cKure Red

💥

VPN Zero-Day

DYK most VPN services can actually make you less secure? Today x.com/PET_Symposium, Benjamin Mixon-Baca will present research done in collaboration with the Citizen Lab about how VPNs can enable an attacker to act as an in-path router between you and the VPN server. The study identifies a new vulnerability called a “port shadow”.

https://petsymposium.org/popets/2024/popets-2024-0070.pdf

Please open Telegram to view this post

VIEW IN TELEGRAM

X (formerly Twitter)

PETS (@PET_Symposium) on X

Official account of the Privacy Enhancing Technologies Symposium. Next event: PETS 2025, July 14-19, Washington, DC and Online.
mastodon: @PET_Symposium@infosec

2.14K views20:15

cKure Red

0:25

This media is not supported in your browser

VIEW IN TELEGRAM

🆕

WhatsApp trick: Android malware can impersonate PDF file.

https://www.mobile-hacker.com/2024/07/23/whatsapp-trick-android-malware-can-impersonate-pdf-file/

Please open Telegram to view this post

VIEW IN TELEGRAM

2.26K views09:57

cKure Red

💥

👉

Breached Forum backend data is publicly searchable.

Includes credentials, registrant IP, and last login IP, among other details.

https://bf.based.re/

Please open Telegram to view this post

VIEW IN TELEGRAM

2.21K viewsedited 21:47

cKure Red

cKure Red pinned «

💥

👉 Breached Forum backend data is publicly searchable. Includes credentials, registrant IP, and last login IP, among other details. https://bf.based.re/»

21:47

cKure Red

💎

Abusing RCU callbacks with a Use-After-Free read to defeat KASLR.

https://anatomic.rip/abusing_rcu_callbacks_to_defeat_kaslr/

Please open Telegram to view this post

VIEW IN TELEGRAM

a place of anatomical precision

Abusing RCU callbacks with a Use-After-Free read to defeat KASLR

Introduction In this article, I will be walking you through a clever technique that can be used to leak addresses and defeat KASLR in the Linux Kernel when you have a certain type of Use-After-Free by abusing RCU callbacks. It is by no means a novel technique…

2.01K views19:44

cKure Red

🎧Basic offensive security tactics for various domains.

Please open Telegram to view this post

VIEW IN TELEGRAM

1.88K views09:29

cKure Red

😎 Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit.

https://flatt.tech/research/posts/beyond-the-limit-expanding-single-packet-race-condition-with-first-sequence-sync/

Please open Telegram to view this post

VIEW IN TELEGRAM

GMO Flatt Security Research

Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit

Introduction
Hello, I’m RyotaK (@ryotkak
), a security engineer at Flatt Security Inc.
In 2023, James Kettle
of PortSwigger published an excellent paper
titled Smashing the state machine: the true potential of web race conditions.
In the paper, he introduced…

2.32K views06:10

cKure Red

💥

‼️

Cyber-Warfare
📍Apparently the Jew ✡️ (Israel) used sonic booms 💥 of fighter jets (apparently F-35s) in Beirut, Lebanon 🇱🇧 and nearby areas during the telecast of Hizbollah chief Hassan Nasrallah's speech to get his location in a corelation attack (had it been live).

https://x.com/Lonewolf8ier/status/1820825946212978816

Please open Telegram to view this post

VIEW IN TELEGRAM

1.9K viewsedited 10:56

cKure Red

0.0.0.0 Day

🔍

🦊18-year-old security flaw in Firefox and Chrome exploited in attacks.

https://www.bleepingcomputer.com/news/security/18-year-old-security-flaw-in-firefox-and-chrome-exploited-in-attacks/

Please open Telegram to view this post

VIEW IN TELEGRAM

BleepingComputer

18-year-old security flaw in Firefox and Chrome exploited in attacks

A vulnerability disclosed 18 years ago, dubbed "0.0.0.0 Day", allows malicious websites to bypass security in Google Chrome, Mozilla Firefox, and Apple Safari and interact with services on a local network.

2.72K views17:16

cKure Red

☣️

Project Zero: ‘It Will Take All of Us to End The Era of Zero Days’.

It’s becoming increasingly apparent that security research is not enough to end the era of zero days.

Natalie Silvanovich

https://duo.com/decipher/project-zero-it-will-take-all-of-us-to-end-the-era-of-zero-days

Please open Telegram to view this post

VIEW IN TELEGRAM

1.81K views05:21

cKure Red

cKure Red pinned «☣️ Project Zero: ‘It Will Take All of Us to End The Era of Zero Days’. It’s becoming increasingly apparent that security research is not enough to end the era of zero days. Natalie Silvanovich https://duo.com/decipher/project-zero-it-will-take-all-of-us…»

05:22

cKure Red

☣️ ESET's Android Malware researcher Lukas on phone hacking.

🔴youtu.be/_Jg8Ol6zbio

Please open Telegram to view this post

VIEW IN TELEGRAM

YouTube

Exploring Android Threats | Cybersecurity Podcast

Did you know a ducky can control your phone?
Welcome to Episode #5 of Unlocked 403, where we dive deep into Android security threats with Lukas Stefanko, a leading malware researcher at ESET. In this episode, we explore some of the most intriguing and dangerous…

1.9K views06:50

cKure Red

The tale of 'Incognito' darknet marketplace.

📺

https://youtu.be/Ma2Wo4wWLQ0

Please open Telegram to view this post

VIEW IN TELEGRAM

YouTube

Hunting The Dark Webs Biggest Villain

Use the code thinker at https://nordpass.com/thinker to get a free 3-month trial of NordPass Business. No credit card is required!

Watch on Spotify: https://creators.spotify.com/pod/profile/thinkeryt/

In this documentary, we dive into the shadowy world…

❤1

2.09K views13:54

cKure Red

🍊Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server.

https://blog.orange.tw/posts/2024-08-confusion-attacks-en/

Orange Tsai

Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server!

📌 [ 繁體中文 | English ] Hey there! This is my research on Apache HTTP Server presented at Black Hat USA 2024. Additionally, this research will also be presented at HITCON and OrangeCon. If you’re int

2.39K views12:54

cKure Red

cKure Red pinned «🍊Confusion Attacks: Exploiting Hidden Semantic Ambiguity in Apache HTTP Server. https://blog.orange.tw/posts/2024-08-confusion-attacks-en/»

12:54

cKure Red

2024-1275_240823_230000.pdf

777.4 KB

💳

Major Backdoor in Millions of RFID Cards Allows Instant Cloning.

https://www.securityweek.com/major-backdoor-in-millions-of-rfid-cards-allows-instant-cloning/

Please open Telegram to view this post

VIEW IN TELEGRAM

2.39K viewsedited 19:00

cKure Red

💎

Stealth Shell: A Fully Virtualized Attack Toolchain.

https://phrack.org/issues/71/14.html

Please open Telegram to view this post

VIEW IN TELEGRAM

Phrack

Stealth Shell

Click to read the article on phrack

❤1

2.22K views08:49

cKure Red

☹️

4 exploits, 1 bug: exploiting cve-2024-20017 4 different ways.

https://blog.coffinsec.com/0day/2024/08/30/exploiting-CVE-2024-20017-four-different-ways.html

Please open Telegram to view this post

VIEW IN TELEGRAM

hyprblog

4 exploits, 1 bug: exploiting CVE-2024-20017 4 different ways

a post going over 4 exploits for CVE-2024-20017, a remotely exploitable buffer overflow in a component of the MediaTek MT7622 SDK.

2.09K views14:36

cKure Red

🕯

WhenFS turns your Google Calendar into a FUSE filesystem. It whimsically supports the following features:

➡️Create a filesystem out of existing Google Calendars, or create a new one from scratch
➡️Read and write files and directories.
➡️Mount your friends' WhenFS calendar file systems to share files in the silliest way possible

https://github.com/lvkv/whenfs

Please open Telegram to view this post

VIEW IN TELEGRAM

GitHub

GitHub - lvkv/whenfs: A FUSE filesystem for your Google calendar

A FUSE filesystem for your Google calendar. Contribute to lvkv/whenfs development by creating an account on GitHub.

2.14K views14:16

cKure Red

⭐️

Exploiting New Attack Surfaces in Radio Layer 2 for Baseband RCE on Samsung Exynos.

https://labs.taszk.io/articles/post/there_will_be_bugs/

Please open Telegram to view this post

VIEW IN TELEGRAM

labs.taszk.io

Unburdened By What Has Been: Exploiting New Attack Surfaces in Radio Layer 2 for Baseband RCE on Samsung Exynos

Samsung Baseband RCE with Layer 2 Vulnerabilities

2.55K views11:40

cKure Red

💬

GAZEploit: Remote Keystroke Inference Attack by Gaze Estimation from Avatar Views in VR/MR Devices.

https://sites.google.com/view/Gazeploit/

PDF: https://arxiv.org/pdf/2409.08122

Please open Telegram to view this post

VIEW IN TELEGRAM

Google

GAZEploit

GAZEploit:

2.16K views15:34

About

Blog

Apps

Platform