Google’s top security teams unilaterally shut down a counterterrorism operation https://www.technologyreview.com/2021/03/26/1021318/google-security-shut-down-counter-terrorist-us-ally/amp/
MIT Technology Review
Google’s top security teams unilaterally shut down a counterterrorism operation
A decision to shut down exploits being used by "friendly" hackers has caused controversy inside the company's security teams.
Nice report » FluBot: Malware Analysis Report https://raw.githubusercontent.com/prodaft/malware-ioc/master/FluBot/FluBot.pdf
Sodinokibi (aka REvil) Ransomware https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
The DFIR Report
Sodinokibi (aka REvil) Ransomware
Sodinokibi (aka REvil) has been one of the most prolific ransomware as a service (RaaS) groups over the last couple years. The ransomware family was purported to be behind the Travelex intrusion and current reports point to an attack against Acer for a reported…
Analyzing attacks taking advantage of the Exchange Server vulnerabilities https://www.microsoft.com/security/blog/2021/03/25/analyzing-attacks-taking-advantage-of-the-exchange-server-vulnerabilities/
Microsoft Security Blog
Analyzing attacks taking advantage of the Exchange Server vulnerabilities | Microsoft Security Blog
Microsoft continues to monitor and investigate attacks exploiting the recent on-premises Exchange Server vulnerabilities. As organizations recover from this incident, we continue to publish guidance and share threat intelligence to help detect and evict threat…
Addressing a particular internetworking misconception https://radar.qrator.net/blog/particular-misconception
APT Encounters of the Third Kind https://igor-blue.github.io/2021/03/24/apt1.html
Igor's Blog
APT Encounters of the Third Kind
A few weeks ago an ordinary security assessment turned into an incident response whirlwind. It was definitely a first for me, and I was kindly granted permission to outline the events in this blog post. This investigation started scary but turned out be quite…
CVE-2021-1732: win32kfull xxxCreateWindowEx callback out-of-bounds https://iamelli0t.github.io/2021/03/25/CVE-2021-1732.html
iamelli0t’s blog
CVE-2021-1732: win32kfull xxxCreateWindowEx callback out-of-bounds
CVE-2021-1732 is a 0-Day vulnerability exploited by the BITTER APT organization in one operation which was disclosed in February this year[1][2][3]. This vulnerability exploits a user mode callback opportunity in win32kfull module to break the normal execution…
In our new blog post, we have reverse-engineered the string decryption function of a sample of Mekotio malware to then brute-forced the decryption key in Python -- thx for the contribution, @RicardoJRdez! https://reversea.me/index.php/reverse-engineering-the-string-decryption-algorithm-of-mekotio/
Repository for information about 0-days exploited in-the-wild https://github.com/googleprojectzero/0days-in-the-wild
GitHub
GitHub - googleprojectzero/0days-in-the-wild: Repository for information about 0-days exploited in-the-wild.
Repository for information about 0-days exploited in-the-wild. - googleprojectzero/0days-in-the-wild
Pentester’s tricks: Local privilege escalation in OpenVAS https://csal.medium.com/pentesters-tricks-local-privilege-escalation-in-openvas-fe933d7f161f
Medium
Pentester’s tricks: Local privilege escalation in OpenVAS
It’s not a common scenario but if during a pentesting you get access to some machine with a user that has sudo rights to execute openvas…
One day short of a full chain: Part 3 - Chrome renderer RCE https://securitylab.github.com/research/one_day_short_of_a_fullchain_renderer/
Black Kingdom ransomware begins appearing on Exchange servers https://news.sophos.com/en-us/2021/03/23/black-kingdom/
Sophos
Black Kingdom ransomware begins appearing on Exchange servers
A novel, if not particularly well made, ransomware is spreading to Exchange servers that haven’t been patched against the ProxyLogon exploit
Speculating the entire x86-64 Instruction Set In Seconds with This One Weird Trick https://blog.can.ac/2021/03/22/speculating-x86-64-isa-with-one-weird-trick/
Can.ac
Speculating the entire x86-64 Instruction Set In Seconds with This One Weird Trick
As cheesy as the title sounds, I promise it cannot beat the cheesiness of the technique I’ll be telling you about in this post. The morning I saw Mark …
Simple utlity for sniffing decrypted HTTP/HTTPS traffic on a jailbroken iOS device into an HAR format https://github.com/doronz88/harlogger
GitHub
GitHub - doronz88/harlogger: Simple utlity for sniffing decrypted HTTP/HTTPS traffic on an macOS/iOS device (either jailbroken…
Simple utlity for sniffing decrypted HTTP/HTTPS traffic on an macOS/iOS device (either jailbroken or not) - doronz88/harlogger
Very good material here » Materials for Windows Malware Analysis training (volume 1) by @hasherezade https://github.com/hasherezade/malware_training_vol1
GitHub
GitHub - hasherezade/malware_training_vol1: Materials for Windows Malware Analysis training (volume 1)
Materials for Windows Malware Analysis training (volume 1) - hasherezade/malware_training_vol1
Triaging modern Android devices (aka android_triage bash script) https://blog.digital-forensics.it/2021/03/triaging-modern-android-devices-aka.html
blog.digital-forensics.it
Triaging modern Android devices (aka android_triage bash script)
DFIR research
Zero click vulnerability in Apple’s macOS Mail https://mikko-kenttala.medium.com/zero-click-vulnerability-in-apples-macos-mail-59e0c14b106c
Medium
Zero click vulnerability in Apple’s macOS Mail
Zero-Click Zip TL;DR
Executing Shellcode via Callbacks https://osandamalith.com/2021/04/01/executing-shellcode-via-callbacks/
🔐Blog of Osanda
Executing Shellcode via Callbacks | 🔐Blog of Osanda
What is a Callback Function? In simple terms, it’s a function that is called through a function pointer. When we pass a function pointer to the parameter where the callback function is required, on…
New vulnerabilities discovered [in QNAP devices] allow access to user data and complete takeover https://securingsam.com/new-vulnerabilities-allow-complete-takeover/
SAM Seamless Network
New Vulnerabilities Discovered Allow Access to User Data and Complete Takeover - SAM Seamless Network
SAM’s security research team is actively looking for vulnerabilities in IoT devices that have yet to be discovered in order to ensure our network security coverage is as accurate and up to date as possible.