hacking: security in practice
Can we finally remove bloatware on Samsung phones, how would a bad actor do this?

https://external-preview.redd.it/kq8eI9WCgCpplHkXexuJKaDqMhuS5oBJCwKO0spB3EE.jpg?width=640&crop=smart&auto=webp&s=a315b00d66dda2568a0d82675a7458fafe0b5551 submitted by /u/pyrilampes
[link] [comments]

hacking: security in practice
Hacker vs Hacker: North Koreans Attempt to Phish Euler Exploiter of $200M in Crypto

https://external-preview.redd.it/lqmRwNXtxnamFUkipNCN5J1Uc74k6D0fLziZSDQUn70.jpg?width=640&crop=smart&auto=webp&s=1e6392632278b7da2eef7b62aa9f635fd250201a submitted by /u/fap_fap_fap_fapper
[link] [comments]

Black Hat Ethical Hacking
Severe Privacy Vulnerability ‘Acropalypse’ Affects Windows 11 Snipping Tool

Severe Privacy Vulnerability ‘Acropalypse’ Affects Windows 11 Snipping ToolPost Views: 94 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Acropalypse FlawMicrosoft’s Windows 11 Snipping Tool has been found to contain a severe privacy flaw named ‘acropalypse’. The flaw, which has already been discovered in Google Pixel’s Markup Tool, allows partially edited content to be recovered. Security researchers David Buchanan and Simon Aarons recently found that the original image data is retained even after editing or cropping out. The bug poses a significant privacy risk, as it can allow sensitive information, such as credit card numbers or revealing photos, to be partially recovered.

The researchers created an online screenshot recovery tool, acropalypse, which attempts to recover edited images created on Google Pixel.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Acropalypse privacy flaw also affects the Windows 11 Snipping Tool.Today, software engineer Chris Blume confirmed that the acropalypse privacy flaw also affects the Windows 11 Snipping Tool. Overwriting an existing file in the tool leaves unused data behind, making it partially recoverable.
I've got a fun one for you all to look at.

I opened a 198 byte PNG with Microsoft's Snipping Tool, chose "Save As" to overwrite a different PNG file (no editing), and saves a 4,762 byte file with all that extra after the PNG IEND chunk.

Sounds similar 😀

— Chris Blume (@ProgramMax) March 21, 2023
To test this flaw, BleepingComputer opened an existing PNG file in the Windows 11 Snipping Tool, cropped it, and then saved the changes to the original file. Surprisingly, the file sizes for the original image file and the cropped image file were the same, indicating that unused data was not truncated, but left behind.

While the untruncated data may not be visible in an image viewer, it can be used to recreate sensitive portions of the original image. Buchanan shared a Python script with BleepingComputer that can be used to recover Windows files.
Trending: A primer on OS Command Injection Attacks Trending: Offensive Security Tool: Bypass Url Parser Recovery of sensitive informationEven though the online acropalypse screenshot recovery app does not currently work with Windows files, Buchanan warned that a potential privacy risk exists. Users may have sensitive information in screenshots that they cropped out, but this information can still be partially recovered by someone with the right tools.

Microsoft acknowledged the reports and stated that they are investigating the issue to protect their customers. However, the researchers noted that not all PNG files, such as optimized PNGs, are affected by this flaw. Additionally, opening an untruncated PNG file in an image editor and saving it to another file can strip off the unused data at the end, making it no longer recoverable.

The Windows 11 Snipping Tool also behaves similarly with JPG files, leaving untruncated data if overwritten. Buchanan warned that his exploit does not currently work on JPGs, but it could be possible.
Trending: Kali Linux 2023.1 – Adds Kali Purple for defensive security, python updates, new tools Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacki[...]

ng.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-10-300x150.png General Bytes Bitcoin ATMs Hacked via Zero-Day AttackMarch 21, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-9-300x150.png Akamai warns of new HinataBot malware botnet capable of massive DDoS attacksMarch 20, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-8-300x150.png Samsung Users at Risk: 18 Zero-Day Vulnerabilities Found in Exynos ChipsetsMarch 17, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Images-for-the-News-posts-7-300x150.png CISA Identifies Critical Vulnerability in Adobe ColdFusionMarch 16, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.
The post Severe Privacy Vulnerability ‘Acropalypse’ Affects Windows 11 Snipping Tool first appeared on Black Hat Ethical Hacking.

Smart Contract Audit Methodology & Tips

This blog outlines a methodology for auditing smart contracts and advice to help you become an efficient and effective auditor.Continue reading on Medium »
Read more...

Deep Web
Noob with questions

I'm completely new here but have a couple of questions. I've become interested in bugs and jammers at the hobby level. There isn't much about building these devices on the regular internet.

Would it be worth my while to setup an OS to search for this type of thing on the dark web? Not sure if that sort of thing is easier to find that way.

submitted by /u/Cactus_Roy
[link] [comments]

KitPloit - PenTest Tools!
PortexAnalyzerGUI - Graphical Interface For PortEx, A Portable Executable And Malware Analysis Library

https://blogger.googleusercontent.com/img/a/AVvXsEirum9zKpcLFrGh5fJoP1uiH5A_Ax6MPAaUR-cOSMdenPaRW6-iWdMzF-r92KXtVR2vR8V0VDEk19hv3IROmro4xNBMZDk2lJGIYo4NKmwC_W0s8uH10WhFC129xms-aUy3M3UcvDl9Yr18rdQNs74Z3CjfcPrynuvekek8Ku3KBVcU5HV6_y3AAQ-QCA=w640-h358

https://blogger.googleusercontent.com/img/a/AVvXsEjih73UXzcD-FNzgIiV7kdqLcOX43bgwhFJMqa129v4rYxyxtiVqiaqgLUDit82fTVoIoyd3zwJWp-SAYVOWNnh1-FmYeUZxPtoStYMlqLacTxa7pXA08ZyS0CO2gFQu-HYOEKgEwrBkL376TROc7hLXMxKNosL2Gu_-keWXEPw_X-R7x5ScP9ikf9BBw=w640-h398

Graphical interface for PortEx, a Portable Executable and Malware Analysis Library

Download

Releases page

Features

* Header information from: MSDOS Header, Rich Header, COFF File Header, Optional Header, Section Table
* PE Structures: Import Section, Resource Section, Export Section, Debug Section
* Scanning for file format anomalies
* Visualize file structure, local entropies and byteplot, and save it as PNG
* Calculate Shannon Entropy, Imphash, MD5, SHA256, Rich and RichPV hash
* Overlay and overlay signature scanning
* Version information and manifest
* Icon extraction and saving as PNG
* Customized signature scanning via Yara. Internal signature scans using PEiD signatures and an internal filetype scanner.
Supported OS and JRE

I test this program on Linux and Windows. But it should work on any OS with JRE version 9 or higher.

Future

I will be including more and more features that PortEx already provides.

These features include among others:

* customized visualization
* extraction and conversion of icons to .ICO files
* dumping of sections, overlay, resources
* export reports to txt, json, csv

Some of these features are already provided by PortexAnalyzer CLI version, which you can find here: PortexAnalyzer CLI

Donations

I develop PortEx and PortexAnalyzer as a hobby in my free time. If you like it, please consider buying me a coffee: https://ko-fi.com/struppigel

Author

Karsten Hahn

Twitter: @Struppigel

Mastodon: struppigel@infosec.exchange

Youtube: MalwareAnalysisForHedgehogs

License

License
Download PortexAnalyzerGUI

Hacking on Medium
Google Dork

https://cdn-images-1.medium.com/max/600/1*Gn0cjTxxIrhtRGWaFkqGOQ.png
Herkese merhaba, Bugün Google Dork hakkında yazıyorum.

Continue reading on Medium »

Hacking on Medium
Screenshot Un-Edit, Hack for Google Pixel

https://cdn-images-1.medium.com/max/2600/0*YOHpDe-iNbiR4VV9
Google Pixel phone has a hack, CVE-2023–21036, known as “aCropalypse”, that allows someone to see the unedited version of a screenshot…

Continue reading on System Weakness »

Hacking on Medium
Are there any decent ethical hackers for hire?

https://cdn-images-1.medium.com/max/602/0*vfB8kCI60WUP5RgT
In today’s world, cybersecurity threats are increasing day by day. As a result, many businesses and organizations are hiring ethical…

Continue reading on Medium »

hacking: security in practice
Got a little interessting thing

I recieved a phishing mail from someone Ive been working with and Ive decoded it down to this string in the pastebin. It looks like some Base64 but I cant seem to figure out the last part.
https://pastebin.com/WtfdmmQX

I have the entire file which contains variables and functions. It looks like something supposed to be decoded by a browser.
It has phrases like ParseInt, join and If/else but its supposed to run via a browser.

The entire thing is here https://pastebin.com/7Jj9saEv

Do anyone happen to know what Im missing here ?

submitted by /u/Kriss3d
[link] [comments]

hacking: security in practice
Evidence of Pedo ring inside an iPad

Hello community of hacking. I don't know if this is the correct sub to ask this question. I'm sorry in advance if it's not the case.

My question is: it is too hard to access data inside an iPad if you don't have its password? The iPad is the model A1670.

Context: 4 years ago Argentinian model Natacha Jaitt died in suspicious circumstances after accusing high profile people of integrating a pedo ring. The accused were either very famous and/or powerful people from Argentina. Before dying she said she had evidence supporting her accusations in an iPad which is the one in the question. She also said she wouldn't OD on cocaine (which is apparently what killed her).

4 years later, Argentinian police haven't been able to access this iPad. Press says that they have tried 96000 times and are still unsuccessful in their mission.

Follow up to the first question: Again, is it that hard? Do they have to actually try the brute force method to access the iPad data like it seems they have been doing? Can't they just disassemble the device and extract the data?

Thanks for reading. You can check yourself in websites like info as about this case. Is not me trying to learn how to do this to an IPad. I'm a noob who wouldn't know how to brute force or whatever a simple windows login.

In Spanish

submitted by /u/Nanolaska
[link] [comments]

Dark Reading: Attacks/Breaches
10 Vulnerabilities Types to Focus On This Year

A new Tech Insight report examines how the enterprise attack surface is expanding and how organizations must deal with vulnerabilities in emerging technologies.