Phishing in the Time of COVID-19: How to Recognize Malicious Coronavirus Phishing Scams
🗣cyberg0100
🎖@malwr
🗣cyberg0100
🎖@malwr
Electronic Frontier Foundation
Phishing in the Time of COVID-19: How to Recognize Malicious Coronavirus Phishing Scams
Update 3-26-20: A new prevalent example of Android Spyware that leverages COVID-19 as a way to deliver their malicious product has been reported by researchers at Lookout. This particular malware,
Cobaltstrike 4.0 Cracked?
Initial post: https://twitter.com/underthebreach/status/1241840589626322946
Analysis: https://twitter.com/Plazmaz/status/1241971383480901632
If this is indeed out in public now, expect many "users" to migrate from 3.0 for malicious activities.
🗣Pir00t
🎖@malwr
Initial post: https://twitter.com/underthebreach/status/1241840589626322946
Analysis: https://twitter.com/Plazmaz/status/1241971383480901632
If this is indeed out in public now, expect many "users" to migrate from 3.0 for malicious activities.
🗣Pir00t
🎖@malwr
Twitter
Alon Gal (Under the Breach)
@msd0s7 I prefer to refrain from re-uploading it myself, though it did get re-uploaded on a different forum. * I DON'T VOUCH FOR THIS SPECIFIC LINK, BE CAUTIOUS! no one called him out so far so I do think it is legit but due diligence should be done on your…
Microsoft warns of 2 critical RCE vulnerabilities in all recent versions of Windows
🗣Kanishkt23
MS intended to release patch in next month (14/April). That's very bad.
👤Homemade-Cupcake
🎖@malwr
🗣Kanishkt23
MS intended to release patch in next month (14/April). That's very bad.
👤Homemade-Cupcake
🎖@malwr
Beazley Breach Briefing: Ransomware remains top cyber security threat for businesses
🗣what-s-up
🎖@malwr
🗣what-s-up
🎖@malwr
CRWE World
Beazley Breach Briefing: Ransomware remains top cyber security threat for businesses
Shift to home working heightens risk of cyber breach via remote desktop protocol and phishing attacksNew York, March 23, 2020 (GLOBE NEWSWIRE) -- Ransomware attacks skyrocketed in 2019, according to the latest Beazley Breach Briefing, an
All the IOC's this person has gathered which are used directly in coronavirus / covid-19 / SARS-CoV-2 cyber attack campaigns
🗣digicat
Another reresource: https://www.activecypher.com/covid-19-cyberthreats/
🎖@malwr
🗣digicat
Another reresource: https://www.activecypher.com/covid-19-cyberthreats/
🎖@malwr
GitHub
GitHub - parthdmaniar/coronavirus-covid-19-SARS-CoV-2-IoCs: All the IOC's I have gathered which are used directly involved coronavirus…
All the IOC's I have gathered which are used directly involved coronavirus / covid-19 / SARS-CoV-2 cyber attack campaigns - GitHub - parthdmaniar/coronavirus-covid-19-SARS-CoV-2-IoCs: All t...
Reverse engineering Blind's API and client side encryption
🗣speckz
Nice article! I myself need to learn more about javacript reversing. Always seems so tedious
👤blabbities
Neat.
Why doesn't the client generate a custom AES key on start up and transmit that using pubic/private key encryption to Blind? That would avoid the issue of having the AES key in the source code, and make the whole shebang infinitely more secure. Or am I missing something?
👤FlynnClubbaire
🎖@malwr
🗣speckz
Nice article! I myself need to learn more about javacript reversing. Always seems so tedious
👤blabbities
Neat.
Why doesn't the client generate a custom AES key on start up and transmit that using pubic/private key encryption to Blind? That would avoid the issue of having the AES key in the source code, and make the whole shebang infinitely more secure. Or am I missing something?
👤FlynnClubbaire
🎖@malwr
Autopsy of the Most Stable MediaTek Rootkit (CVE-2020-0069)
https://blog.quarkslab.com/cve-2020-0069-autopsy-of-the-most-stable-mediatek-rootkit.html
🎖@malwr
https://blog.quarkslab.com/cve-2020-0069-autopsy-of-the-most-stable-mediatek-rootkit.html
🎖@malwr
Quarkslab
CVE-2020-0069: Autopsy of the Most Stable MediaTek Rootkit - Quarkslab's blog
In March 2020, Google patched a critical vulnerability affecting many MediaTek based devices. This vulnerability had been known by MediaTek since April 2019, and later exploited in the wild! In this post, we give some details about this vulnerability and…
MalwareBazaar – welcome to the abuse-ch malware repository
🗣quellaman
Unlike Virustotal, MalwareBazaar follows a different approach:
MalwareBazaar only tracks malware samples. No Adware (PUA/PUP). No benign files
MalwareBazaar is not a multi antivirus scanning engine
You can upload and download as many malware samples as you want
It’s completely free!
🎖@malwr
🗣quellaman
Unlike Virustotal, MalwareBazaar follows a different approach:
MalwareBazaar only tracks malware samples. No Adware (PUA/PUP). No benign files
MalwareBazaar is not a multi antivirus scanning engine
You can upload and download as many malware samples as you want
It’s completely free!
🎖@malwr
Security Affairs
MalwareBazaar - welcome to the abuse-ch malware repository
Abuse.ch launched the MalwareBazaar service, a malware repository to allow experts to share known malware samples and related info.
Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers
https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-attribution-object-using-rtf-object-dimensions-track-apt-phishing-weaponizers/
🎖@malwr
https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-attribution-object-using-rtf-object-dimensions-track-apt-phishing-weaponizers/
🎖@malwr
Virusbulletin
Virus Bulletin :: VB2019 paper: Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers
Anomali Labs has conducted an in-depth study of the unique object dimensions present in weaponized RTF exploits used in phishing attacks. Through this research we have found that the developers of malicious RTF weaponizers leave behind a unique fingerprint…
Frida 12.8.15 is out w/ full support for iOS/arm64e and iOS 13.4
🗣oleavr
Says it was released is December 2019?
👤tigr87
I simple getting started guide if interested.
https://frida.re/docs/ios/
👤littlejob
🎖@malwr
🗣oleavr
Says it was released is December 2019?
👤tigr87
I simple getting started guide if interested.
https://frida.re/docs/ios/
👤littlejob
🎖@malwr
Frida • A world-class dynamic instrumentation toolkit
iOS
Observe and reprogram running programs on Windows, macOS, GNU/Linux, iOS, watchOS, tvOS, Android, FreeBSD, and QNX
Understanding Hardware-enforced Stack Protection
https://techcommunity.microsoft.com/t5/windows-kernel-internals/understanding-hardware-enforced-stack-protection/ba-p/1247815
🎖@malwr
https://techcommunity.microsoft.com/t5/windows-kernel-internals/understanding-hardware-enforced-stack-protection/ba-p/1247815
🎖@malwr
TECHCOMMUNITY.MICROSOFT.COM
Understanding Hardware-enforced Stack Protection
ROP (Return Oriented Programming) based control flow attacks have become a common form of attack. In this post, we will describe our efforts to harden control..