@darrenolivier@mastodon.social avatar

darrenolivier

@darrenolivier@mastodon.social

Director at African Defence Review & software developer at an Amsterdam-based consultancy. DM for Signal. Follows don’t mean approval.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

darrenolivier, to random
@darrenolivier@mastodon.social avatar

Remarkably, DefenceWeb managed to obtain combat radio recordings from this weekend's SANDF engagements against ASWJ insurgents in Macomia, Mozambique, as well as a detailed breakdown of how the fighting unfolded.
It's extremely rare for these to leak.
https://www.defenceweb.co.za/african-news/they-are-attacking-my-base/

darrenolivier,
@darrenolivier@mastodon.social avatar

The recordings show good performance from the SANDF Combat Team Charlie troops, remaining calm and providing clear radio instructions even in the middle of an ambush from several directions & IEDs.

This is the sort of thing SANDF PR should be highlighting. Great scoop by DW!

darrenolivier,
@darrenolivier@mastodon.social avatar

And excellent work by the deployed SANDF forces, who had to suddenly transition from withdrawal mode back to combat operations with far too few vehicles and other equipment available. That was not an easy operation.

gadgeteer, to random

A South African biker’s post-accident medical treatment was delayed after the SOS feature on his Garmin satellite communicator failed to evoke a timely response from emergency services.

Rapport reports that Johan Swarts only received a call from responders while in hospital on the day after he suffered a serious crash, despite paying a R574.99 (US$31) monthly subscription for the service.

He told Rapport that a Garmin product manager only responded two months after his complaints and said the SOS was only received on 18 February, a day after the accident.

So, yes testing is important as well as informing someone where you are going and when you expect to be back, but this is extremely concerning as such devices (along the expense they incur) are intended for use in the most dire emergencies. South Africa, as well as the rest of Africa, has some very isolated areas.

As of 2024 there are yet no reliable satellite services in Africa for ordinary cellphones, so the only option is a full-blown satellite phone (of course with its associated cost that many cannot afford).

Seems it did actually work if the message came through a day later. But where did it come through to a day later, and why? It's like a key piece of the puzzle is just missing here. Certainly a radio transmission is almost instantaneous, it does not transmit "slowly" over 24 hours. Seems to me, there was some human or system failure between the UK and SA? Due to the nature of this service, it warrants a really thorough investigation.

See https://mybroadband.co.za/news/gadgets/536343-garmin-sos-fails-south-african-biker-after-accident.html

#technology #SouthAfrica #Garmin #motorcycling

darrenolivier,
@darrenolivier@mastodon.social avatar

@gadgeteer That call from SAMSA is interesting. Seems someone got the wires crossed on the responsible agency.

darrenolivier,
@darrenolivier@mastodon.social avatar

@gadgeteer That's so ridiculous. It seems there's been a lot of effort to roll out new customer-side SOS alert and notification services without enough thought and development of the actual operational response side.

sigstart, to random

A respected security researcher, speaking on condition of anonymity, confirmed the leak appeared legitimate.

They said the data came from the DOD, not an affiliated company like Armscor or Denel.

https://mybroadband.co.za/news/security/505562-russian-group-hacks-south-african-department-of-defence-allegedly-leaks-ramaphosas-number.html

darrenolivier,
@darrenolivier@mastodon.social avatar

@danie10 @singe @sigstart That should be assumed.

South Africa has done the same. It had a very embarrassing situation in 2005 when a South African Secret Service handler and his entire network of highly placed officials were rounded up, even though SA and Zim were very close at the time. It happened again in Mozambique in 2021, just before we sent troops there.

SITA had some good initial capabilities as it was originally formed from the DoD, SAPS, and DOSE's IT departments.

darrenolivier,
@darrenolivier@mastodon.social avatar

@danie10 @singe @sigstart On the upside, judging by what those trawling through the archive are posting there’s nothing SECRET or TOP SECRET yet. Just RESTRICTED and CONFIDENTIAL. But there’s potentially a lot more data coming.

If the correct rules were followed there shouldn’t be anything TS/S, but then again if the correct rules were followed there wouldn’t be a breach of this magnitude and people wouldn’t have stored personal files on work systems…

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @danie10 @sigstart Thanks. That’s really bad. It would mean that either document security has been lax and those files have been allowed on the regular networks, which is not unheard of, or that the group got into the segregated networks too.

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @danie10 @sigstart Meanwhile the DoD remains in denial. There’s no way this is a leak from an individual.

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @danie10 @sigstart Great question. As spin goes it’s amateurish stuff.

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @danie10 @sigstart Agreed, but I’m entirely unsurprised and I’ve long said that we should assume that any competent state has mostly unlimited access to these types of DoD and other government systems. The warnings about poor security, inadequate skills, and outdated systems have been ignored for years. There was a CSIR team doing very basic vuln scans of government’s IP space a few years ago. They found tons and were told to stop.

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @suqdiq @danie10 @sigstart Yes. Though I’ve seen some claims that Snatch is a GRU front operation. That might explain the timing of the release just before the BRICS summit.

darrenolivier,
@darrenolivier@mastodon.social avatar

@suqdiq @singe @danie10 @sigstart Not saying it’s impossible, just that it elevates the seriousness and scope of the breach if so.

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @danie10 @sigstart DoD IT systems are managed by CMIS within the DoD and SITA from the outside, but neither really have the specialist skills for the role. SITA used to, as it was formed partially from the DoD’s previous IT division, but it has become much more generically corporate focused of late.
Many of the DoD’s enterprise systems are woefully outdated. Including ancient and unpatched IIS servers.

darrenolivier,
@darrenolivier@mastodon.social avatar

@danie10 @singe @sigstart There is definitely some level of magical thinking and denial going on there, judging by the conversations I’ve had.

The top brass for the most part also don’t have the best understanding of technology, given their age.

The DoD also still generally insists on treating IT purchases like other systems with irregular acquisitions & upgrades to on-prem SITA-managed systems rather than adopting a constantly updated managed services model.

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @suqdiq @danie10 I can’t say I can see a clear rationale either, it’s just an additional factor.

Three potential reasons:

  1. Putin is more upset at being effectively disinvited from the summit than was let on, and this is a retaliation.
  2. This may have been another arm of the Russian government retaliating for a perceived slight, both for this and Ramaphosa’s more Ukraine-friendly comments.
  3. It was just a target of opportunity, Snatch was independent, and the timing is meaningless.
darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @suqdiq @danie10 We should be treating 3) as the most likely scenario while not discounting 1) and 2) entirely IMO.

But, yes. If this group was in DoD networks for months and months there’s no doubt there are nation state APTs doing the same.

darrenolivier,
@darrenolivier@mastodon.social avatar

@mensrea @singe @danie10 @sigstart If I can add some context.

There are two main types of networks in the DoD. The standard enterprise network, called the ‘Black’ network, that hosts Outlook, the intranet, network shares, and all your normal enterprise stuff. That’s what was likely hit.

Then there are multiple air gapped ‘Red’ networks for TS/S material & operational systems. They’re not meant to be connected to the Black network anywhere & I assume are still safe.

darrenolivier,
@darrenolivier@mastodon.social avatar

@mensrea @singe @danie10 @sigstart According to protocols there should never be any TS/S material stored on any ‘Black’ network or computer. Only RESTRICTED and CONFIDENTIAL material. But in practice that hasn’t been as controlled as it should’ve been.

I don’t think this is a breach of the DoD’s core ‘Red’ networks based on what I’ve seen so far.

darrenolivier,
@darrenolivier@mastodon.social avatar

@danie10 @singe @suqdiq Sure, and I have no doubt that China and Russia have been spying heavily on South Africa. We’d be naive to believe otherwise.

Releasing the material publicly is another matter though.

darrenolivier,
@darrenolivier@mastodon.social avatar

@mensrea @singe @danie10 @sigstart The ‘Black’ network/intranet is mostly run by SITA along normal enterprise lines.

The Red networks are mostly managed by internal SANDF personnel, such as those in CMIS, and cleared contractors to my knowledge.

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @suqdiq @danie10 I generally agree, but I also think it's unlikely that Russian intelligence has no knowledge of or influence over this group. That nothing has been done so far seems to imply that they're okay with it, which has interesting geopolitical implications.

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @suqdiq @danie10 An insider isn't impossible, but as far as I know even with how lax security is nobody internal should've been able to access this much using their normal permissions. Not even the sysadmins.

darrenolivier, (edited )
@darrenolivier@mastodon.social avatar

@singe @suqdiq @danie10 Turns out SITA issued an urgent R7.6m tender in March this year to Cyber1 Solutions for "Darktrace Network Detection and response tool On-Premise NDR licences and maintenance and support Department of Defence (DoD) for twelve months."

I can't imagine why that would've been done except as a response to this attack.

darrenolivier,
@darrenolivier@mastodon.social avatar

@singe @suqdiq @danie10 Thanks! It was a bit lucky, I came across it while looking for something else entirely.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • provamag3
  • kavyap
  • DreamBathrooms
  • tacticalgear
  • magazineikmin
  • khanakhh
  • everett
  • Youngstown
  • mdbf
  • slotface
  • rosin
  • ethstaker
  • InstantRegret
  • thenastyranch
  • JUstTest
  • ngwrru68w68
  • anitta
  • cubers
  • osvaldo12
  • modclub
  • GTA5RPClips
  • tester
  • Durango
  • megavids
  • cisconetworking
  • Leos
  • normalnudes
  • lostlight
  • All magazines
    •