но через месяц ботнет вернулся с обновленным функционалом (под названием Kitty) и затем эволюционировал второй раз в конце ноября (она же AIRASHI). Образец kitty начал распространяться в начале октября 2024 года. По сравнению с предыдущими образцами AISURU он упростил сетевой протокол и к концу октября стал поддерживать прокси-серверы SOCKS5 для связи с сервером C2. С другой стороны, AIRASHI представлен как минимум в двух разных вариантах: - AIRASHI-DDoS (впервые обнаружен в конце октября), который в первую очередь, ориентирован на DDoS-атаки, но также поддерживает произвольное выполнение команд и обратный доступ к оболочке. - AIRASHI-Proxy (впервые обнаружен в начале декабря), представляющий собой модифицированную версию AIRASHI-DDoS с функциональностью прокси. Ботнет, в дополнение к постоянной настройке своих методов для получения данных сервера C2 через DNS-запросы, полагается на совершенно новый сетевой протокол, который включает HMAC-SHA256 и CHACHA20 для связи. Кроме того, AIRASHI-DDoS поддерживает 13 типов сообщений, в то время как AIRASHI-Proxy поддерживает только пять типов сообщений. Результаты показывают, что злоумышленники продолжают эффективно использовать уязвимости IoT-устройств как в качестве первоначального вектора доступа, так и для создания ботнетов, которые задействуют для проведения мощных DDoS-атак.

🔓 Ace up the sleeve: hacking Apple's new USB-C controller. • Starting in 2024, Apple began using a new USB-C controller in its devices, which is built not only into iPhones, but also into Macs, iPads, and other gadgets. Well, a well-known security researcher in narrow circles , Thomas Roth, hacked this USB controller, which allowed him to execute arbitrary code and control the device. • He spoke about his achievement during the Chaos Communication Congress conference, which was held in Germany from December 27 to 30, 2024. In simple terms, using reverse engineering, Thomas found out at what point the system checks the firmware in order to have time to download a modified patch and deceive the ACE3 protection system. For example, using this vulnerability, you can connect uncertified accessories or perform operations without the user's consent: https://media.ccc.de/v/38c3-ace-up-the-sleeve-hacking-into-apple-s-new-usb-c-controller • The researcher reported the vulnerability to Apple, but the company has no plans to fix it yet. The attack is too complex, so it will not be used en masse. Thomas himself agreed that the vulnerability is very difficult to exploit and the threat to users is unlikely. Some service centers noted that this vulnerability will help them diagnose broken Macs. ➡ https://cybersecuritynews.com/apples-new-usb-c-controller-hacked/ • PS In addition to this report, there were many more cool presentations (more than 200) at the conference, which will be useful for information security specialists and not only... All reports are available for viewing at this link: https://media.ccc.de/c/38c3

🔓 Ace up the sleeve: hacking Apple's new USB-C controller. • Starting in 2024, Apple began using a new USB-C controller in its devices, which is built not only into iPhones, but also into Macs, iPads, and other gadgets. Well, a well-known security researcher in narrow circles , Thomas Roth, hacked this USB controller, which allowed him to execute arbitrary code and control the device. • He spoke about his achievement during the Chaos Communication Congress conference, which was held in Germany from December 27 to 30, 2024. In simple terms, using reverse engineering, Thomas found out at what point the system checks the firmware in order to have time to download a modified patch and deceive the ACE3 protection system. For example, using this vulnerability, you can connect uncertified accessories or perform operations without the user's consent: https://media.ccc.de/v/38c3-ace-up-the-sleeve-hacking-into-apple-s-new-usb-c-controller • The researcher reported the vulnerability to Apple, but the company has no plans to fix it yet. The attack is too complex, so it will not be used en masse. Thomas himself agreed that the vulnerability is very difficult to exploit and the threat to users is unlikely. Some service centers noted that this vulnerability will help them diagnose broken Macs. ➡ https://cybersecuritynews.com/apples-new-usb-c-controller-hacked/ • PS In addition to this report, there were many more cool presentations (more than 200) at the conference, which will be useful for information security specialists and not only... All reports are available for viewing at this link: https://media.ccc.de/c/38c3

The Pwn2Own Automotive 2025 hacker duel, organized by Trend Micro's Zero Day Initiative (ZDI) in Tokyo, Japan, as part of the Automotive World conference, has ended. On the first day of Pwn2Own Automotive, researchers demonstrated 16 unique 0-days and hit the jackpot of $382,750. We covered the results in detail yesterday. On the second day, researchers hacked the Tesla Wall Connector charger twice. In addition, another 23 0-days were used in WOLFBOX, ChargePoint Home Flex, Autel MaxiCharger, Phoenix Contact CHARX and EMPORIA EV chargers, as well as in Alpine iLX-507, Kenwood DMX958XR, Sony XAV-AX8500 In-Vehicle Infotainment (IVI) systems. PHP Hooligans were the first to hack the Tesla Wall Connector, using the Numeric Range Comparison Without Minimum Check vulnerability to take control of the device. Following on from this, the Synacktiv team also hacked a Tesla EV charger via the Charging Connector, demonstrating a method never before seen publicly. Exploits using the Tesla Wall Connector charger have earned participating researchers over $140,000. On day three, targeting the Tesla Wall Connector, there were two bug collisions: one by the PCAutomotive team and the other by Sinoy Kheirha of Summoning Team, who used an exploit chain of two already known vulnerabilities. In total, hackers earned $168,000 on day three, including $35,000 for the Autel MaxiCharger exploit and $26,750 for the Ubiquiti charger exploit. Despite Tesla providing an equivalent desktop Model 3/Y unit (based on Ryzen), no researchers entered the category. Nor did anyone attempt to hack the Tesla, even though the organizers were offering a car and hundreds of thousands of dollars in prizes. In the OS category, there was a single exploit attempt targeting Automotive Grade Linux, which earned hackers $33,500. The winning team was Summoning Team, who were able to earn a total of $222,250. By the end of the competition, participants were able to earn a total of $886,250 for demonstrating nearly 50 previously unknown vulnerabilities in infotainment systems and chargers. Last year - $1,323,750 for 49 vulnerabilities. The results of the first, second and third days of the competition are here , here and here respectively.

The Pwn2Own Automotive 2025 hacker duel, organized by Trend Micro's Zero Day Initiative (ZDI) in Tokyo, Japan, as part of the Automotive World conference, has ended. On the first day of Pwn2Own Automotive, researchers demonstrated 16 unique 0-days and hit the jackpot of $382,750. We covered the results in detail yesterday. On the second day, researchers hacked the Tesla Wall Connector charger twice. In addition, another 23 0-days were used in WOLFBOX, ChargePoint Home Flex, Autel MaxiCharger, Phoenix Contact CHARX and EMPORIA EV chargers, as well as in Alpine iLX-507, Kenwood DMX958XR, Sony XAV-AX8500 In-Vehicle Infotainment (IVI) systems. PHP Hooligans were the first to hack the Tesla Wall Connector, using the Numeric Range Comparison Without Minimum Check vulnerability to take control of the device. Following on from this, the Synacktiv team also hacked a Tesla EV charger via the Charging Connector, demonstrating a method never before seen publicly. Exploits using the Tesla Wall Connector charger have earned participating researchers over $140,000. On day three, targeting the Tesla Wall Connector, there were two bug collisions: one by the PCAutomotive team and the other by Sinoy Kheirha of Summoning Team, who used an exploit chain of two already known vulnerabilities. In total, hackers earned $168,000 on day three, including $35,000 for the Autel MaxiCharger exploit and $26,750 for the Ubiquiti charger exploit. Despite Tesla providing an equivalent desktop Model 3/Y unit (based on Ryzen), no researchers entered the category. Nor did anyone attempt to hack the Tesla, even though the organizers were offering a car and hundreds of thousands of dollars in prizes. In the OS category, there was a single exploit attempt targeting Automotive Grade Linux, which earned hackers $33,500. The winning team was Summoning Team, who were able to earn a total of $222,250. By the end of the competition, participants were able to earn a total of $886,250 for demonstrating nearly 50 previously unknown vulnerabilities in infotainment systems and chargers. Last year - $1,323,750 for 49 vulnerabilities. The results of the first, second and third days of the competition are here , here and here respectively.

Researchers at Black Lotus Labs at Lumen Technologies are reporting a malware campaign targeting Juniper routers and VPN gateways using malware called J-magic, which is designed specifically for Junos OS. The name comes from the fact that the backdoor constantly monitors the TCP traffic for a "magic packet" before launching a reverse shell. J-magic attacks appear to target organizations in the semiconductor, energy, manufacturing (shipbuilding, solar panels, heavy engineering) and IT sectors. According to Black Lotus Labs, the J-magic campaign was active between mid-2023 and mid-2024 and was organized in a low-detection, long-term access format. Based on telemetry data, the researchers believe that about half of the target devices appeared to be configured as a VPN gateway for their organization. J-magic is a modified version of the publicly available cd00r backdoor, an experimental sample that remains hidden and passively monitors network traffic for a specific ("magic") packet before opening a communication channel with the attacker. It does this by creating an eBPF filter on the interface and port specified as a command-line argument when executed. The malware checks various fields and offsets for clues that point to a valid packet from a remote IP address. J-magic relies on five conditions, and if a packet matches one of them, it will implement a reverse shell. However, the sender must solve the puzzle before gaining access to the compromised device. The remote IP receives a random five-character alphanumeric string encrypted with a hard-coded RSA public key. If the response received is not equal to the original string, the connection is closed. The developer probably added this RSA challenge to prevent others from distributing "magic" packets over the Internet to identify victims and then simply reusing J-Magic agents for their own purposes. The researchers note that the campaign under study has technical similarities with the SeaSpy malware, which is also based on the cd00r backdoor, but several differences make it difficult to establish a connection between the two campaigns. Overall, the researchers have low confidence that J-magic correlates with SeaSpy, which was used by Chinese APTs in attacks on Barracuda Email Security Gateways using CVE-2023-2868 as a 0-day in 2022-2023. Black Lotus Labs believes that the J-magic campaign targeting Juniper devices is evidence that the use of this type of malware is becoming a new trend. Attackers can remain undetected for a longer period of time because such targeted corporate devices do not have host-level monitoring tools and the malware sits in memory waiting for the “magic” packet.

Researchers at Black Lotus Labs at Lumen Technologies are reporting a malware campaign targeting Juniper routers and VPN gateways using malware called J-magic, which is designed specifically for Junos OS. The name comes from the fact that the backdoor constantly monitors the TCP traffic for a "magic packet" before launching a reverse shell. J-magic attacks appear to target organizations in the semiconductor, energy, manufacturing (shipbuilding, solar panels, heavy engineering) and IT sectors. According to Black Lotus Labs, the J-magic campaign was active between mid-2023 and mid-2024 and was organized in a low-detection, long-term access format. Based on telemetry data, the researchers believe that about half of the target devices appeared to be configured as a VPN gateway for their organization. J-magic is a modified version of the publicly available cd00r backdoor, an experimental sample that remains hidden and passively monitors network traffic for a specific ("magic") packet before opening a communication channel with the attacker. It does this by creating an eBPF filter on the interface and port specified as a command-line argument when executed. The malware checks various fields and offsets for clues that point to a valid packet from a remote IP address. J-magic relies on five conditions, and if a packet matches one of them, it will implement a reverse shell. However, the sender must solve the puzzle before gaining access to the compromised device. The remote IP receives a random five-character alphanumeric string encrypted with a hard-coded RSA public key. If the response received is not equal to the original string, the connection is closed. The developer probably added this RSA challenge to prevent others from distributing "magic" packets over the Internet to identify victims and then simply reusing J-Magic agents for their own purposes. The researchers note that the campaign under study has technical similarities with the SeaSpy malware, which is also based on the cd00r backdoor, but several differences make it difficult to establish a connection between the two campaigns. Overall, the researchers have low confidence that J-magic correlates with SeaSpy, which was used by Chinese APTs in attacks on Barracuda Email Security Gateways using CVE-2023-2868 as a 0-day in 2022-2023. Black Lotus Labs believes that the J-magic campaign targeting Juniper devices is evidence that the use of this type of malware is becoming a new trend. Attackers can remain undetected for a longer period of time because such targeted corporate devices do not have host-level monitoring tools and the malware sits in memory waiting for the “magic” packet.

Researchers from Positive Technologies have uncovered a new financially motivated group of attackers that has been attacking the financial divisions of Russian companies for almost two years. The researchers named it #DarkGaboon, after the African Gaboon viper that can be found in the vicinity of the Kilimanjaro stratovolcano. The main tool is a ready-made tool called #RevengeRAT. The group skillfully uses document templates downloaded from legitimate Russian resources devoted to financial topics, and is also familiar with Russian vocabulary. DarkGaboon was finally discovered in mid-October last year, when researchers detected a targeted mailing of Revenge RAT to employees of a Russian bank. The email titled "Reconciliation of Settlements" contained an accompanying text in Russian and a decoy archive "Act of Reconciliation.z". A compromised email address was used for the mailing. A group of 11 Revenge RAT samples and eight associated Dynamic DNS domains of the cluster with the "African" name kilimanjaro attracted attention. The analysis showed that similar activity against Russian companies has been observed since at least May 2023. However, previously, until October 2024, a single Dynamic DNS domain and a group of rampage cluster management servers, rotating on average once a month, were used as the management infrastructure. Domains from both clusters were delegated to one server located in Bulgaria with a time difference of one week. All the artifacts found indicated that both the rampage and kilimanjaro clusters were used by the same group. As Pozitiv found out, DarkGaboon was consistently updating the sets of files it used, releasing an average of 10 new malicious builds with Revenge RAT every month and a proportional number of decoy files, which ensured stealth. All 43 variations of Microsoft Office decoy documents were generated by making minor modifications to four templates downloaded from Russian financial-focused websites, likely to alter the hash values. The vast majority of samples found have Russian-language names related to accounting reports. Since August 2024, DarkGaboon has been using homoglyphs in the names of malicious samples, making them invisible to strict search rules that target files with Cyrillic names only. All Revenge RAT samples were signed with fake X.509 certificates, the owners of which mostly had Russian names, but there were also names of American states and cities, as well as large Western companies. The icing on the cake was the X.509 certificate with the name OOO ZAL[…]PA, emphasizing DarkGaboon’s deep knowledge of the basics of Russian vocabulary. The positives believe that the perpetrators are most likely native Russian speakers. DarkGaboon also uses certificates that are quite common in the cyber underground, this is due to its use of popular cryptors for obfuscation and signing of malicious code. These features, including the fact that almost half of all sample uploads to public file verification services come from Russia, indicate that DarkGaboon's attacks are clearly aimed at the Russian segment. At the same time, the constant renewal of the offensive arsenal indicates that the group does not even plan to stop and intends to strengthen the attacks.

Researchers from Positive Technologies have uncovered a new financially motivated group of attackers that has been attacking the financial divisions of Russian companies for almost two years. The researchers named it #DarkGaboon, after the African Gaboon viper that can be found in the vicinity of the Kilimanjaro stratovolcano. The main tool is a ready-made tool called #RevengeRAT. The group skillfully uses document templates downloaded from legitimate Russian resources devoted to financial topics, and is also familiar with Russian vocabulary. DarkGaboon was finally discovered in mid-October last year, when researchers detected a targeted mailing of Revenge RAT to employees of a Russian bank. The email titled "Reconciliation of Settlements" contained an accompanying text in Russian and a decoy archive "Act of Reconciliation.z". A compromised email address was used for the mailing. A group of 11 Revenge RAT samples and eight associated Dynamic DNS domains of the cluster with the "African" name kilimanjaro attracted attention. The analysis showed that similar activity against Russian companies has been observed since at least May 2023. However, previously, until October 2024, a single Dynamic DNS domain and a group of rampage cluster management servers, rotating on average once a month, were used as the management infrastructure. Domains from both clusters were delegated to one server located in Bulgaria with a time difference of one week. All the artifacts found indicated that both the rampage and kilimanjaro clusters were used by the same group. As Pozitiv found out, DarkGaboon was consistently updating the sets of files it used, releasing an average of 10 new malicious builds with Revenge RAT every month and a proportional number of decoy files, which ensured stealth. All 43 variations of Microsoft Office decoy documents were generated by making minor modifications to four templates downloaded from Russian financial-focused websites, likely to alter the hash values. The vast majority of samples found have Russian-language names related to accounting reports. Since August 2024, DarkGaboon has been using homoglyphs in the names of malicious samples, making them invisible to strict search rules that target files with Cyrillic names only. All Revenge RAT samples were signed with fake X.509 certificates, the owners of which mostly had Russian names, but there were also names of American states and cities, as well as large Western companies. The icing on the cake was the X.509 certificate with the name OOO ZAL[…]PA, emphasizing DarkGaboon’s deep knowledge of the basics of Russian vocabulary. The positives believe that the perpetrators are most likely native Russian speakers. DarkGaboon also uses certificates that are quite common in the cyber underground, this is due to its use of popular cryptors for obfuscation and signing of malicious code. These features, including the fact that almost half of all sample uploads to public file verification services come from Russia, indicate that DarkGaboon's attacks are clearly aimed at the Russian segment. At the same time, the constant renewal of the offensive arsenal indicates that the group does not even plan to stop and intends to strengthen the attacks.

Megaproject Stargate: $500 billion for AI data centers in the #US The White House has announced the launch of an ambitious project called Stargate - OpenAI, #SoftBank and #Oracle will build a network of powerful AI data centers, starting in #Texas. The project is planned to cost half a trillion dollars over four years, creating hundreds of thousands of jobs and strengthening the US's technological leadership. The first center in Abilene will consume the energy of 750,000 homes, and the team is already working on its own AI chip by 2026. In Texas, everything will now be not only big, but also smart - cowboys can start learning prompts ... #AI #OpenAI #Stargate #DataCenter

Ukrayna cephesinde bir uzmanın anlatımı; “Bir birimin "yukarıdan" bir radyo izleme noktası oluşturması istendi. Onlara bir bilgisayar, antenli bir SDR alıcısı verdik, oraya gittim, her şeyi bağladım, her şeyi anlattım, her şeyi devreye soktum. Ve oraya uzaktan Teamviewer kurdun. İki ay sonra tesadüfen oraya gidiyorum ve bilgisayarda radyo izleme noktası yok, birileri orada oturup bilgisayarda dizi izliyor. Bu nedenle ancak bilgiye ilgi duyan biri veya bu tür şeylerin önemini anlayan bir komutan olduğunda teçhizat veriyorum. Aksi takdirde her şey boşunadır.”

Taktik uçağının radyo istasyonu yayına girdiğinde böyle görünüyor. Bu "üst" hava bandı ve dijital şifreli bir kanaldır.

Dronlar hakkında ilginç kaynaklara ulaştım. Zaman zaman ilgimi çeken şeyleri burdan paylaşırım. Dünya o yöne gidiyor, biz neden gitmeyelim?