Dark Reading: Attacks/Breaches
Cring Ransomware Used in Attacks on European Industrial Firms

Attackers exploited a vulnerability in Fortigate VPN servers to gain access to target networks, researchers report.

Columbo - A Computer Forensic Analysis Tool Used To Simplify And Identify Specific Patterns In Compromised Datasets
http://www.kitploit.com/2021/04/columbo-computer-forensic-analysis-tool.html

Columbo is a computer forensic (https://www.kitploit.com/search/label/Computer%20Forensic) analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition (https://www.kitploit.com/search/label/Recognition) and machine learning models to identify adversaries behaviour and their possible locations in compromised Windows platforms in a form of suggestions. Currently Columbo operates on Windows platform.
Dependencies & High Level Architecture
Columbo depends on volatility 3, autorunsc.exe and sigcheck.exe to extract data. Therefore users must download these dependent tools and place them under \Columbo\bin folder. Please Make sure you Read and Understand the license section (or License.txt file) before you download anything. The output (data) generated by these tools are automatically piped to Columbo's main engine. It breaks it down to small sections, pre-process it and applies machine learning models to classify the location of the compromised system, executable files and other behaviours.
Get started with Columbo
Videos Before you start Columbo Watch (https://www.youtube.com/watch?v=7rUCC1Wz4Gc) Memory forensics using Columbo Memory-forensics (https://www.youtube.com/watch?v=fOa62iVemAQ) Installation and Configuration Executable -Binary Download and install python 3.7 or 3.8 (not tested with 3.9). Make sure you add python.exe to the PATH during the installation. Download latest binary Columbo release, under Releases (https://github.com/visma-prodsec/columbo/releases) Download each of the following and place them under \Columbo\bin. Volatility 3 source code. Columbo does not support Volatility 2. Please make sure you also download Symbol (https://github.com/volatilityfoundation/volatility3#symbol-tables) table packs for windows, unzip it and put it under \Columbo\bin\volatility3-master\volatility\symbols. Download both autorunsc.exe and sigcheck.exe NB: To avoid errors, The directory structure must be like \Columbo\bin\volatility3-master , \Columbo\bin\autorunsc.exe and \Columbo\bin\sigcheck.exe Finally double click on "main.exe" under \Columbo. Source Code Download and install python 3.7 or 3.8 (not tested with 3.9). Make sure you add python.exe to the PATH during the installation. Download the latest release version of Columbo - source code. Double click on install-prerequisites.bat to install all the required packages. Download each of the following and place them unde \Columbo\bin. Volatility 3 source code. Columbo does not support Volatility 2. Please make sure you also download Symbol (https://github.com/volatilityfoundation/volatility3#symbol-tables) table packs for windows, unzip it and put it under \Columbo\bin\volatility3-master\volatility\symbols Download both autorunsc.exe and sigcheck.exe. NB: To avoid errors, The directory structure must be like this \Columbo\bin\volatility3-master , \Columbo\bin\autorunsc.exe and \Columbo\bin\sigcheck.exe Finally go to cmd and issue python.exe \Columbo\main.py
Columbo and Machine Learning
Columbo uses data preprocessing to organise the data and machine learning models to identify suspicious behaviours. Its outputs are either 1 (suspicious) or 0 (genuine) -in a form of suggestions purely to assist digital forensic examiners in their decision making. We have trained the models with different examples to maximise accuracy and used different approaches to minimise false positives. However,  false positives (false detection)  are still experienced and therefore we are committed to update the models  periodically.   
False Positive
It's not easy to reduce false positives (false detection), especially when we deal with machine learning. The output generated by machine learning models might be false positive depending on the quality of the data used to train the models. However, to assist forensic examiners in their investigation, Columbo generates percentage

scores for each 1 (suspicious) and 0 (genuine). Such approach helps the examiners to pick and choose the path, command or processes that Columbo classifies them as suspicious.
Options to Select
Option 2 Live analysis -files and process traceability. This option analyses running Windows processes to identify running malicious activities if any. Columbo uses autorunsc.exe to extract the data from the machine, the outputs are piped to Machine Learning (https://www.kitploit.com/search/label/Machine%20Learning) models and pattern recognition engines to classify suspicious activities. Later the outputs are saved under \Columbo\ML\Step-2-results in a form of excel files for further analysis. Furthermore, users are given options to examine running processes. The result contains information such as process traceability, commands that are associated with each process -if applicable and whether or not, the processes are responsible for executing new processes. Option 3 Scan and analyse Hard Disk Image File (.vhdx): This option takes paths of mounted Hard Disk Image of Windows. It uses sigcheck.exe to extract the data from the file systems. Then the results are piped into Machine Learning models to classify suspicious activities. Further the outputs are saved under \Columbo\ML\Step-3-results in a form of excel files. Option 4 Memory Forensics. In this option, Columbo takes the path of the memory image and following options are produced for users to select. Memory Information: Volatility 3 is used to extract information (https://www.kitploit.com/search/label/Extract%20Information) about the image. Processes Scan: Volatility 3 is used to extract process, dll and handle information of each process. Then, Columbo uses grouping and clustering mechanisms to group each process according to their mother processes. This option is later used by the process traceability under Anomaly Detection option. process Tree: Volatility 3 is used to extract process tree of the processes. Anomaly Detection and Process Traceability: Volatility 3 is used to extract a list of Anomaly Detection processes. However, Columbo gives an option called Process Traceability to separately examine each process and collectively produces the following information. Paths of the executable files and associated commands. Using Machine Learning models to determine the legitimacy of the identified processes. Trace each process all the way back to their root processes (complete path) and their execution dates and time. Identify if the process is responsible for executing other processes i.e. is it going to be a mother process of new processes or not. It extracts, handles and dlls information of  each process and presents them with the rest of the information. 

Download Columbo (https://github.com/visma-prodsec/columbo)

Hacking on Medium
Here’s How Hackers Can Exploit Data “ The Blockchain Decentral

https://cdn-images-1.medium.com/max/840/0*MdiiJQtzdIXB0w_g.jpg
Fb isn’t any stranger to knowledge hacks and leaks, with the corporate having been on the receiving finish of many high-profile safety…

Continue reading on Medium »

Hacking on Medium
2021–2022 Edition: Upcoming Gender-Focused Hackathons

https://cdn-images-1.medium.com/max/1800/1*7QeE4ta-ajODYQFCxfgM1w.png
Below is a comprehensive list of upcoming gender-focused hackathons.

Continue reading on TechTogether »

KitPloit - PenTest Tools!
Columbo - A Computer Forensic Analysis Tool Used To Simplify And Identify Specific Patterns In Compromised Datasets

https://1.bp.blogspot.com/-T5CjsbbgVfQ/YGvYWQx2nLI/AAAAAAAAVyI/UCYkRA6H92gGlnxYz5Dy1798Wzr3vjnVgCNcBGAsYHQ/w640-h350/columbo.png Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromised Windows platforms in a form of suggestions. Currently Columbo operates on Windows platform. Dependencies & High Level ArchitectureColumbo depends on volatility 3, autorunsc.exe and sigcheck.exe to extract data. Therefore users must download these dependent tools and place them under \Columbo\bin folder. Please Make sure you Read and Understand the license section (or License.txt file) before you download anything. The output (data) generated by these tools are automatically piped to Columbo's main engine. It breaks it down to small sections, pre-process it and applies machine learning models to classify the location of the compromised system, executable files and other behaviours. Get started with ColumboVideos

1. Before you start Columbo Watch
2. Memory forensics using Columbo Memory-forensics

Installation and Configuration

Executable -Binary

1. Download and install python 3.7 or 3.8 (not tested with 3.9). Make sure you add python.exe to the PATH during the installation.
2. Download latest binary Columbo release, under Releases
3. Download each of the following and place them under \Columbo\bin.

* Volatility 3 source code. Columbo does not support Volatility 2. Please make sure you also download Symbol table packs for windows, unzip it and put it under \Columbo\bin\volatility3-master\volatility\symbols.
* Download both autorunsc.exe and sigcheck.exe

NB: To avoid errors, The directory structure must be like \Columbo\bin\volatility3-master , \Columbo\bin\autorunsc.exe and \Columbo\bin\sigcheck.exe

Finally double click on "main.exe" under \Columbo.

Source Code

1. Download and install python 3.7 or 3.8 (not tested with 3.9). Make sure you add python.exe to the PATH during the installation.
2. Download the latest release version of Columbo - source code.
3. Double click on install-prerequisites.bat to install all the required packages.
4. Download each of the following and place them unde \Columbo\bin.

* Volatility 3 source code. Columbo does not support Volatility 2. Please make sure you also download Symbol table packs for windows, unzip it and put it under \Columbo\bin\volatility3-master\volatility\symbols
* Download both autorunsc.exe and sigcheck.exe.

NB: To avoid errors, The directory structure must be like this \Columbo\bin\volatility3-master , \Columbo\bin\autorunsc.exe and \Columbo\bin\sigcheck.exe

Finally go to cmd and issue python.exe \Columbo\main.py Columbo and Machine LearningColumbo uses data preprocessing to organise the data and machine learning models to identify suspicious behaviours. Its outputs are either 1 (suspicious) or 0 (genuine) -in a form of suggestions purely to assist digital forensic examiners in their decision making. We have trained the models with different examples to maximise accuracy and used different approaches to minimise false positives. However,  false positives (false detection)  are still experienced and therefore we are committed to update the models  periodically. False PositiveIt's not easy to reduce false positives (false detection), especially when we deal with machine learning. The output generated by machine learning models might be false positive depending on the quality of the data used to train the models. However, to assist forensic examiner[...]

s in their investigation, Columbo generates percentage scores for each 1 (suspicious) and 0 (genuine). Such approach helps the examiners to pick and choose the path, command or processes that Columbo classifies them as suspicious. Options to SelectOption 2

Live analysis -files and process traceability. This option analyses running Windows processes to identify running malicious activities if any. Columbo uses autorunsc.exe to extract the data from the machine, the outputs are piped to Machine Learning models and pattern recognition engines to classify suspicious activities. Later the outputs are saved under \Columbo\ML\Step-2-results in a form of excel files for further analysis. Furthermore, users are given options to examine running processes. The result contains information such as process traceability, commands that are associated with each process -if applicable and whether or not, the processes are responsible for executing new processes.

Option 3

Scan and analyse Hard Disk Image File (.vhdx): This option takes paths of mounted Hard Disk Image of Windows. It uses sigcheck.exe to extract the data from the file systems. Then the results are piped into Machine Learning models to classify suspicious activities. Further the outputs are saved under \Columbo\ML\Step-3-results in a form of excel files.

Option 4

Memory Forensics. In this option, Columbo takes the path of the memory image and following options are produced for users to select.

1.
Memory Information: Volatility 3 is used to extract information about the image.

2.
Processes Scan: Volatility 3 is used to extract process, dll and handle information of each process. Then, Columbo uses grouping and clustering mechanisms to group each process according to their mother processes. This option is later used by the process traceability under Anomaly Detection option.

3.
process Tree: Volatility 3 is used to extract process tree of the processes.

4.
Anomaly Detection and Process Traceability: Volatility 3 is used to extract a list of Anomaly Detection processes. However, Columbo gives an option called Process Traceability to separately examine each process and collectively produces the following information.
* Paths of the executable files and associated commands.
* Using Machine Learning models to determine the legitimacy of the identified processes.
* Trace each process all the way back to their root processes (complete path) and their execution dates and time.
* Identify if the process is responsible for executing other processes i.e. is it going to be a mother process of new processes or not.
* It extracts, handles and dlls information of  each process and presents them with the rest of the information. Download Columbo

Subdomain Flyover And Manual Exploration Of The Results
https://thexssrat.medium.com/subdomain-flyover-and-manual-exploration-of-the-results-15c69d509091?source=rss------bug_bounty-5

So you have a list of subdomains, now what?Continue reading on Medium » (https://thexssrat.medium.com/subdomain-flyover-and-manual-exploration-of-the-results-15c69d509091?source=rss------bug_bounty-5)

Deep Web
Tether's plan is to shorting X+m+r cryptocurrency which will suppress its value.

short-positioning is used to get profit from a stock when it is supposed to go down in worth. Tether company assumes X+m+r cryptocurrency will fall in price, so they are planning to short-position it.

submitted by /u/StormilyHalloo267
[link] [comments]

hacking: security in practice
Would setting up a guest network be enough to keep me safe and isolate an untrusted/Potentially dangerous machine from my trusted ones?

I will be setting up a machine that would probably get infected soon, but will my work pc and other devices be safe as long as that one is connected only to my guest network?

There is all sorts of procedures like DMZ setup and configuring a firewall , though I am not very familiar but I can learn if necessary. I am wondering if guest network will be enough.

One more question if it is okay. If my trusted pc is connected with ethernet to my router, I'm assuming the guest network would not be able to talk with that either, is that correct?

submitted by /u/WildSimple8048
[link] [comments]

hacking: security in practice
Any chance that there is a way to get around paying a micro transaction for feature that was advertised?

I got a set of Razer Kraken 7.1 surround sound headphones and it advertises it's "THX 7.1 Surround Sound." It doesn't actually come with this feature and makes you pay an extra $20--which is false advertising. I would have never bought said headphones if THX was not included with the headphones as advertised. Any way to get around this? It runs on Razer's software.

Razer's download: https://www.razer.com/p/RZ11-13000-0001

alt download that allows you to get into the software without paying: https://www.techspot.com/downloads/7274-thx-spatial-audio.html

You can get into the client with the alternate download, but it requires an activation code.

submitted by /u/mydepressedass
[link] [comments]

Exploit Collector
iOS / macOS Radio Proximity Kernel Memory Corruption

https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
A radio proximity kernel memory corruption vulnerability exists in iOS and macOS due to bad state machine in BSS steering.

MD5 | 5ff730e5556e80e223e58b23eca60fa1

Download
Source:packetstormsecurity.com