List of Popular Applications that use the `--no-sandbox` flag when running Chromium and Chrome based Applications and may expose users to RCE vulnerabilities.
🗣docker-osx
This is literally just a list of Electron apps...
I'm not sure what "Untrusted desktop application without source code" has to do with sandboxing... if they wanted to give you malicious code, they don't need to use JS to do it. This feels like the author fundamentally doesn't understand the purpose of the sandbox and/or the security issues at hand.
Similarly with extensions, it seems pretty dumb to assume that a malicious extension in many of these applications wouldn't be able to cause damage regardless, especially considering that some of the extensions (e.g. for Teams, VSCode) are designed for performing file-system operations already.
It's also odd to me that this list doesn't separate what I would consider to be the biggest distinction for a discussion of sandboxing, which is whether or not the app renders web content from untrusted sources (e.g. chat rooms). I believe that would exclude VSCode, but would include Twitch, Slack, Signal, FBM, Teams, Discord, and Keybase. However, I don't think any of these intentionally accept arbitrary JS, so exploits still seem unlikely without some kind of additional XSS exploit.
👤thealliedhacker
PoC or GTFO
👤airza
What's the concern with Slack if it's sandboxed? That it's not open source?
👤hillgod
🎖@malwr
🗣docker-osx
This is literally just a list of Electron apps...
I'm not sure what "Untrusted desktop application without source code" has to do with sandboxing... if they wanted to give you malicious code, they don't need to use JS to do it. This feels like the author fundamentally doesn't understand the purpose of the sandbox and/or the security issues at hand.
Similarly with extensions, it seems pretty dumb to assume that a malicious extension in many of these applications wouldn't be able to cause damage regardless, especially considering that some of the extensions (e.g. for Teams, VSCode) are designed for performing file-system operations already.
It's also odd to me that this list doesn't separate what I would consider to be the biggest distinction for a discussion of sandboxing, which is whether or not the app renders web content from untrusted sources (e.g. chat rooms). I believe that would exclude VSCode, but would include Twitch, Slack, Signal, FBM, Teams, Discord, and Keybase. However, I don't think any of these intentionally accept arbitrary JS, so exploits still seem unlikely without some kind of additional XSS exploit.
👤thealliedhacker
PoC or GTFO
👤airza
What's the concern with Slack if it's sandboxed? That it's not open source?
👤hillgod
🎖@malwr
GitHub
GitHub - sickcodes/no-sandbox: No Sandbox - Applications That Run Chromium and Chrome Without The Sandbox. TL;DR exploits in these…
No Sandbox - Applications That Run Chromium and Chrome Without The Sandbox. TL;DR exploits in these browser based applications are already sandboxed escaped: https://no-sandbox.io/ - sickcodes/no-s...
qrljacker for whatsapp
working program to generate a qrl code that when scanned, takes over somenes whatsapp session https://www.youtube.com/watch?v=TTf2MSPGuuA
🗣pwndbyqatux
🎖@malwr
working program to generate a qrl code that when scanned, takes over somenes whatsapp session https://www.youtube.com/watch?v=TTf2MSPGuuA
🗣pwndbyqatux
🎖@malwr
YouTube
qrl
by generating a malicious qrlcode, you can hijack somebodys whatsapp session. this has worked for years and i dont see it stopping in the forseeable future. you should know that this exists and how its used in order to avoid having it done to you.
MITRE ATT&CK Evaluation
Good morning all,
Might be useful information for red teamers with knowing product and what may get past with little to no information passed to blueteams.
https://attackevals.mitre-engenuity.org/enterprise/carbanak\_fin7/
Hope it helps
🗣icedcougar
🎖@malwr
Good morning all,
Might be useful information for red teamers with knowing product and what may get past with little to no information passed to blueteams.
https://attackevals.mitre-engenuity.org/enterprise/carbanak\_fin7/
Hope it helps
🗣icedcougar
🎖@malwr
Reddit
r/redteamsec on Reddit: MITRE ATT&CK Evaluation
Posted by u/icedcougar - 27 votes and 1 comment
Easy Malware to Reverse Engineer
Hey I have recently been analyzing some sample malware and everything I can find is for people far more advanced than me. Does anyone know were I can find some simple malware examples? I am using IDAPro and WinDbg
🗣wp28
There is https://github.com/ytisf/theZoo
It has the reversed source code too
👤kcirtappockets
If you haven’t already, working throughout the exercises and chapters in Practical Malware Analysis is a good starting point.
👤revolver-ocelot-saa
id be interested in knowing this as well
👤ansolo00
🎖@malwr
Hey I have recently been analyzing some sample malware and everything I can find is for people far more advanced than me. Does anyone know were I can find some simple malware examples? I am using IDAPro and WinDbg
🗣wp28
There is https://github.com/ytisf/theZoo
It has the reversed source code too
👤kcirtappockets
If you haven’t already, working throughout the exercises and chapters in Practical Malware Analysis is a good starting point.
👤revolver-ocelot-saa
id be interested in knowing this as well
👤ansolo00
🎖@malwr
Reddit
From the Malware community on Reddit
Explore this post and more from the Malware community
Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day
🗣kickinitlegit
🎖@malwr
🗣kickinitlegit
🎖@malwr
Google Cloud
Mandiant Cybersecurity Consulting
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
CVE-2021-30481: Source engine remote code execution via game invites
🗣hyperreality_monero
1 year to triage😳
👤i_has_many_cs
🎖@malwr
🗣hyperreality_monero
1 year to triage😳
👤i_has_many_cs
🎖@malwr
secret club
CVE-2021-30481: Source engine remote code execution via game invites
Steam is the most popular PC game launcher in the world. It gives millions of people the chance to play their favorite video games with their friends using the built in friend and party system, so it’s safe to assume most users have accepted an invite at…
Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day
🗣b1x3r
🎖@malwr
🗣b1x3r
🎖@malwr
Google Cloud
Mandiant Cybersecurity Consulting
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
Zero-Day Exploits in SonicWall Email Security Lead to Enterprise Compromise
🗣digicat
https://www.sonicwall.comsupport/product-notification/security-notice-sonicwall-email-security-zero-day-vulnerabilities/210416112932360/
👤digicat
🎖@malwr
🗣digicat
https://www.sonicwall.comsupport/product-notification/security-notice-sonicwall-email-security-zero-day-vulnerabilities/210416112932360/
👤digicat
🎖@malwr
Google Cloud
Mandiant Cybersecurity Consulting
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
Detect and exploit OS command injection vulnerabilities against #GraphQL applications via commix.
🗣Alex4nd3r
https://twitter.com/commixproject/status/1384724380647895041
👤RemyLebau
🎖@malwr
🗣Alex4nd3r
https://twitter.com/commixproject/status/1384724380647895041
👤RemyLebau
🎖@malwr
GitHub
Minor improvement regarding parsing GraphQL JSON objects. · commixproject/commix@a8f1a8a
Automated All-in-One OS Command Injection Exploitation Tool - commixproject/commix
pe - Golang package to parse Windows PE files that is fast, complete and robust against malformed files.
🗣Godswitch991
🎖@malwr
🗣Godswitch991
🎖@malwr
GitHub
GitHub - saferwall/pe: A lightweight Go package to parse, analyze and extract metadata from Portable Executable (PE) binaries.…
A :zap: lightweight Go package to parse, analyze and extract metadata from Portable Executable (PE) binaries. Designed for malware analysis tasks and robust against PE malformations. - saferwall/pe
Signal: Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective
🗣qw1ks1lv3r
Moxie rocking?
👤mepher
I value privacy as much as the next guy, but this post and the previous one the author links to both come off as kind of immature. I get it that Cellebrite is a shady company, but publicly insulting them is quite unprofessional. "Amateur hour" may not look good for Cellebrite, but it sure doesn't look good for Signal either.
👤IndependenceNo7975
that last paragraph...
👤hacksauce
🎖@malwr
🗣qw1ks1lv3r
Moxie rocking?
👤mepher
I value privacy as much as the next guy, but this post and the previous one the author links to both come off as kind of immature. I get it that Cellebrite is a shady company, but publicly insulting them is quite unprofessional. "Amateur hour" may not look good for Cellebrite, but it sure doesn't look good for Signal either.
👤IndependenceNo7975
that last paragraph...
👤hacksauce
🎖@malwr
Signal
Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app's perspective
Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included…
Taking Action Against Hackers in Palestine - Facebook
🗣darronofsky
And hereby a more detailed report on one of the groups they tracked, named Arid Viper: https://about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf
👤darronofsky
🎖@malwr
🗣darronofsky
And hereby a more detailed report on one of the groups they tracked, named Arid Viper: https://about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf
👤darronofsky
🎖@malwr
Meta Newsroom
Taking Action Against Hackers in Palestine
We’re sharing actions we took against two separate groups of hackers — removing their ability to abuse our platform, distribute malware and hack people’s accounts across the internet.
.E01 (bootable) converted to .VMDK with Virtual Box was successful, however the bootup sits on this screen and Im not sure could be keeping it from finishing a boot up of Windows. The VM spec is about 26GB RAM, dynamic sizing, and the E01 was a functioning Win machine. Why wont it finish booting?
🗣mattisha
I feel like you are doing too many steps. As others have said, use Arsenal or even FTK Imager. Mount the E01 as a Physical Disk. Then using VMWare or Hyper-V just make a new VM, and the only disk you should add is this new PhysicalDisk. The most important thing is matching BIOS or UEFI of the host, that's really about it. If it's Windows 10 it should fix itself and boot.
Or, just pay for Arsenal and it will boot a VM in one click and bypass the bitlocker and lock screen for ya. Def worth it.
👤FunkeDope
We usually mount the E01 using Arsenal Image Mounter and create a VM with VMware giving the mounted physical drive as VM hdd.
👤walker1993
I've never had success with this method...I always just restore the image to another disk.
👤kstewart0x00
🎖@malwr
🗣mattisha
I feel like you are doing too many steps. As others have said, use Arsenal or even FTK Imager. Mount the E01 as a Physical Disk. Then using VMWare or Hyper-V just make a new VM, and the only disk you should add is this new PhysicalDisk. The most important thing is matching BIOS or UEFI of the host, that's really about it. If it's Windows 10 it should fix itself and boot.
Or, just pay for Arsenal and it will boot a VM in one click and bypass the bitlocker and lock screen for ya. Def worth it.
👤FunkeDope
We usually mount the E01 using Arsenal Image Mounter and create a VM with VMware giving the mounted physical drive as VM hdd.
👤walker1993
I've never had success with this method...I always just restore the image to another disk.
👤kstewart0x00
🎖@malwr
