List of Popular Applications that use the `--no-sandbox` flag when running Chromium and Chrome based Applications and may expose users to RCE vulnerabilities.
🗣docker-osx

This is literally just a list of Electron apps...

I'm not sure what "Untrusted desktop application without source code" has to do with sandboxing... if they wanted to give you malicious code, they don't need to use JS to do it. This feels like the author fundamentally doesn't understand the purpose of the sandbox and/or the security issues at hand.

Similarly with extensions, it seems pretty dumb to assume that a malicious extension in many of these applications wouldn't be able to cause damage regardless, especially considering that some of the extensions (e.g. for Teams, VSCode) are designed for performing file-system operations already.

It's also odd to me that this list doesn't separate what I would consider to be the biggest distinction for a discussion of sandboxing, which is whether or not the app renders web content from untrusted sources (e.g. chat rooms). I believe that would exclude VSCode, but would include Twitch, Slack, Signal, FBM, Teams, Discord, and Keybase. However, I don't think any of these intentionally accept arbitrary JS, so exploits still seem unlikely without some kind of additional XSS exploit.
👤thealliedhacker

PoC or GTFO
👤airza

What's the concern with Slack if it's sandboxed? That it's not open source?
👤hillgod


🎖@malwr

qrljacker for whatsapp
working program to generate a qrl code that when scanned, takes over somenes whatsapp session https://www.youtube.com/watch?v=TTf2MSPGuuA
🗣pwndbyqatux


🎖@malwr

MITRE ATT&CK Evaluation
Good morning all,

Might be useful information for red teamers with knowing product and what may get past with little to no information passed to blueteams.

https://attackevals.mitre-engenuity.org/enterprise/carbanak\_fin7/

Hope it helps
🗣icedcougar


🎖@malwr

Easy Malware to Reverse Engineer
Hey I have recently been analyzing some sample malware and everything I can find is for people far more advanced than me. Does anyone know were I can find some simple malware examples? I am using IDAPro and WinDbg
🗣wp28

There is https://github.com/ytisf/theZoo

It has the reversed source code too
👤kcirtappockets

If you haven’t already, working throughout the exercises and chapters in Practical Malware Analysis is a good starting point.
👤revolver-ocelot-saa

id be interested in knowing this as well
👤ansolo00


🎖@malwr

CVE-2021-30481: Source engine remote code execution via game invites
🗣hyperreality_monero

1 year to triage😳
👤i_has_many_cs


🎖@malwr

Signal: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective
🗣qw1ks1lv3r

Moxie rocking?
👤mepher

I value privacy as much as the next guy, but this post and the previous one the author links to both come off as kind of immature. I get it that Cellebrite is a shady company, but publicly insulting them is quite unprofessional. "Amateur hour" may not look good for Cellebrite, but it sure doesn't look good for Signal either.
👤IndependenceNo7975

that last paragraph...
👤hacksauce


🎖@malwr