Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991 https://qriousec.github.io/post/vbox-pwn2own-2023/
Qrious Secure
Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991
Introduction Hi, I am Trung (xikhud). Last month, I joined Qrious Secure team as a new member, and my first target was to find and reproduce the security bugs that @bienpnn used at the Pwn2Own Vancouver 2023 to escape the VirtualBox VM.
Since VirtualBox is…
Since VirtualBox is…
Unpacking BellaCiao: A Closer Look at Iran’s Latest Malware https://www.bitdefender.com/blog/businessinsights/unpacking-bellaciao-a-closer-look-at-irans-latest-malware/
Bitdefender Blog
Unpacking BellaCiao: A Closer Look at Iran’s Latest Malware
With recent reports that Charming Kitten group (aka Mint Sandstorm) is actively targeting critical infrastructure in the US and other countries, we would like to share the most recent insights from Bitdefender Labs about modernization of Charming Kitten’s…
Zyxel Firewall Devices Vulnerable to Remote Code Execution Attacks — Patch Now https://thehackernews.com/2023/04/zyxel-firewall-devices-vulnerable-to.html
AtomLdr: DLL loader with advanced evasive features https://securityonline.info/atomldr-dll-loader-with-advanced-evasive-features/
usd-2022-0034 | Privilege Escalation in Microsoft Windows https://herolab.usd.de/security-advisories/usd-2022-0034/
usd HeroLab
Security Advisory usd-2022-0034 | usd HeroLab
Advisory ID: usd-2022-0034 | Product: Microsoft Windows | Vulnerability Type: Improper Link Resolution Before File Access (CWE-59)
Finding XSS in a million websites (cPanel CVE-2023-29489) https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/
Total Identity Compromise: Microsoft Incident Response lessons on securing Active Directory https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/total-identity-compromise-microsoft-incident-response-lessons-on/ba-p/3753391
TECHCOMMUNITY.MICROSOFT.COM
Total Identity Compromise: Microsoft Incident Response lessons on securing Active Directory | Microsoft Community Hub
Total Identity Compromise: Microsoft Incident Response lessons on securing Active Directory
When Microsoft Incident Response (formerly DART/CRSP) is...
When Microsoft Incident Response (formerly DART/CRSP) is...
👍1
Breaking out of Docker via runC – Explaining CVE-2019-5736 https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/
Unit 42
Breaking out of Docker via runC – Explaining CVE-2019-5736
Last week (2019-02-11) a new vulnerability in runC was reported by its maintainers, originally found by Adam Iwaniuk and Borys Poplawski. Dubbed
Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707) https://starlabs.sg/blog/2023/04-microsoft-exchange-powershell-remoting-deserialization-leading-to-rce-cve-2023-21707/
STAR Labs
Microsoft Exchange Powershell Remoting Deserialization leading to RCE (CVE-2023-21707)
Introduction While analyzing CVE-2022-41082, also known as ProxyNotShell, we discovered this vulnerability which we have detailed in this blog. However, for a comprehensive understanding, we highly recommend reading the thorough analysis written by team ZDI.…
Silicon Shellcode Emulator Introduction (a lightweight x86/x64 emulator designed for Windows shellcode) https://www.youtube.com/watch?v=8gT2DhwqWqU
YouTube
Silicon Shellcode Emulator Introduction
A lightweight x86/x64 emulator designed for Windows shellcode.
More information at: https://cerbero.io
More information at: https://cerbero.io
PowerShell Malware with x64 Shellcode https://blog.cerbero.io/?p=2682
Exploiting the notoriously unsafe gets() on a PAC-protected ARM64 binary https://blog.ret2.io/2021/06/16/intro-to-pac-arm64/
RET2 Systems Blog
The Oddest Place You Will Ever Find PAC
The latest efforts to harden software against exploitable memory corruption vulnerabilities come in the form of hardware-assisted control flow integrity and ...
The ARM32 Scheduling and Kernelspace/Userspace Boundary https://people.kernel.org/linusw/the-arm32-scheduling-and-kernelspace-userspace-boundary
linusw
The ARM32 Scheduling and Kernelspace/Userspace Boundary — linusw
As of recent I needed to understand how the ARM32 architecture switches control of execution between normal, userspace processes and the ...
How we consistently manage hundreds of Kubernetes clusters across the globe https://tech.deliveryhero.com/how-we-consistently-manage-hundreds-of-kubernetes-clusters-across-the-globe/
Deliveryhero
How we consistently manage hundreds of Kubernetes clusters across the globe
How the SRE team in our Global Discovery tribe developed an abstraction layer over Terragrunt to manage infrastructure at scale efficiently. This is an explanatory walkthrough of our internal tooling that enables developers to become self-sufficient.
Detecting Unwanted Location Trackers https://datatracker.ietf.org/doc/draft-detecting-unwanted-location-trackers/
IETF Datatracker
Detecting Unwanted Location Trackers
This document lists a set of best practices and protocols for accessory manufacturers whose products have built-in location- tracking capabilities. By following these requirements and recommendations, a location-tracking accessory will be compatible with…
Dissecting Buffer Overflow Attacks in MongoDB https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/dissecting-buffer-overflow-attacks-in-mongodb/
Trustwave
Dissecting Buffer Overflow Attacks in MongoDB | Trustwave
Towards the end of 2020, a new vulnerability in MongoDB was found and published. The vulnerability affected almost all versions of MongoDB, up to v4.5.0, but was discussed and patched appropriately.
Tampering with Windows Event Tracing: Background, Offense, and Defense https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
Medium
Tampering with Windows Event Tracing: Background, Offense, and Defense
Event Tracing for Windows (ETW) is the mechanism Windows uses to trace and log system events. Attackers often clear event logs to cover…
288 dark web vendors arrested in major marketplace seizure https://www.europol.europa.eu/media-press/newsroom/news/288-dark-web-vendors-arrested-in-major-marketplace-seizure
Europol
288 dark web vendors arrested in major marketplace seizure – Law enforcement on three continents seize EUR 50.8 million in cash…
This operation, codenamed SpecTor, was composed of a series of separate complementary actions in Austria, France, Germany, the Netherlands, Poland, Brazil, the United Kingdom, the United States, and Switzerland. Intelligence packages as basis for investigations…
👍1
How to Use Wireshark to Capture, Filter and Inspect Packets https://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/
How-To Geek
How to Use Wireshark to Capture, Filter and Inspect Packets
Wireshark, a network analysis tool formerly known as Ethereal, captures packets in real time and display them in human-readable format. Wireshark includes filters, color coding, and other features that let you dig deep into network traffic and inspect individual…