Ghidra Processor Module Generator (GPMG)
https://github.com/oberoisecurity/ghidra-processor-module-generator
🎖@malwr
https://github.com/oberoisecurity/ghidra-processor-module-generator
🎖@malwr
GitHub
GitHub - oberoisecurity/ghidra-processor-module-generator: A step towards automating the creation of Ghidra processor modules
A step towards automating the creation of Ghidra processor modules - oberoisecurity/ghidra-processor-module-generator
Boost Your Command-Line Productivity With Fuzzy Finder
🗣b4r0k
Ever since I heard about broot, I prefer its tree layout over the flat fzf output: https://github.com/Canop/broot
👤karottenreibe
🎖@malwr
🗣b4r0k
Ever since I heard about broot, I prefer its tree layout over the flat fzf output: https://github.com/Canop/broot
👤karottenreibe
🎖@malwr
Medium
Boost Your Command-Line Productivity With Fuzzy Finder
Tips and tricks to level up your Command-line skills with Fuzzy Finder
How commercial anti cheats spy on reverse engineers
🗣amd64_sucks
what was the url for reports again? gonna block it via hostsfile...
👤WarrantyVoider
Is it possible to request this information through gdpr?
👤ZYy9oQ
Woah. That was very interesting.
👤maverickleopard
🎖@malwr
🗣amd64_sucks
what was the url for reports again? gonna block it via hostsfile...
👤WarrantyVoider
Is it possible to request this information through gdpr?
👤ZYy9oQ
Woah. That was very interesting.
👤maverickleopard
🎖@malwr
secret club
BattlEye reverse engineer tracking
Modern commercial anti-cheats are faced by an increasing competetiveness in professional game-hack production, and thus have begun implementing questionable methods to prevent this. In this article, we will present a previously unknown anti-cheat module,…
Is SearchMine Adware Teeing Up Your Endpoints For Other Threat Actors? | SentinelOne
🗣Cyberthere
🎖@malwr
🗣Cyberthere
🎖@malwr
SentinelOne
Is SearchMine Adware Teeing Up Your Endpoints For Other Threat Actors? | SentinelOne
A recent update to a notorious macOS browser hijacker exfiltrates data about the device environment and installed apps. Now what could they want that for?
[Blog Article Pekraut - German RAT starts gnawing](https://www.gdatasoftware.com/blog/2020/04/35849-pekraut-german-rat-starts-gnawing)
🗣Struppigel
🎖@malwr
🗣Struppigel
🎖@malwr
Gdatasoftware
Pekraut - German RAT starts gnawing
Feature-rich remote access malware Pekraut emerges. The rodent seems to be of German origin and is ready to be released. We analyzed the malware in-depth.
Hacking Rootkit Development 16 - Bypass 3.15 Linux Kernel x86 CR4 & CR0 pinning protections
🗣SourcecodeDeleted
🎖@malwr
🗣SourcecodeDeleted
🎖@malwr
YouTube
Hacking Rootkit Development 16 - Bypass Linux Kernel 3.15 x86 CR4 & CR0 pinning protections
Linux Kernel 5.3 solves the CR0 write exploit by making that register read only. Today let's discuss how we can write to the SyscallTable directly and not rely on the CR0 write exploit that we have been using. I heard about this method some time ago and I…
Bypassing CSP & Iframe Sandbox in Android Webview
Just published a blog post around why sensitive pages should not be loaded inside a webview - nuckingfoob on android webviews
Have tried to discuss how CSP & iframe sandbox, in a webview, can be bypassed by the underlying app. Critics welcome, feedback appreciated, expert advice would have me humbled.
🗣qre0ct
🎖@malwr
Just published a blog post around why sensitive pages should not be loaded inside a webview - nuckingfoob on android webviews
Have tried to discuss how CSP & iframe sandbox, in a webview, can be bypassed by the underlying app. Critics welcome, feedback appreciated, expert advice would have me humbled.
🗣qre0ct
🎖@malwr
CVE-2020-3947: A UAF in VMware Workstation that could be used for guest-to-host code execution
🗣RedmondSecGnome
🎖@malwr
🗣RedmondSecGnome
🎖@malwr
Zero Day Initiative
Zero Day Initiative — CVE-2020-3947: Use-After-Free Vulnerability in the VMware Workstation DHCP Component
Ever since introducing the virtualization category at Pwn2Own in 2016, guest-to-host escapes have been a highlight of the contest. This year’s event was no exception. Other guest-to-host escapes have also come through the ZDI program throughout the year.…
Amid Pandemic, Microsoft Alerts Dozens of Hospitals Vulnerable to Ransomware Threat
🗣secureyourdata
🎖@malwr
🗣secureyourdata
🎖@malwr
PCMAG
Amid Pandemic, Microsoft Alerts Dozens of Hospitals Vulnerable to Ransomware Threat
Microsoft said it warned 'several dozens of hospitals' about vulnerabilities in their networks that could be used to deliver ransomware to their IT systems.
safe-mail: A Docker service used by analysts to extract and inspect suspicious .MSG, .EML, and documents
Everyone, I would like to introduce a new utility for Security Analysts that I built called safe-mail. You can find the repository here: https://github.com/swimlane/safe-mail
safe-mail is a Docker service used by analysts to upload, extract, and inspect suspicious .MSG, .EML, and documents.
safe-mail has an API and a (limited) UI which allows a user to upload and retrieve artifacts generated by safe-mail.
safe-mail has the following features and functionality:
Message Features
• Upload EML and MSG mail messages as well as Microsoft Office documents themselves
• .MSG mail messages are Microsoft binary email format messages - typically from Microsoft Outlook clients
• Generates a PNG of the message itself named {filename}.png
• Extracts all embedded & attached images/attachments within the email message
• Provides a OCR text file of the generated mail message
• Generates a JSON file representing the mail message headers
Attachment/Document Features
• Extracts attachments of mail messages
• Generates an image & PDF of each attachment
• Attempts to extract any identified Macros within attachments and creates a JSON file representing the Macro code base
• PDF Documents will generate output from pdfid & pdfparser tools
• ZIP attachments will extract the zip and return any files within the zip
Enjoy! I hope this helps you all on a daily basis!
🗣[Unas](https://www.reddit.com/r/blueteamsec/comments/ftynlo/safemailadockerserviceusedbyanalyststo/)
🎖@malwr
Everyone, I would like to introduce a new utility for Security Analysts that I built called safe-mail. You can find the repository here: https://github.com/swimlane/safe-mail
safe-mail is a Docker service used by analysts to upload, extract, and inspect suspicious .MSG, .EML, and documents.
safe-mail can be used locally on your workstation or can be deployed for shared (or dedicated) use.safe-mail has an API and a (limited) UI which allows a user to upload and retrieve artifacts generated by safe-mail.
safe-mail has the following features and functionality:
Message Features
• Upload EML and MSG mail messages as well as Microsoft Office documents themselves
• .MSG mail messages are Microsoft binary email format messages - typically from Microsoft Outlook clients
• Generates a PNG of the message itself named {filename}.png
• Extracts all embedded & attached images/attachments within the email message
• Provides a OCR text file of the generated mail message
• Generates a JSON file representing the mail message headers
Attachment/Document Features
• Extracts attachments of mail messages
• Generates an image & PDF of each attachment
• Attempts to extract any identified Macros within attachments and creates a JSON file representing the Macro code base
• PDF Documents will generate output from pdfid & pdfparser tools
• ZIP attachments will extract the zip and return any files within the zip
Enjoy! I hope this helps you all on a daily basis!
🗣[Unas](https://www.reddit.com/r/blueteamsec/comments/ftynlo/safemailadockerserviceusedbyanalyststo/)
🎖@malwr
I discovered a vulnerability in Safari that allowed unauthorized websites to access your camera on iOS and macOS
🗣ga-vu
Nice write up and it's cool to see the Apple program finally paying out bounties to non-blessed researchers!
👤SirensToGo
Nice
👤morrislesterszyslak
And this is why I use an adblocker. Though recently, I have stepped up my game with a PiHole as well.
👤thatvhstapeguy
🎖@malwr
🗣ga-vu
Nice write up and it's cool to see the Apple program finally paying out bounties to non-blessed researchers!
👤SirensToGo
Nice
👤morrislesterszyslak
And this is why I use an adblocker. Though recently, I have stepped up my game with a PiHole as well.
👤thatvhstapeguy
🎖@malwr
Ryan Pickren
Webcam Hacking | Ryan Pickren
A vulnerability in Safari allowed hackers to access the iPhone and Macbook cameras. (CVE-2020-3852, CVE-2020-3864, CVE-2020-3865, CVE-2020-3885, CVE-2020-3887 & CVE-2020-9784)