Creating a lightweight malware Scanner
Dear Cybersecurity experts,
I worked at a company where a lot of people would come by with their personal USB drives and use them to load documents onto computers inside the corporate network. These computers where outside of the internet and had no antivirus, meaning that if a virus would be loaded onto it using an USB it could damage the machine easily. Nobody ever checked the comtent of the usb drives before connecting them.

To prevent this, I came up with the simple solution of creating an application for the Raspberry Pi. The Raspberry Pi had a touchscreen, so when the user brought his usb drive, he would connect it to the raspberry pi, select it on the touchscreen and let it verify from the app. After it was confirmed from the application that the usb was clean, the user was allowed to connect it to the server. Even if a virus happened to infect the Raspberry Pi (very unlikely), it was easier to replace than a computer.

Since the Raspberry Pi 3 I used for the project didn't have that much resources to work with, the virus scanner I created was very simple and only used MD5 hashes to check for viruses. It compared each hashed file with a database and that's it. On one hand it's a very fast and lightweight approach, on the other hand it's not very secure.

So, since I'm not an Security expert myself, I wanted to ask you if you know any other systems I might use to check a file without using up too much resources. Sandboxing a file for example is probably not possible using just about 1GB Ram.

If you want to check it out, my project is open-source: Raspirus

I used the signatures in MD5 format from Virusshare for my database.
🗣Benben377

You could possibly try some sort of YARA implementation.

YARA:

https://virustotal.github.io/yara/

more resources and rule sets:

https://github.com/InQuest/awesome-yara
👤_hudsn


🎖@malwr

Reconnaissance Tools | Part 1 | TryHackMe Red Team Recon
In this video walk-through, we covered the first part of passive and active reconnaissance basics and tools. We covered DNS reconnaissance using tools such as dig, whois, nslookup in addition to online tools such as threat intelligence platforms. This was part of TryHackMe Red team pathway.

Video is here

Writeup is here
🗣MotasemHa


🎖@malwr

How do you get a debit/credit card without linking it to you?
For Ops Sec purposes:
- how will you get a debit/credit card or whatsoever that you can use to pay for AWS etc without having it traced back to you?

P.S.: Legal methods only please. Please don’t suggest buying off credit card details from dumps etc.
🗣Huang_Hua

The way you’re asking this question is most certainly for nefarious based purposes. Most threat actors will use compromised aws accounts or buy cc dumps.
👤AstroBoy1337

If you are doing legal and authorized testing, this is not necessary. As others have suggested, it is actually better to identify yourself to these services so they know that you aren't a real threat actor - otherwise, they suspend your account, you have bigger problems. They will be more likely to reach out if you information is legit and verifiable. I even use a +pentest alias in my contact email address.

For sketchier services (like residential proxy providers, in my experience) you can use something like Privacy.com, or use crypto if they accept it. The circumstances where you have to consider a service provider in your threat model as an authorized res teamer is few and far between.
👤DoctorGasbag

Buy a cash card from Walmart or Le Target Boutique (Target). You hand them cash, they will activate it there, and you can use that for subsequent online transactions executed over a VPN. Those don't work with Azure but *shrugs* there are plenty of other providers that they do work with. I haven't tried them with AWS.
👤CellUpper5067


🎖@malwr

New ways to inject system CA certificates in Android 14
🗣pimterry

Been using this the last couple days. Loved the ingenuity to it
👤tysear

This is an update to a previous post from a couple of weeks back, discussed quite a bit in this sub over here: https://httptoolkit.com/blog/android-14-install-system-ca-certificate/
👤pimterry


🎖@malwr