The Long Tail of Log4Shell Exploitation https://www.horizon3.ai/the-long-tail-of-log4shell-exploitation/
Horizon3.ai
The Long Tail of Log4Shell Exploitation
It’s been more than six months since the Log4Shell vulnerability (CVE-2021-44228) was disclosed, and a number of post-mortems have come out talking about lessons learned and ways to prevent the next Log4Shell-type event from happening.
Mantis - the most powerful botnet to date https://blog.cloudflare.com/mantis-botnet/
Retbleed: Arbitrary Speculative Code Execution with Return Instructions https://comsec.ethz.ch/research/microarch/retbleed/
CVE-2022-32223 Discovery: DLL Hijacking via npm CLI https://blog.aquasec.com/cve-2022-32223-dll-hijacking
Aqua
CVE-2022-32223 Discovery: DLL Hijacking via npm CLI
Team Nautilus has recently discovered a vulnerability in Node.js that can lead to DLL hijacking on Windows via npm CLI if OpenSSL is installed on the host
Decoding Cobalt Strike: Understanding Payloads https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/
Gendigital
Decoding Cobalt Strike: Understanding payloads
Identifying and Parsing Cobalt Payloads
Genesis - The Birth of a Windows Process (Part 1 & Part 2) https://fourcore.io/blogs/how-a-windows-process-is-created-part-1 https://fourcore.io/blogs/how-a-windows-process-is-created-part-2
FourCore
Genesis - The Birth of a Windows Process (Part 1)
What happens when you run an executable on your Windows machine? This blog provides a brief overview and the flow for creating a Windows Process, the APIs and structures involved, and the Process Internals.
Reversing C++, Qt based applications using Ghidra https://ktln2.org/reversing-c%2B%2B-qt-applications-using-ghidra/
Gianluca Pacchiella
Reversing C++, Qt based applications using Ghidra
This post is going to be too ambitious probably: I want to introduce you to
reversing C++ code, applying this knowledge in particular to Qt
applications and since we are at it, explaining some ghidra
reversing C++ code, applying this knowledge in particular to Qt
applications and since we are at it, explaining some ghidra
Process Injection using QueueUserAPC Technique in Windows https://tbhaxor.com/windows-process-injection-using-asynchronous-threads-queueuserapc/
tbhaxor's Blog
Process Injection using QueueUserAPC Technique in Windows
You will learn the fundamentals of user mode asynchronous procedure calls in this post, as well as how to use them to inject shellcode into a remote process thread to obtain a reverse shell.
Ongoing Roaming Mantis smishing campaign targeting France https://blog.sekoia.io/ongoing-roaming-mantis-smishing-campaign-targeting-france/
Sekoia.io Blog
Ongoing Roaming Mantis smishing campaign targeting France
MoqHao (aka Wroba) is an Android Remote Access Trojan (RAT) with information-stealing and backdoor capabilities that likely spreads via SMS.
The Workings of Whatsapp's Backups (and why you should enable End-to-End Encrypted Backups) https://sudneela.github.io/posts/the-workings-of-whatsapps-end-to-end-encrypted-backups/
snee.la
The Workings of WhatsApp’s Backups (and Why You Should Enable End-to-End Encrypted Backups)
About This Blog Post This blog post is a technical report of a presentation that I presented on June 10, 2022 for the second task of my Mobile Security course. I decided to investigate how WhatsApp backs up messages to the cloud with the “end-to-end encrypted…
nice series here » Lord Of The Ring0 - Part 1 | Introduction https://idov31.github.io/2022-07-14-lord-of-the-ring0-p1/
A Deep Dive Into ALPHV/BlackCat Ransomware https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware
SecurityScorecard
A Deep Dive Into ALPHV/BlackCat Ransomware
ALPHV/BlackCat is the first widely known ransomware written in Rust. The malware must run with an access token consisting of a 32-byte value (--access-token parameter), and other parameters can be specified. Learn about its particular behaviors.
Automated Volatility Plugin Generation with Dalvik Inspector https://www.504ensics.com/automated-volatility-plugin-generation-with-dalvik-inspector/
504ENSICS Labs
Automated Volatility Plugin Generation with Dalvik Inspector - 504ENSICS Labs
Introduction In this blog post we will be demonstrating a new feature to the Dalvik Inspector tool, which we are planning on releasing this summer at Black Hat USA. Specifically we have added functionality to the Dalvik Inspector GUI for automatic Volatility…
[CVE-2022-34918] A crack in the Linux firewall
https://www.randorisec.fr/crack-linux-firewall/
https://www.randorisec.fr/crack-linux-firewall/
Session On Android – An App Wrapped in Signal
https://thebinaryhick.blog/2022/07/14/session-on-android-an-app-wrapped-in-signal/
https://thebinaryhick.blog/2022/07/14/session-on-android-an-app-wrapped-in-signal/
The Binary Hick
Session On Android – An App Wrapped in Signal
NOTE: parts of this article describe steps by which the order of encryption methods are reversed to render encrypted data in clear-text. This was done in order to investigate the app being discusse…
The Return of Candiru: Zero-days in the Middle East https://decoded.avast.io/janvojtesek/the-return-of-candiru-zero-days-in-the-middle-east/
Gendigital
The Return of Candiru: Zero-days in the Middle East
Zero-day vulnerability in Google Chrome discovery
Anatomy of Attack: Truth Behind the Costa Rica Government Ransomware 5-Day Intrusion https://www.advintel.io/post/anatomy-of-attack-truth-behind-the-costa-rica-government-ransomware-5-day-intrusion
RedSense Cyber Threat Intelligence
RedSense Home
RedSense Cyber Threat Intelligence provides products and services to many of the world’s most sophisticated corporate threat intelligence departments and security organizations. As companies rethink their intelligence frameworks for greater efficacy and cost…
Basics for Binary Exploitation https://o5wald.github.io/posts/binary_exploitation_basics/
o5wald.github.io
Basics for Binary Exploitation
we all know how C programs is get compiled.
first your C file goes to the compiler, then compiler convert it into sequence of operation that will be executed by computer each operation compiled into sequence of bytes called operation code or OP code Why Assembly…
first your C file goes to the compiler, then compiler convert it into sequence of operation that will be executed by computer each operation compiled into sequence of bytes called operation code or OP code Why Assembly…
Gitlab Project Import RCE Analysis (CVE-2022-2185) https://starlabs.sg/blog/2022/07-gitlab-project-import-rce-analysis-cve-2022-2185/
STAR Labs
Gitlab Project Import RCE Analysis (CVE-2022-2185)
At the beginning of this month, GitLab released a security patch for versions 14->15. Interestingly in the advisory, there was a mention of a post-auth RCE bug with CVSS 9.9.
The bug exists in GitLab’s Project Imports feature, which was found by @vakzz. Incidentally…
The bug exists in GitLab’s Project Imports feature, which was found by @vakzz. Incidentally…