for an extended period.

This could be explained by the fact that malware monitoring technology is not as common in Linux environments as in Windows. Also, “vendors have significantly less visibility,” Beaumont told BleepingComputer.

Craig Rowland agrees that this is a big problem. Even if there is monitoring in place, people don’t know what to look for or use the wrong approach to find Linux malware.

The researcher told us that some administrators use cryptographic hashes to scan the system for malware or malicious files. This doesn’t work well because the smallest change in the file results in a new hash.
“Plus then EDR [Endpoint Detection and Response] wants to load agents all over and agents break Linux so they are often not a good choice. So people fly naked with Linux often and stuff like this happens” – Craig Rowland, referring particularly to older Linux systems
Rowland says that hunting for BPFdoor is easy, at least for the Linux version he analyzed, since its tactics clearly show that they “are just malicious out of the box.”
https://www.bleepstatic.com/images/news/u/1100723/Malware/BPFdoor/BPFdoor_SandflyDetection.jpg
Made in China?The researchers BleepingComputer talked to about BPFdoor did not attribute the malware to any threat actor. But in a yearly report on cyberthreats, researchers from PricewaterhouseCoopers (PwC) note that they found the BPFdoor implant during an incident response engagement.

PwC attributed the intrusion to a China-based actor they track as Red Menshen (formerly Red Dev 18), who has been using BPFdoor on “telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors.”

During the investigations, PwC researchers discovered that in the post-exploitation stage of their attacks Red Menshen used custom variants of the Mangzamel backdoor and the Gh0st remote access tool (RAT) along with open-source tools like Mimikatz (to extract credentials) and Metasploit penetration testing suite, for lateral movement on Windows systems.
“We also identified that the threat actor sends commands to BPFDoor victims via Virtual Private Servers (VPSs) hosted at a well-known provider, and that these VPSs, in turn, are administered via compromised routers based in Taiwan, which the threat actor uses as VPN tunnels” – PwC
The researchers note that Red Menshen’s activity is taking place within a nine-hour time interval, between 01:00 and 10:00 UTC, which may align with local working hours.
Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/microsoft-exploit-90x90.jpg Actively Exploited Zero-Day Bug Patched by Microsoft24 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/maxresdefault-90x90.jpg UK government blocked four times as many cyber-scams in 20212 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/microsoft-azure-cloud-90x90.jpg Microsoft releases fixes for Azure flaw allowing RCE attacks3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/f5-big-ip-hacking-90x90.jpg Exploits created for critical F5 BIG-IP flaw, install patch immediately4 [...]

___________________________
@hacking_Attack
@Hacking_Video

days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/Fileless-Malware-660x400-1-90x90.jpg Attackers Use Event Logs to Hide Fileless Malware7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/poison-1481596_1920-90x90.jpg Zero-day bug in uClibc library could leave IoT devices vulnerable to DNS poisoning attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/1ed10a11bb45c273cebc7b8cb492979249bcdcec-90x90.png Security bug in VMWare Workspace ONE could allow access to internal, cloud networks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-2-90x90.jpg New PyScript project lets you run Python programs in the browser1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/1614322146_pexels-kevin-ku-577585-scaled-90x90.jpg Open source ‘Package Analysis’ tool finds malicious npm, PyPI packages2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/supply-chain-attack-90x90.jpg Socket: New tool uses a new, proactive defense against OSS supply chain attacks2 weeks ago
The post BPFdoor: Stealthy Linux malware bypasses firewalls for remote access first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
AWS billing budget 설정하기

https://cdn-images-1.medium.com/max/600/1*8JkNfIpLf3-vzB0ustZskA.png
요금폭탄을 피하는 방법

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Transfer Zelle Paypal Bank Cashapp Bank WU Cloned cc and atm Earn Gov funds free

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Seven faces of a hacker

https://cdn-images-1.medium.com/max/2600/1*QLJL42xnKCRznamFMuo0YQ.jpeg
Today, the word “hacker” is used in all cases. It’s used to describe dangerous criminals, “technology artists,” agents and activists, as…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
PNPT or eCPPT

Hello everyone, recently I have passed my eJPT certification exam. I would like to go for another extra mile by taking up another certification soon. Currently, I am being torn between choosing eCPPT or TCM PNPT for the next cert.

Can anyone tell me which one would be better and why? Thanks!

submitted by /u/DogTime3470
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Tricking/Triggering a car-park induction loop sensor with something portable.

When going into car parks that generate a ticket you must pay, they also give you 15min from entering, where you can leave at no cost. Now exploiting this, has anyone managed to trick the loop sensors that verify a car is over the ticket dispenser, via a method that is portable?

I was sure my chunky subwoofer magnet at the bottom of my work bag, waved around where I would assume coils are, would suffice. But nope- a strong magnet does not mimic a body of metal.

I've seen this page: but carrying around a heavy sheet is a bit excessive.

Considering a motorbike is capable of triggering it and a motorbike frame body is about a foot off the ground (Inverse square rule for magnetic fields), surely a method using something more efficient (or magnetic?) is possible?

Any ideas? https://www.wikiwand.com/en/Induction_loop

submitted by /u/L3T
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Someone is reading my Skype conversations, how do I stop this?

He is repeating things I’ve only said to other people on Skype and it’s quite disturbing. I’ve changed my password multiple times and he is still able to get past it. What can I do to stop this?

submitted by /u/tacularia
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Graphinder: lightweight and blazing fast GraphQL endpoint finder
https://www.reddit.com/r/Pentesting/comments/uoomg4/graphinder_lightweight_and_blazing_fast_graphql/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/achrafash (https://www.reddit.com/user/achrafash)
[link] (https://blog.escape.tech/graphinder-lightweight-and-blazing-fast-graphql-endpoint-finder/) [comments] (https://www.reddit.com/r/Pentesting/comments/uoomg4/graphinder_lightweight_and_blazing_fast_graphql/)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: malicious-pdf

Offensive Security Tool: malicious-pdfPost Views: 9
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes

Offensive Security Tool: malicious-pdf GitHub Link Malicious PDF GeneratorSocial Engineering attacks combined with Phishing Attack simulation, when performing assessments as a Red-Team Penetration tester, requires a certain preparation beforehand. It’s about choosing the right tools and testing the attacks before launching them in real-time. You only have one or very few limited attempts before the victim would realize, something is wrong. Therefore, it’s crucial to understand how important preparation is, and the specific tool, that allows you to generate PDFs containing payloads, with some specific purpose.

Malicious-pdf by jonaslejon, allows you to generate ten different malicious pdf files with phone-home functionality. It can be used with Burp Collaborator or Interact.sh
See Also: Recon Tool: ReconFTW Usagepython3 malicious-pdf.py burp-collaborator-urlOutput will be written as: test1.pdf, test2.pdf, test3.pdf etc in the current directory.

Do not use the https:// etc prefix on the url argument. Purpose* Test web pages/services accepting PDF-files
* Test security products
* Test PDF readers
* Test PDF converters
See Also: Write up: Find hidden and encrypted secrets from any website https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/scanmycode-90x90.png Static Code Analysis Tool: scanmycode-ce7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/MOSINT-1-90x90.png OSINT Tool: MOSINT2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/findomain-90x90.png Recon Tool: Findomain2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/keethief-90x90.png Offensive Security Tool: KeeThief3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/reconftw-90x90.png Recon Tool: ReconFTW3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/smap-demo-90x90.png Recon Tool: Smap4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Proxmark3-90x90.png Offensive Security Tool: Proxmark31 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/boomerang-90x90.png Offensive Security Tool: Boomerang1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/unknown-90x90.png Recon Tool: PSRecon1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/SysWhispers3-90x90.png Offensive Security Tool: SysWhispers32 months ago
The post Offensive Security Tool: malicious-pdf first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Process_Overwriting - Yet Another Variant Of Process Hollowing
http://www.kitploit.com/2022/05/processoverwriting-yet-another-variant.html

Process Overwriting is a PE injection (https://www.kitploit.com/search/label/Injection) technique, closely related to Process Hollowing (https://github.com/hasherezade/libpeconv/tree/master/run_pe) and Module Overloading (https://github.com/hasherezade/module_overloading) Process Hollowing (aka RunPE) is an old and popular PE injection technique. It comes in has variety of flavors, but there are some steps in common: Start by creating a process in a suspended state Write our own PE module in its memory Redirect to the new module Resume the thread
Process Hollowing does not require manual loading of payload's imports. Thanks to the step 3 Windows (https://www.kitploit.com/search/label/Windows) loader treat our PE implant as the main module of the process, and will load imports automatically when its execution resumes. To make our implant recognized by Windows loader, its Module Base must be set in the PEB. It is usually done by one of the two ways: in the most classic variant, the original PE is unmapped from memory, and the new PE is mapped on its place, at the same address. in another, yet common variant, the old module is left as is, and another PE is mapped in a new memory (https://www.kitploit.com/search/label/Memory) region. Then the new module's base address is manually written into the PEB (this variant was demonstrated here (https://github.com/hasherezade/libpeconv/tree/master/run_pe)) As a result of those classic implementations we get a payload (https://www.kitploit.com/search/label/Payload) running as main module, yet it is mapped as MEM_PRIVATE (not as MEM_IMAGE like typically loaded PEs). To obtain payload mapped as MEM_IMAGE we can use some closely related techniques, such as Transacted Hollowing (https://github.com/hasherezade/transacted_hollowing) or its variant "Ghostly Hollowing" (https://github.com/hasherezade/transacted_hollowing#ghostly-hollowing). Process Overwriting is yet another take on solving this problem. In contrast to the classic Process Hollowing, we are not unmapping the original PE, but writing over it. No new memory is allocated: we are using the memory that was originally allocated for the main module of the process. Pros: the implanted PE looks like if it was loaded by Windows loader: mapped as MEM_IMAGE divided into sections with specific access (https://www.kitploit.com/search/label/Access) rights the image is named convenience of loading: no need to manually relocate the implant prior to injection: Windows loader will take care of this (in classic Process Hollowing we have to relocate the module) no need to fill imports (like in every variant of Process Hollowing) no need to allocate new memory in the process Cons: It doesn't work if the target has GFG (Control Flow Guard) (https://docs.microsoft.com/en-us/windows/win32/secbp/control-flow-guard) enabled (yet it is possible to disable it on process creation) The target's ImageSize must not be smaller than payload's ImageSize (remember we are using only the memory that was already allocated!) - this limitation does not occur in other flavors of Process Hollowing Can be detected by comparing of the module in memory with corresponding file (PE-sieve (https://github.com/hasherezade/pe-sieve/) detects it) - just like every variant of Process Hollowing Demo: The demo payload (demo.bin) injected into Windows Calc (default target):