The Year 2038 problem (also called Y2038 or Unix Y2K) relates to representing time in many digital systems as the number of seconds passed since 00:00:00 UTC on 1 January 1970 and storing it as a signed 32-bit integer.
https://en.m.wikipedia.org/wiki/Year_2038_problem


🎖@malwr

av evasion techniques
i need a updated list(prefer 2019) of av evasion techniques (no tools, only docs) an types

The ones I found on Google, are incomplete or outdated, this

https://marcoramilli.com/2013/07/20/malware-evasion-chart/

is one of the best I found but it is 7 years ago and I am not sure that the techniques mentioned are still in use

Thanks for the help
🗣bl455

MITRE ATT&CK Defense Evasion Tactic
👤dakeytheone


🎖@malwr

TikTok vulnerability: Chinese firm buckles up with more safety features as criticism mounts [Exclusive](https://www.ibtimes.sg/tiktok-vulnerability-chinese-firm-buckles-more-safety-features-criticism-mounts-exclusive-38025)
🗣BhaswatiGuha19


🎖@malwr

How do I become familiar with "automated exploitation tools" and "crash analysis, debugging, fuzzing, shell code generation"
Good morning,

I am considering applying to PhD program over at DSU

https://catalog.dsu.edu/previewprogram.php?catoid=30&poid=2204&returnto=1450

I have a background in software engineering, but have not really done much low level programming.

One of their first courses is "Advanced Software Exploitation" with a description of

"This course is designed to expose students to advanced software exploitation techniques including but not limited to: heap and ROP exploitation, by passing DEP and ASLR, reverse engineering, and custom shell code creation. Students should be familiar with the use of automated exploitation tools and have a solid understanding of manual exploitation in a Windows and Linux environment including: crash analysis, debugging, fuzzing, shell code generation and more."

Can anyone recommend a another course or some resources to prepare for this course ? I want to make sure I have an aptitude for this kind of programming and an interest. All I can think of is a refresher on assembly programming, but I wonder if there are more targeted resources I can use.
🗣GORILLA_FACE

Here's a short list of some tools for you to look at. I've recently done a little research on them for fun and insight. Some of these do a couple automated tasks while others are complex and can be capable of performing vulnerability analysis, exploiting vulnerabilities and then moving to the next host. All are some type of machine learning algorithm.

Pwnagotchi: https://pwnagotchi.ai/

Sn1per: https://github.com/1N3/Sn1per

DeepExploit(Machine Learning Security) and SAIVS: https://github.com/13o-bbr-bbq

I'll have to find my bookmarks folder with the last couple but I hope the code helps
👤syncspark

Hackthebox also has some Ropping and sort like. Ippsec does some video’s on this. Search here for any topic: https://ippsec.rocks/
👤Neo-Bubba

Most malware reverse engineering courses should cover those things. https://malwareunicorn.org/workshops/re101.html#8 is a good free one, followed by the 102 course.
👤yells_at_cloud


🎖@malwr

Netgear Signed TLS Cert Private Key Disclosure
🗣homothebrave

Netgear left in its router firmware key ingredients needed to intercept and tamper with secure connections to its equipment's web-based admin interfaces.

Specifically, valid, signed TLS certificates with private keys were embedded in the software, which was available to download for free by anyone, and also shipped with Netgear devices. This data can be used to create HTTPS certs that browsers trust, and can be used in miscreant-in-the-middle attacks to eavesdrop on and alter encrypted connections to the routers' built-in web-based control panel.

In other words, the data can be used to potentially hijack people's routers. It's partly an embarrassing leak, and partly indicative of manufacturers trading off security, user friendliness, cost, and effort.
👤homothebrave


🎖@malwr

Hiding Your Tracks: Bash History
🗣bad3r_

Nice! I would add another one, kill the console to quit bash without saving history:


kill -9 $$
👤ReigningShells


🎖@malwr

What do you use for IP Reputation?
We are currently using IBM X-force, but o don't find it that reliable there is a lot if false positives in there.
Any suggestions? Especially for one were we can get a feed from (API or something)
🗣Mo7Robot

https://www.abuseipdb.com/register

https://talosintelligence.com/reputation\_center

https://www.apivoid.com/api/ip-reputation/
👤chrisknight1985

If you are looking for malicious domains the Fortinet threat feed is pretty good. It's part of their Fortinet Developer's Network Site License. It's an API feed that supports csv and stix formats.
👤Defiant_Success


🎖@malwr