10 Years of Linux Security - A Report Card
🗣citypw
Keep in mind that grsecurity's business model relies on painting Linux, and in particular Linux security, in a negative light.
I'm not saying that makes any of this information invalid by itself, but it's worth considering the source.
👤awkisopen
I see words in that PDF but barely understand anything it's saying. Context is key.
This was clearly written by an engineer who had no idea whether or not the audience would understand the presentation.
👤ToasterToasts
Well, that could have benefited from some explanation of acronyms.
Most of the recommendations seemed to be process or attitude things. How about recommending some simplification, throwing away old code even if it still mostly works ? I'm mostly talking about user-space code. Could we get rid of the init structure and commit to systemd ? Get rid of some old encryption and hashing and VPN modules, force people onto the new stuff ? Have DNS specified in 1 place instead of 5 ?
👤billdietrich1
🎖@malwr
🗣citypw
Keep in mind that grsecurity's business model relies on painting Linux, and in particular Linux security, in a negative light.
I'm not saying that makes any of this information invalid by itself, but it's worth considering the source.
👤awkisopen
I see words in that PDF but barely understand anything it's saying. Context is key.
This was clearly written by an engineer who had no idea whether or not the audience would understand the presentation.
👤ToasterToasts
Well, that could have benefited from some explanation of acronyms.
Most of the recommendations seemed to be process or attitude things. How about recommending some simplification, throwing away old code even if it still mostly works ? I'm mostly talking about user-space code. Could we get rid of the init structure and commit to systemd ? Get rid of some old encryption and hashing and VPN modules, force people onto the new stuff ? Have DNS specified in 1 place instead of 5 ?
👤billdietrich1
🎖@malwr
The analyzer automates the process of exploring EFI files. After the analysis, well-known protocols, interrupts, etc. are found.
https://github.com/DSecurity/efiSeek
🎖@malwr
https://github.com/DSecurity/efiSeek
🎖@malwr
GitHub
GitHub - DSecurity/efiSeek: Ghidra analyzer for UEFI firmware.
Ghidra analyzer for UEFI firmware. Contribute to DSecurity/efiSeek development by creating an account on GitHub.
A buggy behavior located into CreateFile allows to hide malware from users and AV scanners. Microsoft will not fix it:
https://github.com/dalvarezperez/CreateFile_based_rootkit
#CreateFile #malware #rootkit #antivirus
ℹ️ Sent from one of our members
🎖@malwr
https://github.com/dalvarezperez/CreateFile_based_rootkit
#CreateFile #malware #rootkit #antivirus
ℹ️ Sent from one of our members
🎖@malwr
GitHub
GitHub - dalvarezperez/CreateFile_based_rootkit
Contribute to dalvarezperez/CreateFile_based_rootkit development by creating an account on GitHub.
Windows Process Injection: EM_GETHANDLE, WM_PASTE and EM_SETWORDBREAKPROC
🗣digicat
Can i have the name or twitter handle of the owner of this blog they do an amazing job
👤hilo25
https://twitter.com/modexpblog
👤digicat
🎖@malwr
🗣digicat
Can i have the name or twitter handle of the owner of this blog they do an amazing job
👤hilo25
https://twitter.com/modexpblog
👤digicat
🎖@malwr
modexp
Windows Process Injection: EM_GETHANDLE, WM_PASTE and EM_SETWORDBREAKPROC
Introduction Edit Controls Writing CP-1252 Compatible Code Initialization Set RAX to 0 Set RAX to 1 Set RAX to -1 Load and Store Data Two Byte Instructions Prefix Codes Generating Shellcode Injecti…
Fuzzing sockets in Teeworlds game
🗣logicaltrust-net
Never thought I'd see teeworlds here lol
👤MegaManSec2
🎖@malwr
🗣logicaltrust-net
Never thought I'd see teeworlds here lol
👤MegaManSec2
🎖@malwr
Security Audits, Penetration Tests - LogicalTrust
LogicalTrust - [EN] A-Z: Introducing SocketInjectingFuzzer and its first target - Teeworlds
The idea behind Socket Injecting Fuzzer is simple - fuzz applications working in the client-server architecture by mutating real data packets that are exchanged by them in real usage scenarios. Implementation is also simple because it is based on hooking…
[PDF ThaiCERT publishes "Threat Group Cards: A Threat Actor Encyclopedia" version 2.0 - Added 115 threat groups and many other updates - portal coming soon](https://www.dropbox.com/s/ds0ra0c8odwsv3m/Threat%20Group%20Cards.pdf?dl=0)
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
Dropbox
Threat Group Cards.pdf
Shared with Dropbox
An offensive guide to the Authorization Code grant - Comprehensive and digestible enumeration of security concerns in the OAuth 2.0 Authorization Code flow
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
NCC Group Research Blog
An offensive guide to the Authorization Code grant
OAuth is the widely used standard for access delegation, enabling many of the “Sign in with X” buttons and “Connect your Calendar” features of modern Internet software. OAut…
Microsoft launches free Memory Forensics and Rootkit Detection service for Linux systems
🗣dreamygeek
Perhaps read the official blog post before you all get your pitch forks out over the free service thats intended to make hard to find, in memory malware incredibly expensive to keep using for attackers without risk of exposure.
"Project Freta was designed and built with survivor bias at its core."
God forbid microsoft and their academic researchers do a good thing here and get any credit.
Yeesh 🙄
https://www.microsoft.com/en-us/research/blog/toward-trusted-sensing-for-the-cloud-introducing-project-freta/
👤jdwashere
Soooo... Volatility in the cloud?
👤YXZs
mmm... a rootkit that detects rootkits
👤skyl4nk
🎖@malwr
🗣dreamygeek
Perhaps read the official blog post before you all get your pitch forks out over the free service thats intended to make hard to find, in memory malware incredibly expensive to keep using for attackers without risk of exposure.
"Project Freta was designed and built with survivor bias at its core."
God forbid microsoft and their academic researchers do a good thing here and get any credit.
Yeesh 🙄
https://www.microsoft.com/en-us/research/blog/toward-trusted-sensing-for-the-cloud-introducing-project-freta/
👤jdwashere
Soooo... Volatility in the cloud?
👤YXZs
mmm... a rootkit that detects rootkits
👤skyl4nk
🎖@malwr
HelpMeGeek
Microsoft has launched a Free Memory Forensics and Rootkit Detection Service for Linux - HelpMeGeek
Microsoft has just launched a Free online service Project Freta aimed to discover forensic evidence on Linux systems. With this service you will be able to dig up hard-to-find rootkits and malware. The project is named after the Birthplace of Marie Curie…
AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations
🗣DllEntryPoint
🎖@malwr
🗣DllEntryPoint
🎖@malwr
Unit 42
AcidBox: Rare Malware Repurposing Turla Group Exploit Targeted Russian Organizations
A new advanced malware, dubbed AcidBox, was discovered being used by an unknown threat actor against Russian organizations in 2017.
ThiefQuest Ransomware detects VM (possibly)
Set up a Mac VM on VMWare, tried running the ThiefQuest Ransomware. On the Activity Monitor, I Force Quit vmware-tools-daemon, hoping it won't detect it as a VM. But I guess I'm wrong. It's either the samples I've gotten are wrong, or the malware detects a VM.
https://preview.redd.it/qjsk2yyu0h951.png?width=1910&format=png&auto=webp&s=e5d5186bee11b35fdc5eaa1d7c06d577c4a3da32
🗣LMJR500Army
It can still detect that it's in a VM even without the vmware-tools-daemon running. Common methods in this VMware kb article.
There are plenty of other anti-forensic methods for detecting a VM as well. Sometimes you need to be as tricky as the creators to get the malware to actually run when you are trying to examine it.
👤TheDarthSnarf
🎖@malwr
Set up a Mac VM on VMWare, tried running the ThiefQuest Ransomware. On the Activity Monitor, I Force Quit vmware-tools-daemon, hoping it won't detect it as a VM. But I guess I'm wrong. It's either the samples I've gotten are wrong, or the malware detects a VM.
https://preview.redd.it/qjsk2yyu0h951.png?width=1910&format=png&auto=webp&s=e5d5186bee11b35fdc5eaa1d7c06d577c4a3da32
🗣LMJR500Army
It can still detect that it's in a VM even without the vmware-tools-daemon running. Common methods in this VMware kb article.
There are plenty of other anti-forensic methods for detecting a VM as well. Sometimes you need to be as tricky as the creators to get the malware to actually run when you are trying to examine it.
👤TheDarthSnarf
🎖@malwr
