Using process creation properties to catch evasion techniques https://www.microsoft.com/security/blog/2022/06/30/using-process-creation-properties-to-catch-evasion-techniques/
Microsoft News
Using process creation properties to catch evasion techniques
We developed a robust detection method in Microsoft Defender for Endpoint that can catch known and unknown variations of a process execution class used by attackers to evade detection. This class of stealthy execution techniques include process doppelganging…
Amazon Confirmed and Fixed a High Severity Vulnerability of Broken Authentication in Amazon Photos Android App
https://checkmarx.com/blog/amazon-confirmed-and-fixed-a-high-severity-vulnerability-of-broken-authentication-in-amazon-photos-android-app/#MobileSecurity
https://checkmarx.com/blog/amazon-confirmed-and-fixed-a-high-severity-vulnerability-of-broken-authentication-in-amazon-photos-android-app/#MobileSecurity
Checkmarx.com
Amazon Confirmed and Fixed a High Severity Vulnerability of Broken Authentication in Amazon Photos Android App
Our research team at Checkmarx found that the Amazon Photos Android app could have allowed a malicious application, installed on the user’s phone, to steal their Amazon access token. The Android app has over 50 million downloads.
Hacking my Tesla Model 3 - Security Overview https://fn.lc/post/tesla-model-3/
nday exploit: netgear orbi unauthenticated command injection (cve-2020-27861) https://blog.coffinsec.com//research/2022/07/02/orbi-nday-exploit-cve-2020-27861.html
hyprblog
nday exploit: netgear orbi unauthenticated command injection (CVE-2020-27861)
rediscovering and developing a weaponized exploit for a command injection vulnerability in Orbi wifi systems that was reported and patched last year.
Reversing of malware network protocols with angr https://www.securityartwork.es/2018/04/09/reversing-of-malware-network-protocols-with-angr/
Security Art Work
‘Reversing’ of malware network protocols with ‘angr’ - Security Art Work
One of the most difficult objectives to obtain in the analysis of a malicious binary is usually discovering all of the functionalities that it has. If in addition, these functions are only executed at the discretion of the attackers through its control center…
Toll fraud malware: How an Android application can drain your wallet https://www.microsoft.com/security/blog/2022/06/30/toll-fraud-malware-how-an-android-application-can-drain-your-wallet/
Microsoft News
Toll fraud malware: How an Android application can drain your wallet
Toll fraud malware, a subcategory of billing fraud in which malicious applications subscribe users to premium services without their knowledge or consent, is one of the most prevalent types of Android malware – and it continues to evolve.
Flubot: the evolution of a notorious Android Banking Malware https://blog.fox-it.com/2022/06/29/flubot-the-evolution-of-a-notorious-android-banking-malware/
Fox-IT International blog
Flubot: the evolution of a notorious Android Banking Malware
Authored by Alberto Segura (main author) and Rolf Govers (co-author) Summary Flubot is an Android based malware that has been distributed in the past 1.5 years inEurope, Asia and Oceania affecting …
BlackCat — In a Shifting Threat Landscape, It Helps to Land on Your Feet: Tech Dive https://www.advintel.io/post/blackcat-in-a-shifting-threat-landscape-it-helps-to-land-on-your-feet-tech-dive
AdvIntel
BlackCat — In a Shifting Threat Landscape, It Helps to Land on Your Feet: Tech Dive
By Vitali Kremez, Marley Smith & Yelisey Boguslavskiy This report is part one of AdvIntel’s new series on the ALPHV (aka BlackCat) ransomware group. In the upcoming part two, AdvIntel will hold an analytical lens on BlackCat’s organizational, recruitment…
Practical Attacks on Machine Learning Systems (nice whitepaper from NCC Group Research) https://research.nccgroup.com/2022/07/06/whitepaper-practical-attacks-on-machine-learning-systems/
NCC Group Research Blog
Whitepaper – Practical Attacks on Machine Learning Systems
This paper collects a set of notes and research projects conducted by NCC Group on the topic of the security of Machine Learning (ML) systems. The objective is to provide some industry perspective …
Bulk Analysis of Cobalt Strike's Beacon Configurations
https://www.archcloudlabs.com/projects/bulk-cs-analysis/
https://www.archcloudlabs.com/projects/bulk-cs-analysis/
Arch Cloud Labs
Bulk Analysis of Cobalt Strike's Beacon Configurations
About The Project Security researcher Silas Cutler recently tweeted a link to a unique data set of Cobalt Strike Beacon payloads, and their extracted configurations (thanks Silas!). This is a fairly large data set going back to November of 2021, and containing…
Revisiting Pegasus on iOS9 https://shadowfile.inode.link/blog/2022/07/revisiting-pegasus-on-ios9/
The Shadow File
Revisiting Pegasus on iOS9
Reverse Engineering Dark Souls 3 Networking (good series here!) https://timleonard.uk/2022/05/29/reverse-engineering-dark-souls-3-networking
Tim Leonard’s Website
Reverse Engineering Dark Souls 3 Networking (#1 - Connection)
Breaking down and investigating how Dark Souls 3 communicates with its online services.
Google CTF 2022 d8: From V8 Bytecode to Code Execution https://mem2019.github.io/jekyll/update/2022/07/03/Google-CTF.html
mem2019.github.io
Google CTF 2022 d8: From V8 Bytecode to Code Execution
This weekend I have played Google CTF with r3kapig. On the first day I tried the OCR challenge but failed to solve it, and on the second day I spent the whol...
From NtObjectManager to PetitPotam https://clearbluejar.github.io/posts/from-ntobjectmanager-to-petitpotam/
clearbluejar
From NtObjectManager to PetitPotam
Windows RPC enumeration, discovery, and auditing via NtObjectManager. We will audit the vulnerable RPC interfaces that lead to PetitPotam, discover how they have changed over the past year, and overcome some common RPC auditing pitfalls.
One I/O Ring to Rule Them All: A Full Read/Write Exploit Primitive on Windows 11 https://windows-internals.com/one-i-o-ring-to-rule-them-all-a-full-read-write-exploit-primitive-on-windows-11/
WarCon 2022 – Modern Initial Access and Evasion Tactics https://mgeeky.tech/warcon-2022-modern-initial-access-and-evasion-tactics/
Automating binary vulnerability discovery with Ghidra and Semgrep https://security.humanativaspa.it/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep/
HN Security
HN Security Automating binary vulnerability discovery with Ghidra and Semgrep
Introducing new binary vulnerability research tools and methodology, based on custom Ghidra plugins and Semgrep.
Nice interesting discussion and research on forensics here » University of Adelaide's Dr. Matthew Sorell on Evidentiary Health Data at DFRWS-APAC 2022 https://www.forensicfocus.com/podcast/university-of-adelaides-dr-matthew-sorell-on-evidentiary-health-data-at-dfrws-apac-2022/
Windows Registry Forensic Analysis using Chainsaw, Wazuh Agent and Sigma Rules https://socfortress.medium.com/windows-registry-forensic-analysis-using-chainsaw-wazuh-agent-and-sigma-rules-40dbceba7201
Medium
Windows Registry Forensic Analysis using Chainsaw, Wazuh Agent and Sigma Rules
Introduction.