Writing a Linux Kernel Remote in 2022 https://blog.immunityinc.com/p/writing-a-linux-kernel-remote-in-2022/
Anatomy of a Zero Day - How to decrypt....a robot? https://dolosgroup.io/blog/2022/4/28/anatomy-of-a-zero-day-how-to-decrypt-a-robot
Dolos Group
Anatomy of a Zero Day - How to decrypt....a robot? — Dolos Group
That title would have sounded very weird to me a year ago but that’s exactly what happened. Let me walk you through how we were approached by a client for a code review, had to find a zero day just to get started (CVE-2022-29856), and ultimately “decrypted…
Malicious relays and the health of the Tor network https://blog.torproject.org/malicious-relays-health-tor-network/
blog.torproject.org
Malicious relays and the health of the Tor network | Tor Project
In this post, we'll explain what we do to fight malicious relays in our network, how we did in the past, and what further improvements are upcoming and being worked on.
Azure Monitor – Malicious KQL Query https://securecloud.blog/2022/04/27/azure-monitor-malicious-kql-query/
SecureCloudBlog
Azure Monitor – Malicious KQL Query
Malicious KQL Query: Malicious KQL query is injection technique, where attacker with targetable workspace resourceID can inject listener of access tokens in the query. The attacker then uses the ga…
Colibri Loader's unique Persistence Technique using Get-Variable cmdlet https://fourcore.io/blogs/colibri-loader-powershell-get-variable-persistence
FourCore
Colibri Loader's unique Persistence Technique using Get-Variable cmdlet
Colibri Loader uses a novel method of Persistence which makes use of Get-Variable cmdlet to run its executable every time powershell is launched. Here we cover the method, why it works, and how to detect such TTPs.
Kubernetes Cluster: Attack and Defense Perspective Part-2
Importance of Network Policies https://smart7.in/2022/03/30/Kubernetes-Cluster-Attack-Defense-Importance-of-Network-Policies.html
Importance of Network Policies https://smart7.in/2022/03/30/Kubernetes-Cluster-Attack-Defense-Importance-of-Network-Policies.html
smart7.in
Kubernetes Cluster: Attack and Defense Perspective Part-2 - Security Blogs
Hi all,
Microsoft finds new elevation of privilege Linux vulnerability, Nimbuspwn https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/
Microsoft News
Microsoft finds new elevation of privilege Linux vulnerability, Nimbuspwn
Microsoft has discovered several vulnerabilities, collectively referred to as Nimbuspwn, that could be chained together, allowing an attacker to elevate privileges to root on many Linux desktop endpoints. Leveraging Nimbuspwn as a vector for root access could…
Quantum Ransomware https://thedfirreport.com/2022/04/25/quantum-ransomware/
The DFIR Report
Quantum Ransomware
In one of the fastest ransomware cases we have observed, in under four hours the threat actors went from initial access, to domain wide ransomware. The initial access vector for this case was an Ic…
Introduction to VirtualBox security research https://blog.doyensec.com/2022/04/26/vbox-fuzzing.html
Doyensec
Introduction to VirtualBox security research
This article introduces VirtualBox research and explains how to build a coverage-based fuzzer, focusing on the emulated network device drivers. In the examples below, we explain how to create a harness for the non-default network device driver PCNet. The…
CVE-2022-0543 Technical Analysis https://attackerkb.com/topics/wyA1c1HIC8/cve-2022-0543/rapid7-analysis
AttackerKB
CVE-2022-0543 | AttackerKB
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could resul…
Emotet fixes bug in code, resumes spam campaign https://blog.malwarebytes.com/cybercrime/malware/2022/04/emotet-fixes-bug-in-code-resumes-spam-campaign/
Malwarebytes
Emotet fixes bug in code, resumes spam campaign
Emotet is back with a new spam campaign. And it's now spreading itself as a shortcut link file pretending to be Word document.
A flow-based IDS using Machine Learning in eBPF https://arxiv.org/abs/2102.09980#
RW-Fuzzer: A Fuzzing Method for Vulnerability Mining on Router Web Interface https://www.hindawi.com/journals/wcmc/2022/5311295
Hindawi
As the main routing device of the network, most routers can be set up and managed through their web enabled admin portal. This…
RW-Fuzzer: A Fuzzing Method for Vulnerability Mining on Router Web Interface
Osinteye - Username Enumeration And Reconnaisance Suite https://www.kitploit.com/2022/04/osinteye-username-enumeration-and.html
KitPloit - PenTest & Hacking Tools
Osinteye - Username Enumeration And Reconnaisance Suite
NahamCon CTF 2022 Write-up: Click Me! Android challenge https://infosecwriteups.com/nahamcon-ctf-2022-write-up-click-me-android-challenge-63ccba7cb663
Medium
NahamCon CTF 2022 Write-up: Click Me! Android challenge
NahamSec, John Hammond & few other folks hosted a CTF this weekend. I solved Android challenges, the challenges were really fun. I decided…
Analysis on recent wiper attacks: examples and how wiper malware works https://cybersecurity.att.com/blogs/labs-research/analysis-on-recent-wiper-attacks-examples-and-how-they-wiper-malware-works
LevelBlue
Analysis on recent wiper attacks: examples and how wiper…
Executive summary 2022 has experienced an increase in the number of wiper variants targeting Ukrainian entities. This blog post looks to explain how wipers work, what makes them so effective and provides a short overview of the most recent samples that appeared…
Ngrok Threat Hunting: Detect Hackers at the End of the Tunnel https://www.socinvestigation.com/ngrok-threat-hunting-detect-hackers-at-the-end-of-the-tunnel/
Security Investigation - Be the first to investigate
Ngrok Threat Hunting: Detect Hackers at the End of the Tunnel - Security Investigation
What is Ngrok? Ngrok is a program that allows you to access your private systems that are behind NAT or a firewall from the outside (internet). It's an encrypted TCP tunnel that provides an address that anyone can access from the internet, and then connects…
Nice webpage! » Malvuln: Finding and exploiting vulnerable Malware. https://www.malvuln.com/
Malvuln
Malvuln – Malware Vulnerability Research & Exploits Database
Unique source for malware vulnerability research, exploits, and threat intelligence. Track security flaws in malware and C2 infrastructure.
Outlets tricked by 7-zip CVE-2022-29072 hoax https://docs.google.com/document/d/1uZaoOTRNL9DweLNZPIX4Qz2PbwjJ5BkU-sDg2ojur7M/edit
Google Docs
Outlets tricked by 7-zip CVE-2022-29072 hoax
On April 15, 2022, @kagancapar posted a hoax vulnerability as CVE-2022-29072 in 7-zip. While not even a plausible description or demonstration of a vulnerability, multiple people were tricked by it. Let’s see who was tricked, and if they have made any updates…