TSK/Autopsy - Web Artifacts Opera
Hello,
i was wondering why the history of the opera web browser is not detected.
I know that on the web page it says Firefox, Chrome and Internet Explorer. Is it anywhere documented why the Opera browser is not included?
🗣guyizda
As to why I don't know. It does seem it is an sqllite database, much like Chrome/Firefox.
Looks like there is a reference in their github for android:
https://github.com/sleuthkit/autopsy/blob/646a7a9e12148512de8db6ab030f78f297248394/InternalPythonModules/android/operabrowser.py
Mention to the windows location here:
https://github.com/sleuthkit/autopsy/blob/ab60e9c29ed8be6a43f918ffa29f228a6cdf270a/thirdparty/plaso/plaso-20180818-Win32/artifacts/webbrowser.yaml
👤AnalyzeAllTheLogs
Autopsy is generally...not that good. Opera is Chromium based and uses WebKit (Blink now?), so it is probably sorted under the Chrome history.
👤FunkeDope
🎖@malwr
Hello,
i was wondering why the history of the opera web browser is not detected.
I know that on the web page it says Firefox, Chrome and Internet Explorer. Is it anywhere documented why the Opera browser is not included?
🗣guyizda
As to why I don't know. It does seem it is an sqllite database, much like Chrome/Firefox.
Looks like there is a reference in their github for android:
https://github.com/sleuthkit/autopsy/blob/646a7a9e12148512de8db6ab030f78f297248394/InternalPythonModules/android/operabrowser.py
Mention to the windows location here:
https://github.com/sleuthkit/autopsy/blob/ab60e9c29ed8be6a43f918ffa29f228a6cdf270a/thirdparty/plaso/plaso-20180818-Win32/artifacts/webbrowser.yaml
👤AnalyzeAllTheLogs
Autopsy is generally...not that good. Opera is Chromium based and uses WebKit (Blink now?), so it is probably sorted under the Chrome history.
👤FunkeDope
🎖@malwr
reddit
TSK/Autopsy - Web Artifacts Opera
Hello, i was wondering why the history of the opera web browser is not detected. I know that on the web page it says Firefox, Chrome and...
Analyzing in the wild exploitation of CVE-2019-1367 by DarkHotel #APT and Magnitude EK. The exploit introduced a Write-What-Where bug that works in every version of JScript engine.
🗣eliya_confiant
🎖@malwr
🗣eliya_confiant
🎖@malwr
Confiant
Internet Explorer CVE-2019–1367 In the wild Exploitation — prelude
Originally written by Taha Karim
Technical write up by researcher who found vulnerabilities in the Tenda AC15 AC1900 firmware 15.03.05.19 (5 CVEs issued - CMDi, XSS, CSRF, Hardcoded Telnet Password)
🗣goopcat
🎖@malwr
🗣goopcat
🎖@malwr
Medium
Tenda AC15 AC1900 Vulnerabilities Discovered and Exploited
Demonstrating how remote attackers can gain control of the Tenda AC15 AC1900.
https://github.com/ThisIsLibra/MalPull
More info: https://maxkersten.nl/projects/malpull/
ℹ️ Sent from one of our members
🎖@malwr
More info: https://maxkersten.nl/projects/malpull/
ℹ️ Sent from one of our members
🎖@malwr
GitHub
GitHub - ThisIsLibra/MalPull: A multi-threaded malware sample downloader based upon given MD-5/SHA-1/SHA-256 hashes, using multiple…
A multi-threaded malware sample downloader based upon given MD-5/SHA-1/SHA-256 hashes, using multiple malware databases. - ThisIsLibra/MalPull
Malware News
A Twitter Hacking Spree Hits Musk, Obama, Apple, and More 🗣zr0_day 🎖@malwr
All the messages appear to lead back to the same digital wallet, which received its first incoming transaction at 3:03 pm EDT. It has recorded around 300 transactions since, although several of those are outgoing. It's not clear at this time to where.
🎖@malwr
🎖@malwr
Malware News
All the messages appear to lead back to the same digital wallet, which received its first incoming transaction at 3:03 pm EDT. It has recorded around 300 transactions since, although several of those are outgoing. It's not clear at this time to where. 🎖@malwr
At 10:38pm ET, the official Twitter Support account gave a more detailed explanation of the company's findings so far. "We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools," the thread states. "We know they used this access to take control of many highly-visible (including verified) accounts and Tweet on their behalf.
🎖@malwr
🎖@malwr
Cisco Talos on election security - 4 years of research on election infrastructure, the goals of our adversaries, and how the cybersecurity community can help
🗣WorksAtCisco
🎖@malwr
🗣WorksAtCisco
🎖@malwr
Talosintelligence
What to expect when you’re electing: Talos’ 2020 election security primer
A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group
PhD thesis (2020) by Guo Li / UC San Diego: "An Empirical Analysis on [Cyber Threat Intelligence: Data Characteristics and Real-World Uses"](https://escholarship.org/uc/item/5h9983b0)
🗣mrkoot
🎖@malwr
🗣mrkoot
🎖@malwr
escholarship.org
An Empirical Analysis on Threat Intelligence: Data Characteristics and Real-World Uses
Author(s): Li, Guo | Advisor(s): Savage, Stefan; Levchenko, Kirill | Abstract: Threat Intelligence, both as a concept and a product, has been increasingly gaining prominence in the security industry. At a high-level, it is the “knowledge” that helps organizations…
Container escape for Windows Server Containers explained
🗣pingpongfifa
Correct me if I'm wrong, but when have containers ever been safe from attacks trying to break out of the container? I thought that the consensus was that if you want more safety, you should run a virtual machine instead.
👤david171971
Is Windows Sandbox in Windows 10 also based on Containers or on Hyper-V? Does it have the same escape issues?
👤tubularobot
In other news, Microsoft adds yet another technology to Windows with security as a tertiary concern.
👤riskable
🎖@malwr
🗣pingpongfifa
Correct me if I'm wrong, but when have containers ever been safe from attacks trying to break out of the container? I thought that the consensus was that if you want more safety, you should run a virtual machine instead.
👤david171971
Is Windows Sandbox in Windows 10 also based on Containers or on Hyper-V? Does it have the same escape issues?
👤tubularobot
In other news, Microsoft adds yet another technology to Windows with security as a tertiary concern.
👤riskable
🎖@malwr
Unit 42
Windows Server Containers Are Open, and Here's How You Can Break Out
We demonstrate a complete technique to escalate privileges and escape Windows Server Containers.
Z80 Explorer -- Zilog Z80 netlist-level simulator running Z80 machine code, with features that can help reverse-engineer and understand this chip better
🗣r_retrohacking_mod2
This is fantastic stuff!
I can see uses for this with my own work, indeed.
👤heriomortis
There are also other interesting Z80 articles on that site.
👤r_retrohacking_mod2
🎖@malwr
🗣r_retrohacking_mod2
This is fantastic stuff!
I can see uses for this with my own work, indeed.
👤heriomortis
There are also other interesting Z80 articles on that site.
👤r_retrohacking_mod2
🎖@malwr
Baltazar Studios
Z80 Explorer - Baltazar Studios
Z80 Explorer is a Z80 netlist-level simulator capable of running Z80 machine code and also an educational tool with features that help reverse engineer and understand this chip better.