fit: FIT is a Python3 application for forensic acquisition of contents like web pages, emails, social media, etc. directly from the internet.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
GitHub
GitHub - fit-project/fit: FIT is a modular suite of Python applications for digital forensic acquisition of online contents such…
FIT is a modular suite of Python applications for digital forensic acquisition of online contents such as web pages, emails, social media, and more. Each module can run independently or as part of ...
Infección en sitio web de e-commerce chileno - Infection on Chilean e-commerce website - after generating a connection to binance to be able to read a “smart contract”, you must execute whatever comes as a response through the “eval” method.
🗣digicat
🎖@malwr
🗣digicat
🎖@malwr
FINSIN
Infección en sitio web de e-commerce chileno
Por un proceso de simple suerte, visitando a un sitio de e-commerce chileno, me encontré con un popup extraño que me hizo recorrer una serie saltos y encontrar que el sitio había sido comprometido …
Swirl - An open-source search platform. It allows you to search and use AI to find the correct information quickly and easily.
🗣search_guy
🎖@malwr
🗣search_guy
🎖@malwr
GitHub
GitHub - swirlai/swirl-search: AI Search & RAG Without Moving Your Data. Get instant answers from your company's knowledge across…
AI Search & RAG Without Moving Your Data. Get instant answers from your company's knowledge across 100+ apps while keeping data secure. Deploy in minutes, not months. - swirlai/swirl-search
2nd October – Threat Intelligence Report
https://research.checkpoint.com/2023/2nd-october-threat-intelligence-report/
🎖@malwr
https://research.checkpoint.com/2023/2nd-october-threat-intelligence-report/
🎖@malwr
Check Point Research
2nd October – Threat Intelligence Report - Check Point Research
For the latest discoveries in cyber research for the week of 2nd October, please download our Threat_Intelligence Bulletin. TOP ATTACKS AND BREACHES Check Point researchers have detected a phishing campaign exploiting popular file-sharing program Dropbox.…
Free SIEM to augment existing SIEM.
Currently we have SIEM (SAAS Solution) that covers all of our servers, switches, routers firewalls.
We do not collect logs for any of our workstations (3000 workstations) and I would like to have something but we do not have any budget to increase our existing SIEM capacity. I just want to have something incase I need to review logs on a workstations.
I was looking at Wazuh but it does not look like it will scale well with that many workstations.
Any recommendations?
🗣Critical_Egg_913
I'm going to be different and say, you don't need a siem to handle workstations. Get alerts out of your EDR and then use Velociraptor to query for logs and other events on workstations.
👤mustacheride3
I just ran across gravwell.io I'm currently testing it out in a lab but it looks promising. It is free up to 14gb/day
👤semipvt
Graylog. Open Source Splunk.
👤SLC_CA
🎖@malwr
Currently we have SIEM (SAAS Solution) that covers all of our servers, switches, routers firewalls.
We do not collect logs for any of our workstations (3000 workstations) and I would like to have something but we do not have any budget to increase our existing SIEM capacity. I just want to have something incase I need to review logs on a workstations.
I was looking at Wazuh but it does not look like it will scale well with that many workstations.
Any recommendations?
🗣Critical_Egg_913
I'm going to be different and say, you don't need a siem to handle workstations. Get alerts out of your EDR and then use Velociraptor to query for logs and other events on workstations.
👤mustacheride3
I just ran across gravwell.io I'm currently testing it out in a lab but it looks promising. It is free up to 14gb/day
👤semipvt
Graylog. Open Source Splunk.
👤SLC_CA
🎖@malwr
Reddit
From the cybersecurity community on Reddit
Explore this post and more from the cybersecurity community
Food delivery robots give captured video footage to police
https://www.malwarebytes.com/blog/news/2023/10/food-delivery-robots-give-captured-video-footage-to-police
🎖@malwr
https://www.malwarebytes.com/blog/news/2023/10/food-delivery-robots-give-captured-video-footage-to-police
🎖@malwr
Malwarebytes
Food delivery robots give captured video footage to police
A food delivery service that deploys semi-autonomous robots has worked with the police, handing over camera feeds captured while the robots are out and about.
Let’s Go into the rabbit hole (part 1) — the challenges of dynamically hooking Golang programs
🗣guedou
🎖@malwr
🗣guedou
🎖@malwr
Quarkslab
Let’s Go into the rabbit hole (part 1) — the challenges of dynamically hooking Golang programs - Quarkslab's blog
Golang is the most used programming language for developing cloud technologies. Tools such as Kubernetes, Docker, Containerd and gVisor are written in Go. Despite the fact that the code of these programs is open source, there is no way to analyze and extend…
MSIFortune - LPE with MSI Installers
A quite long blogpost about several types of LPEs which I found in the msi repair function.
There is a lot of different stuff, much more then Mandiant reveiled a few months ago.
Tested about 1000 msi which was quite time consuming.
https://badoption.eu/blog/2023/10/03/MSIFortune.html
🗣PfiatDe
🎖@malwr
A quite long blogpost about several types of LPEs which I found in the msi repair function.
There is a lot of different stuff, much more then Mandiant reveiled a few months ago.
Tested about 1000 msi which was quite time consuming.
https://badoption.eu/blog/2023/10/03/MSIFortune.html
🗣PfiatDe
🎖@malwr
Google Cloud Blog
Escalating Privileges via Third-Party Windows Installers | Mandiant | Google Cloud Blog
👍1
TargetCompany Ransomware Abuses FUD Obfuscator Packers
In this entry, we detail our analysis of how the TargetCompany ransomware abused an iteration of fully undetectable (FUD) obfuscator engine BatCloak to infect vulnerable systems.
https://www.trendmicro.com/en_us/research/23/h/targetcompany-ransomware-abuses-fud-obfuscator-packers.html
🎖@malwr
In this entry, we detail our analysis of how the TargetCompany ransomware abused an iteration of fully undetectable (FUD) obfuscator engine BatCloak to infect vulnerable systems.
https://www.trendmicro.com/en_us/research/23/h/targetcompany-ransomware-abuses-fud-obfuscator-packers.html
🎖@malwr
Trend Micro
TargetCompany Ransomware Abuses FUD Obfuscator Packers
In this entry, we detail our analysis of how the TargetCompany ransomware abused an iteration of fully undetectable (FUD) obfuscator engine BatCloak to infect vulnerable systems.
👏1
Remote Code Execution In PyTorch Model Server TorchServe
Remote Code Execution In PyTorch Model Server TorchServe
Oligo's research team has uncovered a chain of critical vulnerabilities, named ShellTorch, including CVE-2023-43654 (CVSS: 9.8) in the PyTorch model server TorchServe.
This flaw allows unauthorized access to #AI models and enables Remote Code Execution (RCE) leaving countless services and end-users at risk.
🗣BigBother59
🎖@malwr
Remote Code Execution In PyTorch Model Server TorchServe
Oligo's research team has uncovered a chain of critical vulnerabilities, named ShellTorch, including CVE-2023-43654 (CVSS: 9.8) in the PyTorch model server TorchServe.
This flaw allows unauthorized access to #AI models and enables Remote Code Execution (RCE) leaving countless services and end-users at risk.
🗣BigBother59
🎖@malwr
GitHub
GHSA-4mqg-h5jf-j9m7 - GitHub Advisory Database
TorchServe Pre-Auth Remote Code Execution
😱1