Reverse engineering of the Anubis malware https://orangecyberdefense.com/uk/blog/uncategorized/reverse-engineering-of-the-anubis-malware/
United Kingdom
Reverse engineering of the Anubis malware | Orange Cyberdefense
Anubis is an Android malware. It is known for stealing banking credentials and allowing its master to spy on the smartphone’s user. Find out more about reverse engineering of this malware.
Apache Tomcat RCE by deserialization (CVE-2020-9484) – write-up and exploit
https://www.redtimmy.com/java-hacking/apache-tomcat-rce-by-deserialization-cve-2020-9484-write-up-and-exploit/
https://www.redtimmy.com/java-hacking/apache-tomcat-rce-by-deserialization-cve-2020-9484-write-up-and-exploit/
Remote Code Execution in Citrix ADC https://swarm.ptsecurity.com/remote-code-execution-in-citrix-adc/
How x86_64 addresses memory https://blog.yossarian.net/2020/06/13/How-x86_64-addresses-memory
Living Off Windows Land – A New Native File “downldr” https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
SentinelOne
Living Off Windows Land - A New Native File "downldr" - SentinelLabs
A newly discovered LOLBin offers an alternative to certutil for helping adversaries download files from a remote server. Meet desktopimgdownldr.exe.
Sandboxing in Linux with zero lines of code https://blog.cloudflare.com/sandboxing-in-linux-with-zero-lines-of-code/
The Cloudflare Blog
Sandboxing in Linux with zero lines of code
In this post we will review Linux seccomp and learn how to sandbox any (even a proprietary) application without writing a single line of code.
An update on our security incident (on Twitter) https://blog.twitter.com/en_us/topics/company/2020/an-update-on-our-security-incident.html
Twitter
An update on our security incident
An update on our security incident and what we know so far.
Nice intro to SEH exploiting --> The Basics of Exploit Development 2: SEH Overflows https://www.coalfire.com/The-Coalfire-Blog/March-2020/The-Basics-of-Exploit-Development-2-SEH-Overflows
Coalfire.com
The Basics of Exploit Development 2: SEH Overflows
Advanced Windows Malware Analysis - Acquiring Memory Artifacts https://darungrim.com/research/2020-07-10-windows-malware-analysis-process-artifacts.html
HugeDomains
DarunGrim.com is for sale | HugeDomains
Find a domain name today. We make it easy.
Persistence Using Universal Windows Platform https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
Oddvar Moe's Blog
Persistence using Universal Windows Platform apps (APPX)
TL;DR Persistence can be achieved with Appx/UWP apps using the debugger options. This technique will not be visible by Autoruns. Two different approaches exists (registry keys). Listed below are th…
Antimalware Scan Interface Provider for Persistence
https://b4rtik.github.io/posts/antimalware-scan-interface-provider-for-persistence/
https://b4rtik.github.io/posts/antimalware-scan-interface-provider-for-persistence/
Breaking the D-Link DIR3060 Firmware Encryption - Static analysis of the decryption routine - Part 2.1 https://0x434b.dev/breaking-the-d-link-dir3060-firmware-encryption-static-analysis-of-the-decryption-routine-part-2-1/
Low-level adventures
Breaking the D-Link DIR3060 Firmware Encryption - Static analysis of the decryption routine - Part 2.1
Welcome back to part 2 of this series! If you have not checked out part 1 yet, please do so first, as it highlights important reconnaissance steps!
So let us dive right into the IDA adventure to get a better look at how imgdecrypt operates to secure firmware…
So let us dive right into the IDA adventure to get a better look at how imgdecrypt operates to secure firmware…
It Only Takes A Minute to Clone a Credit Card, Thanks to a 50-Year-Old Problem https://www.cyberdlab.com/content/dam/cyberdlab/insights/it-only-takes-a-minute-to-clone-a-credit-card-thanks-to-a-50-year-old-problem/It_Only_Takes_a_Minute_to_Clone_a_Credit_Card_%20Thanks_to_a_50_Year_Old_Problem.pdf
Reversing DexGuard, Part 3 – Code Virtualization
https://www.pnfsoftware.com/blog/reversing-dexguard-virtualization/
https://www.pnfsoftware.com/blog/reversing-dexguard-virtualization/
Detecting Linux memfd_create() Fileless Malware with Command Line Forensics https://www.sandflysecurity.com/blog/detecting-linux-memfd_create-fileless-malware-with-command-line-forensics/
Sandfly Security - Agentless Linux EDR and Incident Response
Linux Malware Detection | Ubuntu, Debian, Redhat, Suse, Fedora, Raspberry Pi etc Malware Detect
How to investigate fileless malware on Linux for different distributions: Ubuntu, Debian, Redhat, Suse, Fedora, Raspberry Pi, Arch Linux, CentOS... using simple command line tools and techniques. Easily find create_memfd() injection attacks and more.
The iPhone Data Recovery Myth: What You Can and Cannot Recover https://blog.elcomsoft.com/2020/07/the-iphone-data-recovery-myth-what-you-can-and-cannot-recover/
ElcomSoft blog
The iPhone Data Recovery Myth: What You Can and Cannot Recover
There is no lack of tools claiming the ability to recover lost or deleted information from the iPhone. These tools’ claims range from “Recover data lost due to water damaged, broken, deletion, device loss, etc.” to the much more reserved “Selectively recovers…
Structured fuzzing Android's NFC
https://securitylab.github.com/research/fuzzing_android_nfc
https://securitylab.github.com/research/fuzzing_android_nfc
GitHub Security Lab
Structured fuzzing Android’s NFC
Man Yue Mo built and open sourced a fuzzer for the Android Near Field Communication (NFC) component. He shares here some design considerations when building the fuzzer.