fpicker: Fuzzing with Frida https://insinuator.net/2021/03/fpicker-fuzzing-with-frida/
One day short of a full chain: Part 2 - Chrome sandbox escape https://securitylab.github.com/research/2021-03-16-one_day_short_of_a_fullchain_sbx.html
Analysis of a VB Script Heap Overflow (CVE-2019-0666) https://www.malwaretech.com/2019/04/analysis-of-a-vb-script-heap-overflow.html
Malwaretech
Analysis of a VB Script Heap Overflow (CVE-2019-0666) – MalwareTech
Anyone who uses RegEx knows how easy it is to shoot yourself in the foot; but, is it possible to write RegEx so badly that it can lead to RCE? With VB Script, the answer is yes!
Google’s top security teams unilaterally shut down a counterterrorism operation https://www.technologyreview.com/2021/03/26/1021318/google-security-shut-down-counter-terrorist-us-ally/amp/
MIT Technology Review
Google’s top security teams unilaterally shut down a counterterrorism operation
A decision to shut down exploits being used by "friendly" hackers has caused controversy inside the company's security teams.
Nice report » FluBot: Malware Analysis Report https://raw.githubusercontent.com/prodaft/malware-ioc/master/FluBot/FluBot.pdf
Sodinokibi (aka REvil) Ransomware https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
The DFIR Report
Sodinokibi (aka REvil) Ransomware
Sodinokibi (aka REvil) has been one of the most prolific ransomware as a service (RaaS) groups over the last couple years. The ransomware family was purported to be behind the Travelex intrusion and current reports point to an attack against Acer for a reported…
Analyzing attacks taking advantage of the Exchange Server vulnerabilities https://www.microsoft.com/security/blog/2021/03/25/analyzing-attacks-taking-advantage-of-the-exchange-server-vulnerabilities/
Microsoft Security Blog
Analyzing attacks taking advantage of the Exchange Server vulnerabilities | Microsoft Security Blog
Microsoft continues to monitor and investigate attacks exploiting the recent on-premises Exchange Server vulnerabilities. As organizations recover from this incident, we continue to publish guidance and share threat intelligence to help detect and evict threat…
Addressing a particular internetworking misconception https://radar.qrator.net/blog/particular-misconception
APT Encounters of the Third Kind https://igor-blue.github.io/2021/03/24/apt1.html
Igor's Blog
APT Encounters of the Third Kind
A few weeks ago an ordinary security assessment turned into an incident response whirlwind. It was definitely a first for me, and I was kindly granted permission to outline the events in this blog post. This investigation started scary but turned out be quite…
CVE-2021-1732: win32kfull xxxCreateWindowEx callback out-of-bounds https://iamelli0t.github.io/2021/03/25/CVE-2021-1732.html
iamelli0t’s blog
CVE-2021-1732: win32kfull xxxCreateWindowEx callback out-of-bounds
CVE-2021-1732 is a 0-Day vulnerability exploited by the BITTER APT organization in one operation which was disclosed in February this year[1][2][3]. This vulnerability exploits a user mode callback opportunity in win32kfull module to break the normal execution…
In our new blog post, we have reverse-engineered the string decryption function of a sample of Mekotio malware to then brute-forced the decryption key in Python -- thx for the contribution, @RicardoJRdez! https://reversea.me/index.php/reverse-engineering-the-string-decryption-algorithm-of-mekotio/
Repository for information about 0-days exploited in-the-wild https://github.com/googleprojectzero/0days-in-the-wild
GitHub
GitHub - googleprojectzero/0days-in-the-wild: Repository for information about 0-days exploited in-the-wild.
Repository for information about 0-days exploited in-the-wild. - googleprojectzero/0days-in-the-wild
Pentester’s tricks: Local privilege escalation in OpenVAS https://csal.medium.com/pentesters-tricks-local-privilege-escalation-in-openvas-fe933d7f161f
Medium
Pentester’s tricks: Local privilege escalation in OpenVAS
It’s not a common scenario but if during a pentesting you get access to some machine with a user that has sudo rights to execute openvas…
One day short of a full chain: Part 3 - Chrome renderer RCE https://securitylab.github.com/research/one_day_short_of_a_fullchain_renderer/
Black Kingdom ransomware begins appearing on Exchange servers https://news.sophos.com/en-us/2021/03/23/black-kingdom/
Sophos
Black Kingdom ransomware begins appearing on Exchange servers
A novel, if not particularly well made, ransomware is spreading to Exchange servers that haven’t been patched against the ProxyLogon exploit
Speculating the entire x86-64 Instruction Set In Seconds with This One Weird Trick https://blog.can.ac/2021/03/22/speculating-x86-64-isa-with-one-weird-trick/
Can.ac
Speculating the entire x86-64 Instruction Set In Seconds with This One Weird Trick
As cheesy as the title sounds, I promise it cannot beat the cheesiness of the technique I’ll be telling you about in this post. The morning I saw Mark …
Simple utlity for sniffing decrypted HTTP/HTTPS traffic on a jailbroken iOS device into an HAR format https://github.com/doronz88/harlogger
GitHub
GitHub - doronz88/harlogger: Simple utlity for sniffing decrypted HTTP/HTTPS traffic on an macOS/iOS device (either jailbroken…
Simple utlity for sniffing decrypted HTTP/HTTPS traffic on an macOS/iOS device (either jailbroken or not) - doronz88/harlogger
Very good material here » Materials for Windows Malware Analysis training (volume 1) by @hasherezade https://github.com/hasherezade/malware_training_vol1
GitHub
GitHub - hasherezade/malware_training_vol1: Materials for Windows Malware Analysis training (volume 1)
Materials for Windows Malware Analysis training (volume 1) - hasherezade/malware_training_vol1
Triaging modern Android devices (aka android_triage bash script) https://blog.digital-forensics.it/2021/03/triaging-modern-android-devices-aka.html
blog.digital-forensics.it
Triaging modern Android devices (aka android_triage bash script)
DFIR research