The Cycle of Adversary Pursuit - To track a fast-moving adversary over time, FireEye exploit organic intrusion data, pivot to other data sets, and make that knowledge actionable for analysts and incident responders, enabling new discoveries and assessments on the actor
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Google Cloud Blog
It's Your Money and They Want It Now — The Cycle of Adversary Pursuit | Mandiant | Google Cloud Blog
YARA rule metadata specification and validation utility from the Canadian Center for Cyber Security
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - CybercentreCanada/CCCS-Yara: YARA rule metadata specification and validation utility / Spécification et validation pour…
YARA rule metadata specification and validation utility / Spécification et validation pour les règles YARA - CybercentreCanada/CCCS-Yara
Holy water: ongoing targeted water-holing attHoly water: ongoing targeted water-holing attack in Asiaack in Asia
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Securelist
Holy water: ongoing targeted water-holing attack in Asia
On December 4, 2019, we discovered watering hole websites that were compromised to selectively trigger a drive-by download attack with fake Adobe Flash update warnings.
Applied Reverse Engineering: Accelerated Assembly Part 2 is now available!
🗣daaximus
Very good
Be sure to continue this series
👤Ali_taba
I finished this last night and thought I would share in the subreddit with the hopes it helps some new or maybe even some seasoned reverse engineers. I appreciate any and all feedback, and if there are mistakes please let me know!
I hope you enjoy it :)
👤daaximus
🎖@malwr
🗣daaximus
Very good
Be sure to continue this series
👤Ali_taba
I finished this last night and thought I would share in the subreddit with the hopes it helps some new or maybe even some seasoned reverse engineers. I appreciate any and all feedback, and if there are mistakes please let me know!
I hope you enjoy it :)
👤daaximus
🎖@malwr
Reverse Engineering
Applied Reverse Engineering: Accelerated Assembly [P2] - Reverse Engineering
Takes a third-party crackme and teaches assembly while reverse engineering the target application. Covers data structure analysis, flow validation, and more
kmon: Linux Kernel Manager and Activity Monitor
🗣orhunp
Looks interesting but very specific to certain users.
👤MeanEYE
Project Homepage: https://github.com/orhun/kmon
👤orhunp
🎖@malwr
🗣orhunp
Looks interesting but very specific to certain users.
👤MeanEYE
Project Homepage: https://github.com/orhun/kmon
👤orhunp
🎖@malwr
A recursive GZIP file decompresses indefinitely using Archive Utility on macOS
🗣Honno
This is a demonstration of a recursive GZIP file being indefinitely decompressed by the Archive Utility in macOS. Credit to Tim Allison (video from here), who first found this happenstance around November last year on Mojave 10.14.6.
The problem is that the Utility does have checks to handle recursion with GZIP. The end result is frustration. With the small filesize of 204B, Archive Utility extracts it almost immediately, so the GUI becomes basically unusable as each progress bar instance is gone in less than a second!
It does do checks with recursive ZIP files however, where I believe it just stops after x numbers of decompressions (a common check to prevent infinite decompressions). I imagine this is the case because of the prevalence of ZIP bombs which nudged a developer to protect the users from excessive decompression.
(Note: ZIP and GZIP are different file formats!)
There probably isn't much of a security vulnerability here, but who knows with these things. An interesting project could be expanding the filesize of the GZIP (as most ZIP bombs do), which is certainly possible once you understand how DEFLATE compression works. When I get some time I'm definitely gunna play around with this myself.
A dirty trick could be to send an innocent sounding file (i.e.
Details on the GZIP file can be found on a tutorial I made last year, How to make compressed file quines, step by step.
👤Honno
🎖@malwr
🗣Honno
This is a demonstration of a recursive GZIP file being indefinitely decompressed by the Archive Utility in macOS. Credit to Tim Allison (video from here), who first found this happenstance around November last year on Mojave 10.14.6.
The problem is that the Utility does have checks to handle recursion with GZIP. The end result is frustration. With the small filesize of 204B, Archive Utility extracts it almost immediately, so the GUI becomes basically unusable as each progress bar instance is gone in less than a second!
It does do checks with recursive ZIP files however, where I believe it just stops after x numbers of decompressions (a common check to prevent infinite decompressions). I imagine this is the case because of the prevalence of ZIP bombs which nudged a developer to protect the users from excessive decompression.
(Note: ZIP and GZIP are different file formats!)
There probably isn't much of a security vulnerability here, but who knows with these things. An interesting project could be expanding the filesize of the GZIP (as most ZIP bombs do), which is certainly possible once you understand how DEFLATE compression works. When I get some time I'm definitely gunna play around with this myself.
A dirty trick could be to send an innocent sounding file (i.e.
coursework_submission.gz) to someone and piss them off for life ;)Details on the GZIP file can be found on a tutorial I made last year, How to make compressed file quines, step by step.
👤Honno
🎖@malwr
Reddit
r/cybersecurity on Reddit: A recursive GZIP file decompresses indefinitely using Archive Utility on macOS
Posted by u/Honno - 6 votes and 1 comment
Ghidra Processor Module Generator (GPMG)
https://github.com/oberoisecurity/ghidra-processor-module-generator
🎖@malwr
https://github.com/oberoisecurity/ghidra-processor-module-generator
🎖@malwr
GitHub
GitHub - oberoisecurity/ghidra-processor-module-generator: A step towards automating the creation of Ghidra processor modules
A step towards automating the creation of Ghidra processor modules - oberoisecurity/ghidra-processor-module-generator
Boost Your Command-Line Productivity With Fuzzy Finder
🗣b4r0k
Ever since I heard about broot, I prefer its tree layout over the flat fzf output: https://github.com/Canop/broot
👤karottenreibe
🎖@malwr
🗣b4r0k
Ever since I heard about broot, I prefer its tree layout over the flat fzf output: https://github.com/Canop/broot
👤karottenreibe
🎖@malwr
Medium
Boost Your Command-Line Productivity With Fuzzy Finder
Tips and tricks to level up your Command-line skills with Fuzzy Finder
How commercial anti cheats spy on reverse engineers
🗣amd64_sucks
what was the url for reports again? gonna block it via hostsfile...
👤WarrantyVoider
Is it possible to request this information through gdpr?
👤ZYy9oQ
Woah. That was very interesting.
👤maverickleopard
🎖@malwr
🗣amd64_sucks
what was the url for reports again? gonna block it via hostsfile...
👤WarrantyVoider
Is it possible to request this information through gdpr?
👤ZYy9oQ
Woah. That was very interesting.
👤maverickleopard
🎖@malwr
secret club
BattlEye reverse engineer tracking
Modern commercial anti-cheats are faced by an increasing competetiveness in professional game-hack production, and thus have begun implementing questionable methods to prevent this. In this article, we will present a previously unknown anti-cheat module,…
Is SearchMine Adware Teeing Up Your Endpoints For Other Threat Actors? | SentinelOne
🗣Cyberthere
🎖@malwr
🗣Cyberthere
🎖@malwr
SentinelOne
Is SearchMine Adware Teeing Up Your Endpoints For Other Threat Actors? | SentinelOne
A recent update to a notorious macOS browser hijacker exfiltrates data about the device environment and installed apps. Now what could they want that for?