This tutorial forms a part of a new series which will concentrate on some of the non-GUI related issues in Windows programming. The subject of this tutorial will be the CreateProcess win32 API call. The tutorial is split into several sections, each one describing…

In this post, we’re going to take a quick look at Frida and use it to steel credentials from KeePass.

Reverse engineering software using a full system simulator - mfthomps/RESim

New #APT34 tool leaked. “Jason” #infosec #malware

This post walks through the discovery process of the NVIDIA GeForce Experience OS command injection vulnerability, assigned to CVE-2019-5678.

Introduction Previous Research AMSI Example in C AMSI Context AMSI Initialization AMSI Scanning CLR Implementation of AMSI AMSI Bypass A (Patching Data) AMSI Bypass B (Patching Code 1) AMSI Bypass …

Backward Compatibility is Hard, and so is Stacked Impersonation by Simon Raner and Mitja Kolsek, the 0patch Team [Update 6/12/201...

Slides and material from 2019 Security Data Science Colloquium hosted by Microsoft - ramshans/2019-Security-Data-Science-Colloquium-

Hundreds of incredibly popular and widely deployed Java libraries & JVM compilers are still downloading their dependencies over HTTP with…

In this case study of OS X digital forensics, we were tasked to recover the version history of documents created using Apple’s TextEdit application.

Earlier this week, Microsoft issued patches for CVE-2019-1040, which is a vulnerability that allows for bypassing of NTLM relay mitigations. The vulnerability was discovered by Marina Simakov and Yaron Zinar (as well as several others credited in the Microsoft…

An API misconfiguration in the open-source version of the popular DevOps tool Docker Engine-Community allows attackers to infiltrate containers and run a variant of AESDDoS.