kmon: Linux Kernel Manager and Activity Monitor
🗣orhunp
Looks interesting but very specific to certain users.
👤MeanEYE
Project Homepage: https://github.com/orhun/kmon
👤orhunp
🎖@malwr
🗣orhunp
Looks interesting but very specific to certain users.
👤MeanEYE
Project Homepage: https://github.com/orhun/kmon
👤orhunp
🎖@malwr
A recursive GZIP file decompresses indefinitely using Archive Utility on macOS
🗣Honno
This is a demonstration of a recursive GZIP file being indefinitely decompressed by the Archive Utility in macOS. Credit to Tim Allison (video from here), who first found this happenstance around November last year on Mojave 10.14.6.
The problem is that the Utility does have checks to handle recursion with GZIP. The end result is frustration. With the small filesize of 204B, Archive Utility extracts it almost immediately, so the GUI becomes basically unusable as each progress bar instance is gone in less than a second!
It does do checks with recursive ZIP files however, where I believe it just stops after x numbers of decompressions (a common check to prevent infinite decompressions). I imagine this is the case because of the prevalence of ZIP bombs which nudged a developer to protect the users from excessive decompression.
(Note: ZIP and GZIP are different file formats!)
There probably isn't much of a security vulnerability here, but who knows with these things. An interesting project could be expanding the filesize of the GZIP (as most ZIP bombs do), which is certainly possible once you understand how DEFLATE compression works. When I get some time I'm definitely gunna play around with this myself.
A dirty trick could be to send an innocent sounding file (i.e.
Details on the GZIP file can be found on a tutorial I made last year, How to make compressed file quines, step by step.
👤Honno
🎖@malwr
🗣Honno
This is a demonstration of a recursive GZIP file being indefinitely decompressed by the Archive Utility in macOS. Credit to Tim Allison (video from here), who first found this happenstance around November last year on Mojave 10.14.6.
The problem is that the Utility does have checks to handle recursion with GZIP. The end result is frustration. With the small filesize of 204B, Archive Utility extracts it almost immediately, so the GUI becomes basically unusable as each progress bar instance is gone in less than a second!
It does do checks with recursive ZIP files however, where I believe it just stops after x numbers of decompressions (a common check to prevent infinite decompressions). I imagine this is the case because of the prevalence of ZIP bombs which nudged a developer to protect the users from excessive decompression.
(Note: ZIP and GZIP are different file formats!)
There probably isn't much of a security vulnerability here, but who knows with these things. An interesting project could be expanding the filesize of the GZIP (as most ZIP bombs do), which is certainly possible once you understand how DEFLATE compression works. When I get some time I'm definitely gunna play around with this myself.
A dirty trick could be to send an innocent sounding file (i.e.
coursework_submission.gz) to someone and piss them off for life ;)Details on the GZIP file can be found on a tutorial I made last year, How to make compressed file quines, step by step.
👤Honno
🎖@malwr
Reddit
r/cybersecurity on Reddit: A recursive GZIP file decompresses indefinitely using Archive Utility on macOS
Posted by u/Honno - 6 votes and 1 comment
Ghidra Processor Module Generator (GPMG)
https://github.com/oberoisecurity/ghidra-processor-module-generator
🎖@malwr
https://github.com/oberoisecurity/ghidra-processor-module-generator
🎖@malwr
GitHub
GitHub - oberoisecurity/ghidra-processor-module-generator: A step towards automating the creation of Ghidra processor modules
A step towards automating the creation of Ghidra processor modules - oberoisecurity/ghidra-processor-module-generator
Boost Your Command-Line Productivity With Fuzzy Finder
🗣b4r0k
Ever since I heard about broot, I prefer its tree layout over the flat fzf output: https://github.com/Canop/broot
👤karottenreibe
🎖@malwr
🗣b4r0k
Ever since I heard about broot, I prefer its tree layout over the flat fzf output: https://github.com/Canop/broot
👤karottenreibe
🎖@malwr
Medium
Boost Your Command-Line Productivity With Fuzzy Finder
Tips and tricks to level up your Command-line skills with Fuzzy Finder
How commercial anti cheats spy on reverse engineers
🗣amd64_sucks
what was the url for reports again? gonna block it via hostsfile...
👤WarrantyVoider
Is it possible to request this information through gdpr?
👤ZYy9oQ
Woah. That was very interesting.
👤maverickleopard
🎖@malwr
🗣amd64_sucks
what was the url for reports again? gonna block it via hostsfile...
👤WarrantyVoider
Is it possible to request this information through gdpr?
👤ZYy9oQ
Woah. That was very interesting.
👤maverickleopard
🎖@malwr
secret club
BattlEye reverse engineer tracking
Modern commercial anti-cheats are faced by an increasing competetiveness in professional game-hack production, and thus have begun implementing questionable methods to prevent this. In this article, we will present a previously unknown anti-cheat module,…
Is SearchMine Adware Teeing Up Your Endpoints For Other Threat Actors? | SentinelOne
🗣Cyberthere
🎖@malwr
🗣Cyberthere
🎖@malwr
SentinelOne
Is SearchMine Adware Teeing Up Your Endpoints For Other Threat Actors? | SentinelOne
A recent update to a notorious macOS browser hijacker exfiltrates data about the device environment and installed apps. Now what could they want that for?
[Blog Article Pekraut - German RAT starts gnawing](https://www.gdatasoftware.com/blog/2020/04/35849-pekraut-german-rat-starts-gnawing)
🗣Struppigel
🎖@malwr
🗣Struppigel
🎖@malwr
Gdatasoftware
Pekraut - German RAT starts gnawing
Feature-rich remote access malware Pekraut emerges. The rodent seems to be of German origin and is ready to be released. We analyzed the malware in-depth.
Hacking Rootkit Development 16 - Bypass 3.15 Linux Kernel x86 CR4 & CR0 pinning protections
🗣SourcecodeDeleted
🎖@malwr
🗣SourcecodeDeleted
🎖@malwr
YouTube
Hacking Rootkit Development 16 - Bypass Linux Kernel 3.15 x86 CR4 & CR0 pinning protections
Linux Kernel 5.3 solves the CR0 write exploit by making that register read only. Today let's discuss how we can write to the SyscallTable directly and not rely on the CR0 write exploit that we have been using. I heard about this method some time ago and I…
Bypassing CSP & Iframe Sandbox in Android Webview
Just published a blog post around why sensitive pages should not be loaded inside a webview - nuckingfoob on android webviews
Have tried to discuss how CSP & iframe sandbox, in a webview, can be bypassed by the underlying app. Critics welcome, feedback appreciated, expert advice would have me humbled.
🗣qre0ct
🎖@malwr
Just published a blog post around why sensitive pages should not be loaded inside a webview - nuckingfoob on android webviews
Have tried to discuss how CSP & iframe sandbox, in a webview, can be bypassed by the underlying app. Critics welcome, feedback appreciated, expert advice would have me humbled.
🗣qre0ct
🎖@malwr