Circumventing inotify Watchdogs https://www.archcloudlabs.com/projects/inotify/
Arch Cloud Labs
Circumventing inotify Watchdogs
About The Project Recently I’ve been building rudimentary file monitoring tools to get better at Golang, and build faux-watchdog programs for research at Arch Cloud Labs. Through this experimentation, I’ve identified some interesting gaps in the inotify subsystem…
👍1
Bypass-Sandbox-Evasion - Bypass Malware Sandbox Evasion Ram Check https://www.kitploit.com/2023/06/bypass-sandbox-evasion-bypass-malware.html
Kitploit
Kitploit – Maintenance in Progress
Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.
A Collection of Android (Samsung) Security Research References https://github.com/NetKingJ/awesome-android-security
GitHub
GitHub - NetKingJ/awesome-android-security: A Collection of Android (Samsung) Security Research References
A Collection of Android (Samsung) Security Research References - NetKingJ/awesome-android-security
Reverse Engineering Terminator aka Zemana AntiMalware/AntiLogger Driver https://voidsec.com/reverse-engineering-terminator-aka-zemana-antimalware-antilogger-driver/
VoidSec
Reverse Engineering Terminator aka Zemana AntiMalware/AntiLogger Driver - VoidSec
Reverse engineering Spybot's Terminator tool (Zemana Antimalware driver) to achieve LPE as SYSTEM and unrestricted raw SCSI disk read/write.
👍1
iOS App Extraction & Analysis https://datalocaltmp.github.io/ios-app-extraction-analysis.html
/data/local/tmp
Ios App Extraction & Analysis
There are many reasons you may want to extract iOS applications; one in particular is reviewing security and privacy aspects with an analysis tool such as Ghidra. Unfortunately, unlike .apk files for Android, .ipa files cannot be side-loaded very easily;…
💩1
Inside of the WASP's nest: deep dive into PyPI-hosted malware https://blog.virustotal.com/2023/06/inside-of-wasps-nest-deep-dive-into.html
Virustotal
Inside of the WASP's nest: deep dive into PyPI-hosted malware
Photo by Matheus Queiroz on Unsplash In late 2022 we decided to start monitoring PyPI , arguably the most important Python repository, a...
👍1
Emulating IoT Firmware Made Easy: Start Hacking Without the Physical Device https://boschko.ca/qemu-emulating-firmware/
Boschko Security Blog
Emulating IoT Firmware Made Easy: Start Hacking Without the Physical Device
A step-by-step how-to guide to using QEMU in Ubuntu 18.04 to emulate embedded devices.
👍2🤔1
Funds of every wallet created with the Trust Wallet browser extension could have been stolen without any user interaction https://blog.ledger.com/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-extension-could-have-been-stolen/
Ledger
Funds of Every Wallet Created With The Trust Wallet Browser Extension Could Have Been Stolen Without Any User Interaction | Ledger
Seed generation of Trust Wallet was flawed, the total entropy was only 32 bits. We have created a file containing all possible seeds. Fortunately, the Ledger Donjon discovered the vulnerability very quickly and likely avoided one of the biggest hack in the…
👍2
Swing VPN app is a DDOS botnet https://lecromee.github.io/posts/swing_vpn_ddosing_sites/
Greek geek
Swing VPN app is a DDOS botnet
tldr: Swing VPN is using its user base to DDOS sites using its users as a an attack botnet.
Introduction It all started with a friend of mine complaining that his phone was doing a request to a specific app every few seconds. Initial assumption was that the…
Introduction It all started with a friend of mine complaining that his phone was doing a request to a specific app every few seconds. Initial assumption was that the…
👍2
Turning Google smart speakers into wiretaps for $100k https://downrightnifty.me/blog/2022/12/26/hacking-google-home.html
🔥2
Shell We Assemble?
Unleashing Assembly for Shellcode Execution https://redops.at/en/blog/shell-we-assemble-unleashing-x86-inline-assembly-for-shellcode-execution
Unleashing Assembly for Shellcode Execution https://redops.at/en/blog/shell-we-assemble-unleashing-x86-inline-assembly-for-shellcode-execution
RedOps - English
.Shell We Assemble? Unleashing Assembly for Shellcode Execution - RedOps
👍2
It's vacation time, so we're going to disconnect for a while. We return in September. Have a good summer! https://media4.giphy.com/media/ToMjGppLes0ENI5osCc/giphy.gif
👍5❤2🤣1😨1
Today is the day! I hope you had a very good summer vacation, today we continue sharing interesting infosec news. Keep tuned! 😉
👍2🥰2🎉2❤1👏1
Red Team Tactics: Writing Windows Kernel Drivers for Advanced Persistence (Part 2) https://v3ded.github.io/redteam/red-team-tactics-writing-windows-kernel-drivers-for-advanced-persistence-part-2
v3ded.github.io
Red Team Tactics: Writing Windows Kernel Drivers for Advanced Persistence (Part 2)
Introduction Hey everyone! Welcome back to the second part of the kernel development series. In my previous post, we briefly covered some details on setting ...
Windows Triaging with Powershell — Part 1: Parsing Event Logs https://aditya-pratap9557.medium.com/windows-triaging-with-powershell-part-1-parsing-event-logs-a6748657d150
Medium
Windows Triaging with Powershell — Part 1: Parsing Event Logs
This is the part 1 for Triaging a Windows system with Powershell. On a Windows machine, Event Logs play an important role in determining a…
❤2
Windows Triaging with Powershell — Part 2: Artifacts Collection https://aditya-pratap9557.medium.com/windows-triaging-with-powershell-part-2-artifacts-collection-d28a8a9010cd
Medium
Windows Triaging with Powershell — Part 2: Artifacts Collection
The current blog is in continuation of Part 1 of Windows Triaging with Powershell. Part 1 described how the Powershell functions can be…
👍1
Leveraging Android Permissions: A Solver Approach https://blog.thalium.re/posts/leveraging-android-permissions/
THALIUM
Leveraging Android Permissions: A Solver Approach
The Android permission management system has already suffered from several vulnerabilities in the past. Such weaknesses can grant dangerous permissions to a malevolent application, an example being CALL_LOG, which gives access to all incoming and outgoing…
Cadet Blizzard emerges as a novel and distinct Russian threat actor https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/
Microsoft News
Cadet Blizzard emerges as a novel and distinct Russian threat actor
Microsoft shares new details about techniques of a distinct Russian state-sponsored threat actor, now elevated to the name Cadet Blizzard.
A Truly Graceful Wipe Out https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
The DFIR Report
A Truly Graceful Wipe Out - The DFIR Report
In this intrusion, dated May 2023, we observed Truebot being used to deploy Cobalt Strike and FlawedGrace (aka GraceWire & BARBWIRE) resulting in the exfiltration of data and the deployment of the MBR Killer wiper. The threat actors deployed the wiper within…