38, this vulnerability is, again, high severity – it allows an attacker to bypass the security rules of Windows AppContainer Firewall – as well as publicly disclosed.

AppContainers are designed to protect against infiltration from third-party apps. They essentially isolate the runtime environment of applications with the goal of blocking malicious code.

This vulnerability results in loss of confidentiality and can be exploited without any user interaction.

Maarten Buis, Automox product marketing manager, noted that a successful attacker that exploits this vulnerability could run arbitrary code on the endpoint, but they need to have administrative privileges before they can meaningfully exploit it.

“However, there is still a significant risk because no user interaction is required, and no special endpoint conditions are required for an attack to succeed,” Buis explained to Threatpost via email .

There are no reports of the vulnerability having been actively exploited – yet. Still, Automox recommends a rapid patch rollout – as in, within 72 hours of the patch being made available – given that it’s been publicly disclosed in a proof of concept by James Forshaw of Google’s Project Zero.

Aleks Haugom, Automox product marketing manager, noted that, given the sheer number of apps users download, “making sure that AppContianers cannot be compromised is important to every company’s security hygiene.”
See Also: Hacking stories – Operation Aurora: When China hacked Google How to Prioritize?Williams said that he doesn’t want to sound like a broken record, but he’s still going to say what security experts say every Patch Tuesday. To wit, “Patch now.”

That’s particularly true for the MysterySnail campaign, he said: “Seriously, this is not a patch Tuesday to delay on,” he advised. “Threat actors are actively exploiting the vulnerability for CVE-2021-40449 to elevate from user to administrator permissions on compromised systems. While CVE-2021-40449 doesn’t allow for remote exploitation, that doesn’t mean it can be taken lightly. Threat actors regularly gain access to target machines using phishing attacks and vulnerabilities such as CVE-2021-40449 allow them to evade more effectively bypass endpoint controls and evade detection.”

Besides which, MysterySnail’s success in weaponizing this flaw means that other APTs will soon follow, Williams said: “Because the code for this has already been weaponized by one threat actor, we should expect to see it weaponized by others more quickly because there is already sample exploit code in the wild to work with.”

Danny Kim, Principle Architect at Virsec, who spent time at Microsoft during his graduate work on the OS security development team, voted for prioritizing the three critical remote code execution vulnerabilities: CVE-2021-40469, CVE-2021-26427 and CVE-2021-40487, which affect a wide range of Windows versions.

“These vulnerabilities not only have a high to critical CVSS rating, but two of the three attacks (CVE-2021-40487, CVE-2021-40469) can be executed remotely,” he stressed. “Remote Code Execution (RCE) attacks are especially devastating because once the exploit is executed, [the attackers] can launch any kind of cyberattack, including ransomware.

He noted that RCE vulnerabilities were also the root cause of the Hafnium and Kaseya attacks. “Trying to mitigate the attacker’s actions after they have gained access is significantly harder than stopping the actions that led to the successful exploit,” Kim pointed out. “This is why runtime monitoring of enterprises’ server workloads is becoming a key part of today’s cybersecurity. Stopping the exploitation of these vulnerabilities has to start with equipping the servers themselves with constant, deterministic runtime protection, not just detection.”
Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/apple-iphone-hacking-90[...]

___________________________
@hacking_Attack
@Hacking_Video

x90.jpg Emergency Apple iOS 15.0.2 update fixes zero-day used in attacks1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Linux-1280x720-1-90x90.jpg FontOnLake malware infects Linux systems2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/excel-header-90x90.jpg Microsoft is disabling Excel 4.0 macros by default to protect users5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-1-90x90.jpg Twitch source code and creator payouts part of massive leak6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Apache-web-server-90x90.png Apache fixes actively exploited zero-day vulnerability, patch now1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/security-breach-freepik-90x90.jpg Encrypted & Fileless Malware Sees Big Growth1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Digital-Wallet-90x90.jpg MFA Glitch Leads to 6K+ Coinbase Customers Getting Robbed1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/shutterstock_1156765921-900x506-1-90x90.jpg Google pushes emergency Chrome update to fix two zero-days2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ezgif.com-gif-maker-2-90x90.jpg Apple Pay with VISA lets hackers force payments on locked iPhones2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/gamma-finfisher-hacked-tool-90x90.jpg FinFisher malware hijacks Windows Boot Manager with UEFI bootkit2 weeks ago
The post Microsoft Kills Bug Being Exploited in MysterySnail Espionage Campaign first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What do you guys think, how the attacker would've carried the attack, plus overriding the commands by remote controller.

https://external-preview.redd.it/kH6V2gDZuxdxrEGtBl1Wv400kY8nbGinBfBG1EJQVVA.png?width=320&crop=smart&auto=webp&s=30ef8ad9ad27b08bd2a0c054d5bcba12650f7d8a submitted by /u/geeknintrovert
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking to download a protected pdf webpage as a pdf file with highlightable text.

This is the webpage: https://beta.sbc.gov.sa/ar/BC/SBC_AR/GW.aspx

I just need to convert it into a downloadable pdf file.

Any help would be much appreciated.

submitted by /u/Blezius
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Finding IDORs, the conceptual way
https://tusharbhatia43.medium.com/finding-idors-the-conceptual-way-d091e59a755b?source=rss------bug_bounty-5

This is my take on IDORs and how to understand them when you are just starting in the Web Application Penetration Testing.Continue reading on Medium » (https://tusharbhatia43.medium.com/finding-idors-the-conceptual-way-d091e59a755b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The InsecureNet-of-Things: The State of IoT Privacy, Security and Safety

https://cdn-images-1.medium.com/max/1200/1*R7URGwXG-xyMsGqP8Vny4Q.png
Digital technology and Moore’s Law have moved us along from the Computer Age to the Information Age. Now we are living in an IoT…

Continue reading on The InfoSec Journal »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Ransomware as a service is growing in popularity

https://cdn-images-1.medium.com/max/2600/1*d90_F2rTL5vq-Fre0rmdSA.jpeg
Ransomware attacks are on the rise and are targeting both governments as well as businesses. While ransomware has been around for decades…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Exotic Programming Languages: Why Hackers Use Them

https://cdn-images-1.medium.com/max/2600/0*jOkUoNybS33Akvn9
The world keeps evolving and so do cybercriminals. It’s important to keep up with the change so as to not fall victim to it.

Continue reading on JavaScript in Plain English »

___________________________
@hacking_Attack
@Hacking_Video

Finding IDORs, the conceptual way

This is my take on IDORs and how to understand them when you are just starting in the Web Application Penetration Testing.Continue reading on Medium »
Read more...

Rdesktop - Open Source Client for Microsoft's RDP protocol

rdesktop is an open source client for Microsoft's RDP protocol. It is known to work with Windows versions ranging from NT 4 Terminal Server to Windows 2012 R2 RDS. rdesktop currently has implemented the RDP version 4 and 5 protocols. Installation rdesktop uses a GNU-style build procedure. Typically all that is necessary to install rdesktop is the following: % ./configure% make% make install The default is to install under /usr/local. This can be changed by adding --prefix= to the configure line. The smart-card support module uses PCSC-lite. You should use PCSC-lite 1.2.9 or later. To enable smart-card support in the rdesktop add --enable-smartcard to the configure line. Note for users building from source If you have retrieved a snapshot of the rdesktop source, you will first need to run ./bootstrap in order to generate the build infrastructure. This is not necessary for release versions of rdesktop. Usage Connect to an RDP server with: % rdesktop server where server is the name of the Terminal Services machine. If you receive "Connection refused", this probably means that the server does not have Terminal Services enabled, or there is a firewall blocking access. You can also specify a number of options on the command line. These are listed in the rdesktop manual page (run man rdesktop). Download Rdesktop
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Rdesktop - Open Source Client for Microsoft's RDP protocol
http://www.kitploit.com/2021/10/rdesktop-open-source-client-for.html

___________________________
@hacking_Attack
@Hacking_Video

rdesktop is an open source client for Microsoft's RDP protocol. It is known to work with Windows (https://www.kitploit.com/search/label/Windows) versions ranging from NT 4 Terminal Server to Windows 2012 R2 RDS. rdesktop currently has implemented the RDP version 4 and 5 protocols.
Installation
rdesktop uses a GNU-style build procedure. Typically all that is necessary to install rdesktop is the following: % ./configure
% make
% make install
The default is to install under /usr/local. This can be changed by adding --prefix= to the configure line. The smart-card support module uses PCSC-lite. You should use PCSC-lite 1.2.9 or later. To enable smart-card support in the rdesktop add --enable-smartcard to the configure line.
Note for users building from source
If you have retrieved a snapshot of the rdesktop source, you will first need to run ./bootstrap in order to generate the build infrastructure. This is not necessary for release versions of rdesktop.
Usage
Connect to an RDP server with: % rdesktop server
where server is the name of the Terminal Services machine. If you receive "Connection refused", this probably means that the server does not have Terminal Services enabled, or there is a firewall (https://www.kitploit.com/search/label/Firewall) blocking access. You can also specify a number of options on the command line. These are listed in the rdesktop manual page (run man rdesktop).

Download Rdesktop (https://github.com/rdesktop/rdesktop)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Rdesktop - Open Source Client for Microsoft's RDP protocol

https://blogger.googleusercontent.com/img/a/AVvXsEjI9_dtJMGFIo2ekUTFnK-BYMm-b9mDbEawVBsdN3vwWYN07iaWgbErPWsrqVbYJLmUHajMGJiegtxAC-nuy4WhR_2YYeLON4EF-FuX5J8dBpu8c3E3hgNSpehEPhjQLTh37lzaVSK6VtCP2esnZcO09zo4ZMLtOEyTBefOHtkG1Yhpq96sjhL15MNCOQ=w640-h360
rdesktop is an open source client for Microsoft's RDP protocol. It is known to work with Windows versions ranging from NT 4 Terminal Server to Windows 2012 R2 RDS. rdesktop currently has implemented the RDP version 4 and 5 protocols.
Installation

rdesktop uses a GNU-style build procedure. Typically all that is necessary to install rdesktop is the following:

% ./configure
% make
% make install


The default is to install under /usr/local. This can be changed by adding --prefix=to the configure line.

The smart-card support module uses PCSC-lite. You should use PCSC-lite 1.2.9 or later. To enable smart-card support in the rdesktop add --enable-smartcardto the configure line.

Note for users building from source

If you have retrieved a snapshot of the rdesktop source, you will first need to run ./bootstrapin order to generate the build infrastructure. This is not necessary for release versions of rdesktop.

Usage

Connect to an RDP server with:

% rdesktop server


where serveris the name of the Terminal Services machine. If you receive "Connection refused", this probably means that the server does not have Terminal Services enabled, or there is a firewall blocking access.

You can also specify a number of options on the command line. These are listed in the rdesktop manual page (run man rdesktop).
Download Rdesktop

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
New CrowdXDR Alliance Defines Data Exchange Standard for XDR

Google Cloud, Okta, ServiceNow, Zscaler, Netskope, Proofpoint, Extrahop, Mimecast, Claroty, and Corelight have joined the coalition.

Dark Reading: Attacks/Breaches
New Vaultree Encryption-as-a-Service Keeps Cloud Data Fully Encrypted

Encryption startup Vaultree aims to give companies the ability to work with fully encrypted data in the cloud.

___________________________
@hacking_Attack
@Hacking_Video