New macOS malware XcodeSpy Targets Xcode Developers with EggShell Backdoor https://labs.sentinelone.com/new-macos-malware-xcodespy-targets-xcode-developers-with-eggshell-backdoor/
SentinelOne
New macOS Malware XcodeSpy Targets Xcode Developers with EggShell Backdoor - SentinelLabs
Targeting software developers is one route to a successful supply chain attack. Now threat actors are going after Apple developers through the Xcode IDE.
How we found and fixed a rare race condition in our session handling https://github.blog/2021-03-18-how-we-found-and-fixed-a-rare-race-condition-in-our-session-handling/
The GitHub Blog
How we found and fixed a rare race condition in our session handling
On March 8, out of an abundance of caution, we logged all users out of GitHub.com. In this post we share technical details of the vulnerability and steps we're taking to ensure it doesn't happen again.
Lsass Memory Dumps are Stealthier than Ever Before – Part 2 https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
Deep Instinct
LSASS Memory Dumps: New Method for Dumping LSASS [Part 2] | Deep Instinct
In this article, we show a new way to dump LSASS memory without dropping any new tool on the endpoint that is highly evasive.
ZHtrap, la nueva amenaza que convierte routers y otros equipos en honeypots https://blog.underc0de.org/zhtrap-la-nueva-amenaza-que-convierte-routers-y-otros-equipos-en-honeypots/
Underc0de Blog
ZHtrap, la nueva amenaza que convierte routers y otros equipos en honeypots - Underc0de Blog
Los dispositivos de redes, como por ejemplo un router, pueden sufrir muchos ataques. Son muchas las variedades de malware que de una u otra forma pueden
CVE-2018–8414: A Case Study in Responsible Disclosure https://posts.specterops.io/cve-2018-8414-a-case-study-in-responsible-disclosure-ff74c39615ba
Medium
CVE-2018–8414: A Case Study in Responsible Disclosure
The process of vulnerability disclosure can be riddled with frustrations, concerns about ethics, and communication failure. I have had…
CVE-2021-3156 (Sudo Baron Samedit) PoC https://github.com/worawit/CVE-2021-3156 and writeup https://datafarm-cybersecurity.medium.com/exploit-writeup-for-cve-2021-3156-sudo-baron-samedit-7a9a4282cb31
GitHub
GitHub - worawit/CVE-2021-3156: Sudo Baron Samedit Exploit
Sudo Baron Samedit Exploit. Contribute to worawit/CVE-2021-3156 development by creating an account on GitHub.
CVE-2021-27076: A Replay-Style Deserialization Attack Against SharePoint https://www.zerodayinitiative.com/blog/2021/3/17/cve-2021-27076-a-replay-style-deserialization-attack-against-sharepoint
Zero Day Initiative
Zero Day Initiative — CVE-2021-27076: A Replay-Style Deserialization Attack Against SharePoint
An attacker is frequently in the position of having to find a technique to evade some data integrity measure implemented by a target. One instructive example of a data integrity measure is a message authentication check. Generally, message authentication…
50 years of malware? Not really. 50 years of computer worms? That's a different story... https://isc.sans.edu/diary/27208
SANS Internet Storm Center
50 years of malware? Not really. 50 years of computer worms? That's a different story...
50 years of malware? Not really. 50 years of computer worms? That's a different story..., Author: Jan Kopriva
mmm 🤔🤔 » It’s time to stop using SMS for anything. https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80
Medium
It’s time to stop using SMS for anything.
By now most infosec professionals are aware of various ways SMS text messaging can be hijacked. For example so-called “SIM Swap” attacks…
fpicker: Fuzzing with Frida https://insinuator.net/2021/03/fpicker-fuzzing-with-frida/
One day short of a full chain: Part 2 - Chrome sandbox escape https://securitylab.github.com/research/2021-03-16-one_day_short_of_a_fullchain_sbx.html
Analysis of a VB Script Heap Overflow (CVE-2019-0666) https://www.malwaretech.com/2019/04/analysis-of-a-vb-script-heap-overflow.html
Malwaretech
Analysis of a VB Script Heap Overflow (CVE-2019-0666) – MalwareTech
Anyone who uses RegEx knows how easy it is to shoot yourself in the foot; but, is it possible to write RegEx so badly that it can lead to RCE? With VB Script, the answer is yes!
Google’s top security teams unilaterally shut down a counterterrorism operation https://www.technologyreview.com/2021/03/26/1021318/google-security-shut-down-counter-terrorist-us-ally/amp/
MIT Technology Review
Google’s top security teams unilaterally shut down a counterterrorism operation
A decision to shut down exploits being used by "friendly" hackers has caused controversy inside the company's security teams.
Nice report » FluBot: Malware Analysis Report https://raw.githubusercontent.com/prodaft/malware-ioc/master/FluBot/FluBot.pdf
Sodinokibi (aka REvil) Ransomware https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
The DFIR Report
Sodinokibi (aka REvil) Ransomware
Sodinokibi (aka REvil) has been one of the most prolific ransomware as a service (RaaS) groups over the last couple years. The ransomware family was purported to be behind the Travelex intrusion and current reports point to an attack against Acer for a reported…
Analyzing attacks taking advantage of the Exchange Server vulnerabilities https://www.microsoft.com/security/blog/2021/03/25/analyzing-attacks-taking-advantage-of-the-exchange-server-vulnerabilities/
Microsoft Security Blog
Analyzing attacks taking advantage of the Exchange Server vulnerabilities | Microsoft Security Blog
Microsoft continues to monitor and investigate attacks exploiting the recent on-premises Exchange Server vulnerabilities. As organizations recover from this incident, we continue to publish guidance and share threat intelligence to help detect and evict threat…
Addressing a particular internetworking misconception https://radar.qrator.net/blog/particular-misconception
APT Encounters of the Third Kind https://igor-blue.github.io/2021/03/24/apt1.html
Igor's Blog
APT Encounters of the Third Kind
A few weeks ago an ordinary security assessment turned into an incident response whirlwind. It was definitely a first for me, and I was kindly granted permission to outline the events in this blog post. This investigation started scary but turned out be quite…