Yours Truly, Signed AV Driver: Weaponizing an Antivirus Driver https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
Interesting » From KBs to CVEs: Understanding the Relationships Between Windows Security Updates and Vulnerabilities https://claroty.com/2022/05/04/blog-research-from-kbs-to-cves-understanding-the-relationships-between-windows-security-updates-and-vulnerabilities/
Claroty
From KBs to CVEs: Understanding the Relationships Between Windows Security Updates and Vulnerabilities
Security vulnerabilities are regularly published by the dozens, and software vendors are in a constant race to issue updates that patch or mitigate them. This happens at an even faster pace in popular platforms that are appealing to researchers and attackers…
Anker Eufy Homebase 2 libxm_av.so DemuxCmdInBuffer buffer overflow vulnerability https://talosintelligence.com/vulnerability_reports/TALOS-2022-1480
Anker Eufy Homebase 2 libxm_av.so getpeermac() authentication bypass vulnerability https://talosintelligence.com/vulnerability_reports/TALOS-2022-1479
Ursnif Malware Banks on News Events for Phishing Attacks https://blog.qualys.com/vulnerabilities-threat-research/2022/05/08/ursnif-malware-banks-on-news-events-for-phishing-attacks
Qualys
Ursnif Malware Banks on News Events for Phishing Attacks | Qualys
Ursnif (aka Gozi, Dreambot, ISFB) is one of the most widespread banking trojans. It has been observed evolving over the past few years. Ursnif has shown incredible theft capabilities.
Frelatage v0.1 releases: coverage-based Python fuzzing library https://securityonline.info/frelatage-coverage-based-python-fuzzing-library/
Penetration Testing
Frelatage v0.1 releases: coverage-based Python fuzzing library
Frelatage is a coverage-based Python fuzzing library which can be used to fuzz python code. The functioning of a fuzzing cycle can be roughly summarized
Learning Linux kernel exploitation - Part 1 - Laying the groundwork https://0x434b.dev/dabbling-with-linux-kernel-exploitation-ctf-challenges-to-learn-the-ropes/
Low-level adventures
Learning Linux kernel exploitation - Part 1 - Laying the groundwork
Table fo contents
Disclaimer: This post will cover basic steps to accomplish a privilege escalation based on a vulnerable driver. The basis for this introduction will be a challenge from the hxp2020 CTF called "kernel-rop". There's (obviously) write…
Disclaimer: This post will cover basic steps to accomplish a privilege escalation based on a vulnerable driver. The basis for this introduction will be a challenge from the hxp2020 CTF called "kernel-rop". There's (obviously) write…
North Korea’s Lazarus: their initial access trade-craft using social media and social engineering https://research.nccgroup.com/2022/05/05/north-koreas-lazarus-and-their-initial-access-trade-craft-using-social-media-and-social-engineering/
A new secret stash for “fileless” malware https://securelist.com/a-new-secret-stash-for-fileless-malware/106393/
Securelist
A new secret stash for “fileless” malware
We observed the technique of putting the shellcode into Windows event logs for the first time “in the wild” during the malicious campaign.
Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
Microsoft News
Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself
Microsoft coined the term “human-operated ransomware” to clearly define a class of attack driven by expert human intelligence at every step of the attack chain and culminate in intentional business disruption and extortion. In this blog, we explain the ransomware…
Frappo: A New “Phishing-as-a-Service” On The Dark Web https://brandefense.io/flappo-a-new-phishing-as-a-service-on-the-darkweb/
Brandefense
Frappo: A New "Phishing-as-a-Service" On The Dark Web - Brandefense
A 0-day vulnerability has been identified in dompdf, a PHP-based HTML to PDF conversion library, that could lead to remote code execution.
Reversing Simatic S7 PLC Programs https://www.pnfsoftware.com/blog/reversing-simatic-s7-plc-programs/
Reversing an Android sample which uses Flutter https://cryptax.medium.com/reversing-an-android-sample-which-uses-flutter-23c3ff04b847
Medium
Reversing an Android sample which uses Flutter
Flutter is a framework able to build multi-platform apps (e.g. iOS and Android) from a single code base. The same source code is able to…
Exploiting a Use-After-Free for code execution in every version of Python 3 https://pwn.win/2022/05/11/python-buffered-reader.html
pwn.win
Exploiting a Use-After-Free for code execution in every version of Python 3
A while ago I was browsing the Python bug tracker, and I stumbled upon this bug - “memoryview to freed memory can cause segfault”. It was created in 2012, originally present in Python 2.7, but remains open to this day, 10 years later. This piqued my interest…
CVE-2022-21972: Windows Server VPN Remote Kernel Use After Free Vulnerability (Part 1) https://labs.nettitude.com/blog/cve-2022-21972-windows-server-vpn-remote-kernel-use-after-free-vulnerability/
LRQA
CVE-2022-21972: Windows Server VPN Remote Kernel Use After Free Vulnerability (Part 1)
CVE-2022-21972 is a Windows VPN Use after Free (UaF) vulnerability that was discovered through reverse engineering the raspptp.sys kernel driver. The vulnerability is a race condition issue and can be reliably triggered through sending crafted input to a…
Talking with the Moon: Inside Apollo's premodulation processor https://www.righto.com/2022/05/talking-with-moon-inside-apollos.html
Righto
Talking with the Moon: Inside Apollo's premodulation processor
The Apollo missions to the Moon required complex hardware to communicate between Earth and the spacecraft, sending radio signals over hund...
DuplicateDump - Dumping LSASS With A Duplicated Handle From Custom LSA Plugin https://www.kitploit.com/2022/05/duplicatedump-dumping-lsass-with.html
KitPloit - PenTest & Hacking Tools
DuplicateDump - Dumping LSASS With A Duplicated Handle From Custom LSA Plugin