Towards Detecting Compromised Accounts on Social Networks

Compromising social network accounts has become a profitable course of action for cybercriminals. By hijacking control of a popular media or business account, attackers can distribute their malicious messages or disseminate fake information to a large user base. The impacts of these incidents range from a tarnished reputation to multi-billion dollar monetary losses on financial markets. In our previous work, we demonstrated how we can detect large-scale compromises (i.e., so-called campaigns) of regular online social network users. In this work, we show how we can use similar techniques to identify compromises of individual high-profile accounts. High-profile accounts frequently have one characteristic that makes this detection reliable -- they show consistent behavior over time. We show that our system, were it deployed, would have been able to detect and prevent three real-world attacks against popular companies and news agencies. Furthermore, our system, in contrast to popular media, would not have fallen for a staged compromise instigated by a US restaurant chain for publicity reasons

7‑hydroxymitragynine is an active metabolite of mitragynine and a key mediator of its analgesic effects

Mitragynina speciosa, more commonly known as kratom, is a plant native to Southeast Asia, the leaves of which have been used traditionally as a stimulant, analgesic, and treatment for opioid addiction. Recently, growing use of the plant in the United States and concerns that kratom represents an uncontrolled drug with potential abuse liability, have highlighted the need for more careful study of its pharmacological activity. The major active alkaloid found in kratom, mitragynine, has been reported to have opioid agonist and analgesic activity in vitro and in animal models, consistent with the purported effects of kratom leaf in humans. However, preliminary research has provided some evidence that mitragynine and related compounds may act as atypical opioid agonists, inducing therapeutic effects such as analgesia, while limiting the negative side effects typical of classical opioids. Here we report evidence that an active metabolite plays an important role in mediating the analgesic effects of mitragynine. We find that mitragynine is converted in vitro in both mouse and human liver preparations to the much more potent mu-opioid receptor agonist 7-hydroxymitragynine, and that this conversion is mediated by cytochrome P450 3A isoforms. Further, we show that 7-hydroxymitragynine is formed from mitragynine in mice and that brain concentrations of this metabolite are sufficient to explain most or all of the opioid-receptor-mediated analgesic activity of mitragynine. At the same time, mitragynine is found in the brains of mice at very high concentrations relative to its opioid receptor binding affinity, suggesting that it does not directly activate opioid receptors. The results presented here provide a metabolism-dependent mechanism for the analgesic effects of mitragynine and clarify the importance of route of administration for determining the activity of this compound. Further, they raise important questions about the interpretation of existing data on mitragynine and highlight critical areas for further research in animals and humans.</p

Molecular Gas in Candidate Double-Barred Galaxies II. Cooler, Less Dense Gas Associated with Stronger Central Concentrations

We have performed a multi-transition CO study of the centers of seven double-barred galaxies that exhibit a variety of molecular gas morphologies to determine if the molecular gas properties are correlated with the nuclear morphology and star forming activity. Near infrared galaxy surveys have revealed the existence of nuclear stellar bars in a large number of barred or lenticular galaxies. High resolution CO maps of these galaxies exhibit a wide range of morphologies. Recent simulations of double-barred galaxies suggest that variations in the gas properties may allow it to respond differently to similar gravitational potentials. We find that the 12CO J=3-2/J=2-1 line ratio is lower in galaxies with centrally concentrated gas distributions and higher in galaxies with CO emission dispersed around the galactic center in rings and peaks. The 13CO/12CO J=2-1 line ratios are similar for all galaxies, which indicates that the J=3-2/J=2-1 line ratio is tracing variations in gas temperature and density, rather than variations in optical depth. There is evidence that the galaxies which contain more centralized CO distributions are comprised of molecular gas that is cooler and less dense. Observations suggest that the star formation rates are higher in the galaxies containing the warmer, denser, less centrally concentrated gas. It is possible that either the bar dynamics are responsible for the variety of gas distributions and densities (and hence the star formation rates) or that the star formation alone is responsible for modifying the gas properties.Comment: 27 pages + 6 figures; to appear in the April 20, 2003 issue of Ap

On the Feasibility of Malware Authorship Attribution

There are many occasions in which the security community is interested to discover the authorship of malware binaries, either for digital forensics analysis of malware corpora or for thwarting live threats of malware invasion. Such a discovery of authorship might be possible due to stylistic features inherent to software codes written by human programmers. Existing studies of authorship attribution of general purpose software mainly focus on source code, which is typically based on the style of programs and environment. However, those features critically depend on the availability of the program source code, which is usually not the case when dealing with malware binaries. Such program binaries often do not retain many semantic or stylistic features due to the compilation process. Therefore, authorship attribution in the domain of malware binaries based on features and styles that will survive the compilation process is challenging. This paper provides the state of the art in this literature. Further, we analyze the features involved in those techniques. By using a case study, we identify features that can survive the compilation process. Finally, we analyze existing works on binary authorship attribution and study their applicability to real malware binaries.Comment: FPS 201

The Different Structures of the Two Classes of Starless Cores

We describe a model for the thermal and dynamical equilibrium of starless cores that includes the radiative transfer of the gas and dust and simple CO chemistry. The model shows that the structure and behavior of the cores is significantly different depending on whether the central density is either above or below about 10^5 cm-3. This density is significant as the critical density for gas cooling by gas-dust collisions and also as the critical density for dynamical stability, given the typical properties of the starless cores. The starless cores thus divide into two classes that we refer to as thermally super-critical and thermally sub-critical.This two-class distinction allows an improved interpretation of the different observational data of starless cores within a single model.Comment: ApJ in pres

High-excitation OH and H_2O lines in Markarian 231: the molecular signatures of compact far-infrared continuum sources

The ISO/LWS far-infrared spectrum of the ultraluminous galaxy Mkn 231 shows OH and H_2O lines in absorption from energy levels up to 300 K above the ground state, and emission in the [O I] 63 micron and [C II] 158 micron lines. Our analysis shows that OH and H_2O are radiatively pumped by the far-infrared continuum emission of the galaxy. The absorptions in the high-excitation lines require high far-infrared radiation densities, allowing us to constrain the properties of the underlying continuum source. The bulk of the far-infrared continuum arises from a warm (T_dust=70-100 K), optically thick (tau_100micron=1-2) medium of effective diameter 200-400 pc. In our best-fit model of total luminosity L_IR, the observed OH and H2O high-lying lines arise from a luminous (L/L_IR~0.56) region with radius ~100 pc. The high surface brightness of this component suggests that its infrared emission is dominated by the AGN. The derived column densities N(OH)>~10^{17} cm^{-2} and N(H_2O)>~6x10^{16} cm^{-2} may indicate XDR chemistry, although significant starburst chemistry cannot be ruled out. The lower-lying OH, [C II] 158 micron, and [O I] 63 micron lines arise from a more extended (~350 pc) starburst region. We show that the [C II] deficit in Mkn 231 is compatible with a high average abundance of C+ because of an extreme overall luminosity to gas mass ratio. Therefore, a [C II] deficit may indicate a significant contribution to the luminosity by an AGN, and/or by extremely efficient star formation.Comment: 16 pages, 6 figures, accepted for publication in The Astrophysical Journa

SARS-CoV-2 / COVID-19 in patients on the Swiss national transplant waiting list.

The impact of coronavirus disease 2019 (COVID-19) on patients listed for solid organ transplantation has not been systematically investigated to date. Thus, we assessed occurrence and effects of infections with severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) on patients on the Swiss national waiting list for solid organ transplantation. Patient data were retrospectively extracted from the Swiss Organ Allocation System (SOAS). From 16 March to 31 May 2020, we included all patients listed for solid organ transplantation on the Swiss national waiting list who were tested positive for SARS-CoV-2. Severity of COVID-19 was categorised as follows: stage I, mild symptoms; stage II, moderate to severe symptoms; stage III, critical symptoms; stage IV, death. We compared the incidence rate (laboratory-confirmed cases of SARS-CoV-2), the hospital admission rate (number of admissions of SARS-CoV-2-positive individuals), and the case fatality rate (number of deaths of SARS-CoV-2-positive individuals) in our study population with the general Swiss population during the study period, calculating age-adjusted standardised incidence ratios and standardised mortality ratios, with 95% confidence intervals (CIs). A total of 1439 patients were registered on the Swiss national solid organ transplantation waiting list on 31 May 31 2020. Twenty-four (1.7%) waiting list patients were reported to test positive for SARS-CoV-2 in the study period. The median age was 56 years (interquartile range 45.3&amp;ndash;65.8), and 14 (58%) were male. Of all patients tested positive for SARS-CoV-2, two patients were asymptomatic, 14 (58%) presented in COVID-19 stage I, 3 (13%) in stage II, and 5 (21%) in stage III. Eight patients (33%) were admitted to hospital, four (17%) required intensive care, and three (13%) mechanical ventilation. Twenty-two patients (92%) of all those infected recovered, but two male patients aged &amp;gt;65 years with multiple comorbidities died in hospital from respiratory failure. Comparing our study population with the general Swiss population, the age-adjusted standardised incidence ratio was 4.1 (95% CI 2.7&amp;ndash;6.0). The overall rate of SARS-CoV-2 infections in candidates awaiting solid organ transplantation was four times higher than in the Swiss general population; however, the frequency of testing likely played a role. Given the small sample size of affected patients, conclusions have to be drawn cautiously and results need verification in larger cohorts

EvilCohort: Detecting Communities of Malicious Accounts on Online Services

Cybercriminals misuse accounts on online services (e.g., webmails and online social networks) to perform malicious activity, such as spreading malicious content or stealing sensitive information. In this paper, we show that accounts that are accessed by botnets are a popular choice by cybercriminals. Since botnets are composed of a finite number of infected computers, we observe that cybercriminals tend to have their bots connect to multiple online accounts to perform malicious activity. We present EVILCOHORT, a system that detects online accounts that are accessed by a common set of infected machines. EVILCOHORT only needs the mapping between an online account and an IP address to operate, and can therefore detect malicious accounts on any online service (webmail services, online social networks, storage services) regardless of the type of malicious activity that these accounts perform. Unlike previous work, our system can identify malicious accounts that are controlled by botnets but do not post any malicious content (e.g., spam) on the service. We evaluated EVILCOHORT on multiple online services of different types (a webmail service and four online social networks), and show that it accurately identifies malicious accounts