React Router Version 6 Tutorial – How to Set Up Router and Route to Other Components https://www.freecodecamp.org/news/how-to-use-react-router-version-6/
freeCodeCamp.org
React Router Version 6 Tutorial – How to Set Up Router and Route to Other Components
In this tutorial, we'll talk about what React Router is and how to use it. Then we'll discuss its features and how to use them in your React app to navigate to and render multiple components. Prerequisites A React app A good understanding of what c...
Trusted publishing: a new benchmark for packaging security https://blog.trailofbits.com/2023/05/23/trusted-publishing-a-new-benchmark-for-packaging-security/
The Trail of Bits Blog
Trusted publishing: a new benchmark for packaging security
Read the official announcement on the PyPI blog as well! For the past year, we’ve worked with the Python Package Index to add a new, more secure authentication method called “trusted publishing.” Trusted publishing eliminates the need for long-lived API tokens…
Compromised from Within: The Unauthorized Restoration of TorGuard’s Telegram Channel https://medium.com/@TorGuard/compromised-from-within-the-unauthorized-restoration-of-torguards-telegram-channel-dce4c5836
Medium
Compromised from Within: The Unauthorized Restoration of TorGuard’s Telegram Channel
This is the comprehensive, substantiated account of how TorGuard’s deleted Telegram Channel was improperly resurrected and handed over to a…
🔥1
Exploring P4 Protocol: Usage, Implementation, and CVE-2021-37535 https://redrays.io/exploring-p4-protocol-usage-implementation-and-cve-2021-37535/
RedRays - Your SAP Security Solution
Exploring P4 Protocol: Usage, Implementation, and CVE-2021-37535
Explore the P4 protocol's role in Java remote communication, its implementation, and security features. Understand its use in JNDI, RMI, and distributed systems. Dive into the CVE-2021-37535 vulnerability resolution for safer Java applications.
Salt Labs exposes a new vulnerability in popular OAuth framework, used in hundreds of online services https://salt.security/blog/a-new-oauth-vulnerability-that-may-impact-hundreds-of-online-services
salt.security
New OAuth Vulnerability Impacts Hundreds of Online Services
OAuth vulnerability earns CVE-2023-28131. Salt exposes a new vulnerability in the popular OAuth framework, used in hundreds of online services.
Introduction to the Z3 Solver framework with the Hex-Rays CTF Challenge 2023 https://www.youtube.com/watch?v=kZd1Hi0ZBYc
YouTube
Introduction to the Z3 Solver framework with the Hex-Rays CTF Challenge 2023
This CTF challenge from Hex-Rays presents a very good opportunity to introduce you to the Z3 framework.
In this video, we will solve the CTF challenge with the absolute beginners in mind.
- https://hex-rays.com/blog/free-madame-de-maintenon-ctf-challenge/…
In this video, we will solve the CTF challenge with the absolute beginners in mind.
- https://hex-rays.com/blog/free-madame-de-maintenon-ctf-challenge/…
Cloud-Based Malware Delivery: The Evolution of GuLoader https://research.checkpoint.com/2023/cloud-based-malware-delivery-the-evolution-of-guloader/
Check Point Research
Cloud-Based Malware Delivery: The Evolution of GuLoader - Check Point Research
Key takeaways Introduction Antivirus products are constantly evolving to become more sophisticated and better equipped to handle complex threats. As a result, malware developers strive to create new threats that can bypass the defenses of antivirus products.…
Future Exploitation Vector: File Extensions as Top-Level Domains https://www.trendmicro.com/en_us/research/23/e/future-exploitation-vector-file-extensions-as-top-level-domains.html
Trend Micro
Future Exploitation Vector File Extensions as Top Level Domains
In this blog entry, we will examine the security risks related to file extension-related Top-Level Domains (TLDs) while also providing best practices and recommendations on how both individual users and organizations can protect themselves from these hazards.
Future Exploitation Vector: File Extensions as Top-Level Domains https://www.trendmicro.com/en_us/research/23/e/future-exploitation-vector-file-extensions-as-top-level-domains.html
Trend Micro
Future Exploitation Vector File Extensions as Top Level Domains
In this blog entry, we will examine the security risks related to file extension-related Top-Level Domains (TLDs) while also providing best practices and recommendations on how both individual users and organizations can protect themselves from these hazards.
Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) https://status.barracuda.com/incidents/34kx82j5n4q9
Barracuda
Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) on May 19, 2023.
Barracuda Networks's Status Page - Barracuda identified a vulnerability (CVE-2023-2868) in our Email Security Gateway appliance (ESG) on May 19, 2023..
Rooting with root cause: finding a variant of a Project Zero bug https://github.blog/2023-05-25-rooting-with-root-cause-finding-a-variant-of-a-project-zero-bug/
The GitHub Blog
Rooting with root cause: finding a variant of a Project Zero bug
In this blog, I’ll look at CVE-2022-46395, a variant of CVE-2022-36449 (Project Zero issue 2327), and use it to gain arbitrary kernel code execution and root privileges from the untrusted app domain on an Android phone that uses the Arm Mali GPU. I’ll also…
Debugging the Windows Kernel and Undocumented Structures https://twitter.com/Steph3nSims/status/1662156705457909760?s=20
Nice series here >> Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells) https://pberba.github.io/security/2021/11/22/linux-threat-hunting-for-persistence-sysmon-auditd-webshell/ (and good summary map in https://pberba.github.io/assets/posts/common/20220201-linux-persistence.pdf)
pepe berba
Hunting for Persistence in Linux (Part 1): Auditd, Sysmon, Osquery (and Webshells)
An introduction to monitoring and logging in linux to look for persistence.
🔥1
Man-in-the-Middle Attacks without Rogue AP:
When WPAs Meet ICMP Redirects https://csis.gmu.edu/ksun/publications/WiFi_Interception_SP23.pdf
When WPAs Meet ICMP Redirects https://csis.gmu.edu/ksun/publications/WiFi_Interception_SP23.pdf
Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (aka Volt Typhoon) https://unit42.paloaltonetworks.com/volt-typhoon-threat-brief/
Unit 42
Threat Brief: Attacks on Critical Infrastructure Attributed to Insidious Taurus (Volt Typhoon)
Insidious Taurus, aka Volt Typhoon, is a nation-state TA attributed to the People's Republic of China. We provide an overview of their current activity and mitigations recommendations.
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware https://blog.talosintelligence.com/mercenary-intellexa-predator/
Cisco Talos
Mercenary mayhem: A technical analysis of Intellexa's PREDATOR spyware
Commercial spyware use is on the rise, with actors leveraging these sophisticated tools to conduct surveillance operations against a growing number of targets. Cisco Talos has new details of a commercial spyware product sold by the spyware firm Intellexa…
🤔1
GobRAT malware written in Go language targeting Linux routers https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
JPCERT/CC Eyes
GobRAT malware written in Go language targeting Linux routers - JPCERT/CC Eyes
JPCERT/CC has confirmed attacks that infected routers in Japan with malware around February 2023. This blog article explains the details of the attack confirmed by JPCERT/CC and GobRAT malware, which was used in the attack. ### Attack flow up to...