UUIDs are Popular, but Bad for Performance — Let’s Discuss https://www.percona.com/blog/2019/11/22/uuids-are-popular-but-bad-for-performance-lets-discuss/
Percona Database Performance Blog
MySQL UUIDs - Bad For Performance
MySQL UUIDs are still very popular despite a majority of posts warning against their usage. Learn what UUIDs are and why they are very bad for MySQL performance.
Exploiting and detecting CVE-2021-25735: Kubernetes validating admission webhook bypass https://sysdig.com/blog/cve-2021-25735-kubernetes-admission-bypass/
Fuzzing exotic arch with AFL using ghidra emulator https://airbus-cyber-security.com/fuzzing-exotic-arch-with-afl-using-ghidra-emulator/ (src: https://github.com/airbus-cyber/afl_ghidra_emu)
Abusing Replication: Stealing AD FS Secrets Over the Network https://www.fireeye.com/blog/threat-research/2021/04/abusing-replication-stealing-adfs-secrets-over-the-network.html
Google Cloud Blog
Abusing AD FS Replication | Stealing Secrets Over the Network | Google Cloud Blog
Abusing AD FS Replication. We demonstrate how a threat actor can extract the encrypted Token Signing Certificate from anywhere on an internal network.
SSD Advisory – NETGEAR Nighthawk R7000 httpd PreAuth RCE https://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/
SSD Secure Disclosure
SSD Advisory – NETGEAR Nighthawk R7000 httpd PreAuth RCE - SSD Secure Disclosure
TL;DR Find out how a vulnerability in NETGEAR R7000 allows an attacker to run arbitrary code without requiring authentication with the device. Vulnerability Summary A vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations…
Google Promised Its Contact Tracing App Was Completely Private—But It Wasn’t https://themarkup.org/privacy/2021/04/27/google-promised-its-contact-tracing-app-was-completely-private-but-it-wasnt
The Markup
Google Promised Its Contact Tracing App Was Completely Private—But It Wasn’t
Researchers say hundreds of preinstalled apps can access a log found on Android devices where sensitive contact tracing information is stored
Bypassing EDR real-time injection detection logic https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection
Domain Hijacking Via Logic Error - Gandi and Route 53 Vulnerability
https://www.cyberis.co.uk/blog/domain-hijacking.html
https://www.cyberis.co.uk/blog/domain-hijacking.html
Cyberis Limited
Domain Hijacking Via Logic Error - Gandi And Route 53 Vulnerability
On 12 February 2021, Cyberis identified a weakness in the domain transfer processes of Gandi which allowed any Nominet registry domain (including .co.uk and org.uk domains) registered with Gandi to be transferred out of the owner’s control and into the control…
Mouse Trap — six 0days that allow a remote attacker to get full RCE on a box with no user interaction https://axelp.io/MouseTrap
Axel’s Blog
Mouse Trap
Six CVEs including a 0-click RCE on the latest version of RemoteMouse giving you full access to someone’s computer at the logged-on user’s privilege level.
“BadAlloc” – Memory allocation vulnerabilities could affect wide range of IoT and OT devices in industrial, medical, and enterprise networks https://msrc-blog.microsoft.com/2021/04/29/badalloc-memory-allocation-vulnerabilities-could-affect-wide-range-of-iot-and-ot-devices-in-industrial-medical-and-enterprise-networks/
Advisory: Cisco RV34X Series – Privilege Escalation in vpnTimer https://www.iot-inspector.com/blog/advisory-cisco-rv34x-series-privilege-escalation-vpntimer/
ONEKEY
Advisory: Cisco RV34X Series - Privilege Escalation in vpnTimer - ONEKEY
IoT Inspector detected a rare security vulnerability in Cisco's RV34X Series. Read the full root analysis on the blog!
Q1 2021 DDoS attacks and BGP incidents https://blog.qrator.net/en/q1-2021-report_129/
CVE-2021-21551- Hundreds Of Millions Of Dell Computers At Risk Due to Multiple BIOS Driver Privilege Escalation Flaws https://labs.sentinelone.com/cve-2021-21551-hundreds-of-millions-of-dell-computers-at-risk-due-to-multiple-bios-driver-privilege-escalation-flaws/
SentinelOne
CVE-2021-21551- Hundreds Of Millions Of Dell Computers At Risk Due to Multiple BIOS Driver Privilege Escalation Flaws - SentinelLabs
Update your Dell devices now! SentinelLabs discover five high severity flaws in Dell firmware update driver impacting desktops, laptops, notebooks and more.
byeintegrity-uac: Bypass UAC by hijacking a DLL https://securityonline.info/byeintegrity-uac-bypass-uac-by-hijacking-a-dll/
Cybersecurity News
byeintegrity-uac: Bypass UAC by hijacking a DLL
ByeIntegrity - Bypass User Account Control (UAC) to gain elevated (Administrator) privileges to run any program at a high integrity level.
"Configuration Recommendations for Hardening of Windows 10 Using Built-in Functionalities" and "Microsoft Office Telemetry" (from @BSI_Bund) https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Cyber-Security/SiSyPHuS/AP11/Hardening_Guideline.pdf?__blob=publicationFile&v=3 https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/Studien/Office_Telemetrie/Office_Telemetrie.pdf?__blob=publicationFile&v=1
Trickbot Brief: Creds and Beacons https://thedfirreport.com/2021/05/02/trickbot-brief-creds-and-beacons/
The DFIR Report
Trickbot Brief: Creds and Beacons
In an intrusion from this past month, Trickbot threat actors were seen enumerating and collecting information related to the domain as well as dumping passwords before leaving the network. Cobalt Strike Beacons were deployed and remained connected despite…
Anatomy of Cobalt Strike's DLL Stager https://blog.nviso.eu/2021/04/26/anatomy-of-cobalt-strike-dll-stagers/
NVISO Labs
Anatomy of Cobalt Strike’s DLL Stager
This blog post will cover the Cobalt Strike DLL stager's anatomy, design choices and highlight ways to reduce both log footprint and time-to-shellcode.
@RicardoJRdez and @daniel_uroz explain us their recent work published at @wootsecurity. Do not miss it! » "How powerful are Return Oriented Programming attacks?" https://reversea.me/index.php/how-powerful-are-return-oriented-programming-attacks/ great job guys!
cool new attacks on WiFi » FragAttacks (fragmentation and aggregation attacks): a collection of new security vulnerabilities that affect Wi-Fi devices (by @vanhoefm) https://www.fragattacks.com/ related paper: https://papers.mathyvanhoef.com/usenix2021.pdf
Fragattacks
FragAttacks: Security flaws in all Wi-Fi devices
We present three security design flaws in Wi-Fi and widepread implementation flaws. These can be abused to exfiltrate user data and attack local devices.