proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC https://github.com/wbenny/injdrv
GitHub
GitHub - wbenny/injdrv: proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC
proof-of-concept Windows Driver for injecting DLL into user-mode processes using APC - wbenny/injdrv
Bypassing Symantec Endpoint Protection for Fun & Profit (Defense Evasion) https://cognosec.com/bypassing-symantec-endpoint-protection-for-fun-profit-defense-evasion/e
Fuzzing software: advanced tricks (Part 2) https://securitylab.github.com/research/fuzzing-software-2
GitHub Security Lab
Fuzzing software: advanced tricks (Part 2)
In this second part of a two-part series about common challenges you usually face in your fuzzing work, we’ll visit some advanced fuzzing tricks.
Malware Reverse Engineering Handbook https://ccdcoe.org/library/publications/malware-reverse-engineering-handbook/
Exploiting popular macOS apps with a single “.terminal” file https://medium.com/@metnew/exploiting-popular-macos-apps-with-a-single-terminal-file-f6c2efdfedaa
Medium
Exploiting popular macOS apps with a single “.terminal” file.
A story about macOS File Quarantine, 10years old bug, OneDrive entitlements and UX Security in apps.
Ensiko: A Webshell With Ransomware Capabilities
https://blog.trendmicro.com/trendlabs-security-intelligence/ensiko-a-webshell-with-ransomware-capabilities/
https://blog.trendmicro.com/trendlabs-security-intelligence/ensiko-a-webshell-with-ransomware-capabilities/
Trend Micro
Research, News, and Perspectives
Mirai Botnet Exploit Weaponized to Attack IoT Devices via CVE-2020-5902 https://blog.trendmicro.com/trendlabs-security-intelligence/mirai-botnet-exploit-weaponized-to-attack-iot-devices-via-cve-2020-5902/
Trend Micro
Research, News, and Perspectives
GHSL-2020-072: Arbitrary file disclosure in JinJava - CVE-2020-12668 https://securitylab.github.com/advisories/GHSL-2020-072-hubspot_jinjava
GitHub Security Lab
GHSL-2020-072: Arbitrary file disclosure in JinJava - CVE-2020-12668
A user with privileges to write JinJava templates, for example in a CMS context, will be able to read arbitrary files from the file system.
Industrial Systems Can Be Hacked Remotely via VPN Vulnerabilities https://www.securityweek.com/industrial-systems-can-be-hacked-remotely-vpn-vulnerabilities
Securityweek
Industrial Systems Can Be Hacked Remotely via VPN Vulnerabilities | SecurityWeek.Com
Vulnerabilities discovered in VPN products primarily used for remote access to industrial systems can allow hackers to gain access to ICS and possibly cause physical damage
Interesting finding ->
Memorizing Behavior: Experiments with Overfit Machine Learning Models https://www.crowdstrike.com/blog/how-we-trained-overfit-models-to-identify-malicious-activity/
Memorizing Behavior: Experiments with Overfit Machine Learning Models https://www.crowdstrike.com/blog/how-we-trained-overfit-models-to-identify-malicious-activity/
Crowdstrike
How We Trained Overfit Models to Identify Malicious Activity
In this blog, we present the results of preliminary experiments with training highly interpolated models to identify malicious activity based on behavioral data.
Problems I have faced in Bug Bounty https://medium.com/@unknownuser1806/problems-i-have-faced-in-bug-bounty-3c9d0a679d8b
Medium
Problems I have faced in Bug Bounty
This is my second blog about #bugbounty.You can check out my first blog that is full of resources and content for bug bounty hunters. If…
Accelerate Memory Forensics with Intezer Analyze https://www.intezer.com/blog/intezer-analyze/accelerate-memory-forensics
Intezer
Accelerate Memory Forensics with Intezer Analyze - Intezer
Accelerate the memory dump analysis process using the Volatility memory forensics framework and the Intezer Analyze CLI.
Abusing the COM Registry Structure: CLSID, LocalServer32, & InprocServer32 https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
bohops
Abusing the COM Registry Structure: CLSID, LocalServer32, & InprocServer32
TL;DR Vendors are notorious for including and/or leaving behind Registry artifacts that could potentially be abused by attackers for lateral movement, evasion, bypass, and persistence. CLSIDs subke…
A course on Reverse Engineering iOS Applications https://github.com/ivRodriguezCA/RE-iOS-Apps
GitHub
GitHub - ivRodriguezCA/RE-iOS-Apps: A completely free, open source and online course about Reverse Engineering iOS Applications.
A completely free, open source and online course about Reverse Engineering iOS Applications. - ivRodriguezCA/RE-iOS-Apps
Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019 https://googleprojectzero.blogspot.com/2020/07/detection-deficit-year-in-review-of-0.html
projectzero.google
Detection Deficit: A Year in Review of 0-days Used In-The-Wild in 2019 - Project Zero
Posted by Maddie Stone, Project ZeroIn May 2019, Project Zero released our tracking spreadsheet for 0-days used “in the wild” and we started a mo...
Windows Process Injection: Command Line and Environment Variables https://modexp.wordpress.com/2020/07/31/wpi-cmdline-envar/
modexp
Windows Process Injection: Command Line and Environment Variables
Windows Process Injection: Command Line and Environment Variables Contents Introduction Shellcode Environment Variables Command Line Window Title Runtime Data 1. Introduction There are many ways to…
50 CVEs in 50 Days: Fuzzing Adobe Reader https://research.checkpoint.com/2018/50-adobe-cves-in-50-days/
Check Point Research
50 CVEs in 50 Days: Fuzzing Adobe Reader - Check Point Research
Research By: Yoav Alon, Netanel Ben-Simon Introduction The year 2017 was an inflection point in the vulnerability landscape. The number of new vulnerabilities reported that year was around 14,000, which is over twice the number from the year before (see table…
The core of Apple is PPL: Breaking the XNU kernel's kernel https://googleprojectzero.blogspot.com/2020/07/the-core-of-apple-is-ppl-breaking-xnu.html
projectzero.google
The core of Apple is PPL: Breaking the XNU kernel's kernel
Posted by Brandon Azad, Project ZeroWhile doing research for the one-byte exploit technique,...
Linux warning: TrickBot malware is now infecting your systems https://www.bleepingcomputer.com/news/security/linux-warning-trickbot-malware-is-now-infecting-your-systems/
BleepingComputer
Linux warning: TrickBot malware is now infecting your systems
TrickBot's Anchor malware platform has been ported to infect Linux devices and compromise further high-impact and high-value targets using covert channels.
CVE-2020–9854: "Unauthd" (code available in https://github.com/A2nkF/unauthd) https://objective-see.com/blog/blog_0x4D.html
GitHub
GitHub - A2nkF/unauthd: A local privilege escalation chain from user to kernel for MacOS < 10.15.5. CVE-2020–9854
A local privilege escalation chain from user to kernel for MacOS < 10.15.5. CVE-2020–9854 - GitHub - A2nkF/unauthd: A local privilege escalation chain from user to kernel for MacOS < ...
DUT Processes in Windows 10 https://windows-internals.com/dut-processes-in-windows-10/