Treat security as a risk https://blog.frankel.ch/treat-security-as-risk/
A Java geek
Treat security as a risk
Security is the poster child of a Non-Functional Requirement: most people don’t care until the proverbial fecal matter hits the rotary propeller. Consequences can range from losing reputation to legal liability to putting the business out. In my post on running…
T-Reqs-HTTP-Fuzzer - A Grammar-Based HTTP Fuzzer https://www.kitploit.com/2022/01/t-reqs-http-fuzzer-grammar-based-http.html
KitPloit - PenTest & Hacking Tools
T-Reqs-HTTP-Fuzzer - A Grammar-Based HTTP Fuzzer
CVE-2022-0185: Detecting and mitigating Linux Kernel vulnerability causing container escape https://sysdig.com/blog/cve-2022-0185-container-escape/
Sysdig
CVE-2022-0185: Detecting and mitigating Linux Kernel vulnerability causing container escape | Sysdig
Linux maintainers and vendors disclosed a heap overflow vulnerability in the Linux Kernel causing DoS, escape container or elevate privileges
A Detailed Analysis of WhisperGate Targeting Ukrainian Organizations https://lifars.com/2022/01/a-detailed-analysis-of-whispergate-targeting-ukrainian-organizations/
LIFARS, a SecurityScorecard company
A Detailed Analysis of WhisperGate Targeting Ukrainian Organizations
Microsoft reported evidence of destructive malware targeting organizations in Ukraine starting from January 13 . The LIFARS threat intelligence team have A Detailed Analysis of WhisperGate Targeting Ukrainian Organizations
How BRATA is monitoring your bank account https://www.cleafy.com/cleafy-labs/how-brata-is-monitoring-your-bank-account
Cleafy
How BRATA is monitoring your bank account | Cleafy Labs
The mobile banking malware BRATA keeps evolving. Read here the new Technical Report, which explains in detail how it monitors banks account and how to prevent it.
New Ransomware Spotted: White Rabbit and Its Evasion Tactics https://www.trendmicro.com/en_us/research/22/a/new-ransomware-spotted-white-rabbit-and-its-evasion-tactics.html
Trend Micro
New Ransomware Spotted: White Rabbit and Its Evasion Tactics
We analyze the ransomware White Rabbit and bring into focus the familiar evasion tactics employed by this newcomer.
Modern Techniques to Prevent Malware instead of Detecting It https://www.balasys.hu/blogs/modern-techniques-to-prevent-malware-instead-of-detecting-it
www.balasys.hu
Modern Techniques to Prevent Malware instead of Detecting It
Google lists 4,840,000 results to the search of "malware detection tools." Is malware detection a silver bullet, or is there a smarter method to prevent malware attacks? We believe there is one.
Windows Process Injection: KernelCallbackTable used by FinFisher / FinSpy https://modexp.wordpress.com/2019/05/25/windows-injection-finspy/
modexp
Windows Process Injection: KernelCallbackTable used by FinFisher / FinSpy
Introduction The surveillance spyware FinFisher, also known as FinSpy, uses what Microsoft called an “interesting and quite unusual” method of process injection via the KernelCallBackTa…
CVE-2022-0329 and the problems with automated vulnerability management https://tomforb.es/cve-2022-0329-and-the-problems-with-automated-vulnerability-management/
tomforb.es
CVE-2022-0329 and the problems with automated vulnerability management
Update: Github have responded and said they will stop sending notifications about this CVE. Yesterday Github started notifying tens of thousands of people about a critical remote code execution vulnerability in a package named loguru. Their reviewed advisory…
pwnkit: Local Privilege Escalation in polkit's pkexec (CVE-2021-4034) https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
Pwnkit: How to exploit and check https://beny23.github.io/posts/pwnkit_how_to_check_and_exploit/
beny23.github.io
Pwnkit: How to exploit and check
Pwnkit is a vulnerability that uses a bug in polkit to elevate permissions to root. This write-up shows how to reproduce it using Ubuntu and what to do to check whether a system is vulnerable.
What went wrong? Quoting from the original researchers:
This…
What went wrong? Quoting from the original researchers:
This…
Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation https://github.com/ly4k/PwnKit
GitHub
GitHub - ly4k/PwnKit: Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation
Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation - ly4k/PwnKit
Heap tricks never get old - Insomni'hack teaser 2022 https://www.synacktiv.com/en/publications/heap-tricks-never-get-old-insomnihack-teaser-2022.html
Synacktiv
Heap tricks never get old - Insomni'hack teaser 2022
The Synacktiv team participated in the Insomni'hack teaser 2022 last week-end and placed 9th out of 280 teams.
Cobalt Strike, a Defender’s Guide – Part 2 https://thedfirreport.com/2022/01/24/cobalt-strike-a-defenders-guide-part-2/
The DFIR Report
Cobalt Strike, a Defender’s Guide – Part 2
Our previous report on Cobalt Strike focused on the most frequently used capabilities that we had observed. In this report, we will focus on the network traffic it produced, and provide some easy w…
Technical Analysis of CVE-2022-22583: Bypassing macOS System Integrity Protection (SIP) https://perception-point.io/technical-analysis-of-cve-2022-22583-bypassing-macos-system-integrity-protection/
Perception Point
CVE-2022-22583 Analysis: Bypassing macOS SIP
Learn about how we discovered CVE-2022-22583, a vulnerability that allows attackers to bypass macOS SIP and take control of the system.
Scanning for Generalized Transient Execution Gadgets in the Linux Kernel https://www.vusec.net/projects/kasper/
vusec
Kasper - vusec
Scanning for Generalized Transient Execution Gadgets in the Linux Kernel TL;DR We present Kasper, a transient (or speculative) execution gadget scanner. It uses taint analysis policies to model an attacker capable of exploiting arbitrary software/hardware…
Reverse engineering the 1988 NeXT keyboard protocol https://journal.spencerwnelson.com/entries/nextkb.html
Workshop: An Introduction to macOS Forensics with Open Source Software https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_workshop_macOS-forensic_jp.pdf