s in their investigation, Columbo generates percentage scores for each 1 (suspicious) and 0 (genuine). Such approach helps the examiners to pick and choose the path, command or processes that Columbo classifies them as suspicious. Options to SelectOption 2

Live analysis -files and process traceability. This option analyses running Windows processes to identify running malicious activities if any. Columbo uses autorunsc.exe to extract the data from the machine, the outputs are piped to Machine Learning models and pattern recognition engines to classify suspicious activities. Later the outputs are saved under \Columbo\ML\Step-2-results in a form of excel files for further analysis. Furthermore, users are given options to examine running processes. The result contains information such as process traceability, commands that are associated with each process -if applicable and whether or not, the processes are responsible for executing new processes.

Option 3

Scan and analyse Hard Disk Image File (.vhdx): This option takes paths of mounted Hard Disk Image of Windows. It uses sigcheck.exe to extract the data from the file systems. Then the results are piped into Machine Learning models to classify suspicious activities. Further the outputs are saved under \Columbo\ML\Step-3-results in a form of excel files.

Option 4

Memory Forensics. In this option, Columbo takes the path of the memory image and following options are produced for users to select.

1.
Memory Information: Volatility 3 is used to extract information about the image.

2.
Processes Scan: Volatility 3 is used to extract process, dll and handle information of each process. Then, Columbo uses grouping and clustering mechanisms to group each process according to their mother processes. This option is later used by the process traceability under Anomaly Detection option.

3.
process Tree: Volatility 3 is used to extract process tree of the processes.

4.
Anomaly Detection and Process Traceability: Volatility 3 is used to extract a list of Anomaly Detection processes. However, Columbo gives an option called Process Traceability to separately examine each process and collectively produces the following information.
* Paths of the executable files and associated commands.
* Using Machine Learning models to determine the legitimacy of the identified processes.
* Trace each process all the way back to their root processes (complete path) and their execution dates and time.
* Identify if the process is responsible for executing other processes i.e. is it going to be a mother process of new processes or not.
* It extracts, handles and dlls information of  each process and presents them with the rest of the information. Download Columbo

Subdomain Flyover And Manual Exploration Of The Results
https://thexssrat.medium.com/subdomain-flyover-and-manual-exploration-of-the-results-15c69d509091?source=rss------bug_bounty-5

So you have a list of subdomains, now what?Continue reading on Medium » (https://thexssrat.medium.com/subdomain-flyover-and-manual-exploration-of-the-results-15c69d509091?source=rss------bug_bounty-5)

Deep Web
Tether's plan is to shorting X+m+r cryptocurrency which will suppress its value.

short-positioning is used to get profit from a stock when it is supposed to go down in worth. Tether company assumes X+m+r cryptocurrency will fall in price, so they are planning to short-position it.

submitted by /u/StormilyHalloo267
[link] [comments]

hacking: security in practice
Would setting up a guest network be enough to keep me safe and isolate an untrusted/Potentially dangerous machine from my trusted ones?

I will be setting up a machine that would probably get infected soon, but will my work pc and other devices be safe as long as that one is connected only to my guest network?

There is all sorts of procedures like DMZ setup and configuring a firewall , though I am not very familiar but I can learn if necessary. I am wondering if guest network will be enough.

One more question if it is okay. If my trusted pc is connected with ethernet to my router, I'm assuming the guest network would not be able to talk with that either, is that correct?

submitted by /u/WildSimple8048
[link] [comments]

hacking: security in practice
Any chance that there is a way to get around paying a micro transaction for feature that was advertised?

I got a set of Razer Kraken 7.1 surround sound headphones and it advertises it's "THX 7.1 Surround Sound." It doesn't actually come with this feature and makes you pay an extra $20--which is false advertising. I would have never bought said headphones if THX was not included with the headphones as advertised. Any way to get around this? It runs on Razer's software.

Razer's download: https://www.razer.com/p/RZ11-13000-0001

alt download that allows you to get into the software without paying: https://www.techspot.com/downloads/7274-thx-spatial-audio.html

You can get into the client with the alternate download, but it requires an activation code.

submitted by /u/mydepressedass
[link] [comments]

Exploit Collector
iOS / macOS Radio Proximity Kernel Memory Corruption

https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
A radio proximity kernel memory corruption vulnerability exists in iOS and macOS due to bad state machine in BSS steering.

MD5 | 5ff730e5556e80e223e58b23eca60fa1

Download
Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Voice-Changing Software Found on APT Attackers' Server

Security researchers believe the presence of Morph Vox Pro could indicate APT-C-23 has new plans for their phishing campaigns.

Dark Reading: Attacks/Breaches
Did 4 Major Ransomware Groups Truly Form a Cartel?

An analysis of well-known extortion groups and their cryptocurrency transactions reveals the answer.

Examining the database in SQL injection attacks

When exploiting SQL injection vulnerabilities, it is often necessary to gather some information about the database itself. This includes…Continue reading on Medium »
Read more...

Examining the database in SQL injection attacks
https://mrinalprakash4577.medium.com/examining-the-database-in-sql-injection-attacks-1e56f051e7b2?source=rss------bug_bounty-5