Docker container that logs all DNS and new outbound TCP/UDP connections.
Finally got this Docker container ready that can log all DNS and new outbound TCP/UDP connections using a modified version of suricata, an open source intrusion detection system.

If you log DNS requests, this takes it one step further by matching your outbound traffic with DNS requests. This means that it can detect traffic that might be DoH (DNS over https).

Tested using a workstation running Ubuntu (host and container). Alpha software, so please don't use this on a production network. Happy to make modifications it if you have a use case that others will benefit from.

https://github.com/morsgiathatch/suricata\_edits/tree/master/DOCKER/syn\_detector
🗣1stOctet


🎖@malwr

SpecterOps Adversary Tactics: PowerShell course material:

https://github.com/specterops/at-ps

ℹ️ Just released (2 hours ago) ℹ️


🎖@malwr

Cracking my first WPA2 password! (It’s my home network)
🗣Perellex_Music

Do you still need to collect I think it use to be 100K or 1M "good packets"?
👤drman769

Dictionary attack? What dictionary file did you use?
👤acousticcoupler

Use hashcat for GPU cracking with almost 12000 H/s speed ( GPU specific ) and it cracks passwords with more ease cause it doesn't even requires a wordlist , it creates of its own.
Good luck
👤Jidnyesh


🎖@malwr

Information Leaks via Safari's Intelligent Tracking Prevention

🎖@malwr

User: admin Password: admin
🗣jadoredior

Honeykey
👤eyemokurok


🎖@malwr

VirusTotal is not an Incident Responder - a tool that aids in analysis should not be a “one-stop-shop” in determining if content is malicious. Attackers can easily manipulate these results.
🗣cyberbutler

There's a lesser used VT result that I think should be implemented more often: unrated. If a URL hasn't been scanned or whatever it should default to unrated, not clean. But of course that doesn't look as great in the results list so a lot of companies default to Clean.

Disclaimer: I work for a VT contributing company.
👤Fr0gm4n

It's understood that the better APT groups will use Virustotal to verify that their malware is undetectable. They will also monitor it and pivot if they see any of their stuff submitted by a third party.
👤K3wp

Reliance on tools like this to come up with conclusions, means that there must be a lack of tools provided to an analyst or proper training/funding.

I know for the team I manage, tools like this are amazing to help pivot to other tools/techniques which can be part of an operators tool belt.

One of the problems to me is, too many vendors sell numerous fucking tools with fancy interfaces, and forget to teach the underlying concepts behind how the tools actually work... Once the tools are down or can't use it.... you're left there thinking.. what next.

edit. - I feel like it's also quite trivial to bypass these types of sandboxes/tools, I have a malicious binary I use for threat hunting as a stager, still hasn't been detected by any tools we use :)
👤cloudy_ft


🎖@malwr

Analysis of a Fake Threema App
🗣antoinet123

It doesn't fucking help that the playstore just pretends that apps which are incompatible with your device just don't exist. That fake app requires Android > 4.4. For the real app it "varies by device". In the end, searching for an app that you know exists and looking through the search results trying to figure out which one is real is not enough. I cannot tell how often I run into this problem, including some banking apps (looking at you Revolut, you POS still owe me money and you can't even tell me what phone I should buy/Android version I should install to being able to communicate with you or even look up my balance).

Thanks Google for being of absolutely no help at all. I'm pretty sure plenty of people installed that fake crap just because you decide to hide the real one from them.
👤electrodraco


🎖@malwr

My employees keep abusing social networks while at work (facebook, whatsapp, youtube). Is there a tool that I can install on all workstations and monitor or possibly block all that activity? Thank you.
🗣zzizourm

The company I work for makes software for employee monitoring/internet filtering that is sold by the license. To avoid potentially breaking rule 5 (" Do not ask for or offer services or products ") I won't mention my company specifically, but a Google search for "employee internet monitoring will give you some results you can look into.

My personal recommendation is to go the monitoring route vs blocking some websites entirely -- a reasonable level of "Cyberloafing" can help employees blow off some steam between tasks and help with their wellbeing/productivity in the long run. Using monitoring instead of filtering can help you keep it at a manageable level and prevent employees from feeling resentful, just make sure they're aware they're being monitored.
👤TransientWonderboy

OpenDNS for direct site blocking or you could look into Application Awareness in a next gen firewall. Basically you set the rules as time of access or if you want to allow just view and not allow them to post.
👤MikePencesBurnerAct

OpenDNS: will block all of that

https://www.opendns.com/

How many employees?

Who does your IT?
👤bbsittrr


🎖@malwr

About Jeff Bezos' phone hacking
How a video can be delivered through "an encrypted downloader hosted on WhatsApp’s media server" ?

I read all the report on VICE and I found it very interesting.

I don't understand however how it was possible through whatsapp, sending the video via "an encrypted downloader hosted on WhatsApp’s media server".

I mean, what's the difference to just directly send a video file or via this encrypted downloader ?

This is what VICE writes (and report too):

"They did not find any malicious code embedded in the video file, but discovered that the video was delivered via an encrypted downloader hosted on WhatsApp’s media server."

Thanks for an explanation
🗣AnotherRedditUsr

My guess is that a well resourced attacker purchased a 1 click exploit and used CVE-2019-11932 to get access to Bezo's phone.
👤darknetj

In the PDF below it says the encrypted file was slightly larger than the video itself

https://assets.documentcloud.org/documents/6668313/FTI-Report-into-Jeff-Bezos-Phone-Hack.pdf

"Encrypted" is probably because all WhatsApp communications are encrypted

The video wasn't just a video file but an exploit + a video file (hence the diff in file size).

The "hosted on WhatsApp media server" probably just means that all data sent on WhatsApp goes through their infrastructure.

See "zero click" exploits https://threatpost.com/apple-imessage-remote-attackersread-iphone-messages/146789/ and https://media.ccc.de/v/36c3-10497-messenger\_hacking\_remotely\_compromising\_an\_iphone\_through\_imessage
👤octave1

/u/bnimblebquick has a good explanation, and a good level of salt grains. But, as a further point, the golden rule is “authenticate before you operate”. As a total guess, maybe that didn’t happen here.

It seems like one could assume the internal services of WhatsApp may have been vulnerable to /something/ in the media call - either at the start or end of the upload. This would leave the file benign but could introduce a vector for compromise based on a trust relationship with the client (ie Jeff’s WhatsApp binary).

It’ll be interesting to see if the hacking claim is proven true, and secondarily what the postmortem reveals, if anything.

Lastly, Facebook is a company that actively makes money by harvesting and reselling personal information. They’ve also actively claimed “privacy needs to go away”. (Randi Zuckerberg, Marketing ‘Director’ and coincidentally family member of another infamous Zuckerberg who works at Facebook. Entirely a coincidence, I’m sure.)

This is important as it seems likely the assumptions on their WhatsApp implementation by the public will be wrong. For example, they’ve made a few claims that seem contradictory about how it operates: “it uses the Signal Protocol” vs “We can uniquely identify content to stop spam messages”. All bets are off in terms of attack vectors. There’s no implementation verification, no OSS of their use case, etc. If they’re going to be caught doing something bad, again, it seems likely they’ll simply I’m stop this investigation.
👤i_build_minds


🎖@malwr

Working malware samples site
If y'all are interested in downloading some malware samples, I'd recommend some sites. This site may not have all the latest malware, but it works. Y'all can go take a look at it. When yall download the zip file, the password for it is infected

https://www.tutorialjinni.com/
🗣LMJR500Army

Ok thanks
👤1711frgtn


🎖@malwr

Cisco Warns of Critical Network Security Tool Flaw
https://threatpost.com/cisco-critical-network-security-tool-flaw/152131/

Cisco advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200122-fmc-auth
🗣BorrowedCommonSense


🎖@malwr

GitHub - reemertastic/infosec-spam-list: List of unwarranted sales email domains you can add to your junk mail filter
🗣Reemertastic

I somehow got signed up for a conference and had my email get put on a list a few years back, so I've been adding domains to my Outlook junk mail list for a while. I figured others probably have the same issue, so I might as well share it. I could unsubscribe from the emails, but I don't want to fall victim to any phishing campaigns (especially when I've used that tactic for some of our phishing campaigns).
👤Reemertastic


🎖@malwr