Nice descriptions of CVE-2020-0751, CVE-2020-0890 and CVE-2020-0904 https://labs.bluefrostsecurity.de/advisories/bfs-sa-2020-002/ https://labs.bluefrostsecurity.de/advisories/bfs-sa-2020-003/ https://labs.bluefrostsecurity.de/advisories/bfs-sa-2020-001/
labs.bluefrostsecurity.de
Microsoft Hyper-V NULL Pointer Dereference Denial of Service | Bluefrostsecurity
Gozi: The Malware with a Thousand Faces https://research.checkpoint.com/2020/gozi-the-malware-with-a-thousand-faces/
Check Point Research
Gozi: The Malware with a Thousand Faces - Check Point Research
Introduction Most of the time, the relationship between cybercrime campaigns and malware strains is simple. Some malware strains, like the gone-but-not-forgotten GandCrab, are intimately tied to a single actor, who is using the malware directly or distributing…
Security in PRIME networks – Current status https://www.tarlogic.com/en/blog/security-in-prime-networks-current-status/
Tarlogic Security - Cyber Security and Ethical hacking
Security in PRIME networks - Current status
Since January 2019, all electricity meters for low power customers (up to 15 kW) in Spain are (or have been replaced by) smart electricity meters, allowing distributors to carry out consumption measurements and various supply point management operations remotely.…
New NIST publication on Cloud Computing and Forensics Challenges https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8006.pdf
Malware Used by Lazarus after Network Intrusion https://blogs.jpcert.or.jp/en/2020/08/Lazarus-malware.html
JPCERT/CC Eyes
Malware Used by Lazarus after Network Intrusion - JPCERT/CC Eyes
JPCERT/CC has observed attack activity by Lazarus (also known as Hidden Cobra) targeting Japanese organisations. Different types of malware are used during and after the intrusion. This article introduces one of the types of malware used after the intrusion.…
Using Frida as a scriptable cheat engine http://tickelton.gitlab.io/articles/cheating-with-frida/
Bypass SSL Pinning in android apps with Frida https://www.docdroid.net/zokUC70/android-ssl-pinning-pdf
www.docdroid.net
Android - SSL-Pinning.pdf
Credits: https://br.linkedin.com/in/atjunior Frida Code: https://codeshare.frida.re/@sowdust/ When i started making pentesting on android applications, i had problems on intercepting requests with burp suite and other proxies. So i’ve started to search more…
PoC for CVE-2020-1247 (Out Of Bound Read and Write) https://cpr-zero.checkpoint.com/vulns/cprid-2154/
CPR-Zero
CPR-Zero: CVE-2020-1247
Check Point Research Vulnerability Repository
More angr - Defeating 5 ELF Crackmes https://binaryresearch.github.io/2020/01/22/more-angr-defeating-5-ELF-crackmes.html
What is a canary, how does it work, and what does that mean if I want to write a modern exploit https://aaronryool.blogspot.com/2020/07/what-is-canary-how-does-it-work-and.html
Blogspot
What is a canary, how does it work, and what does that mean if I want to write a modern exploit.
Canaries were once regularly used in coal mining as an early warning system . Toxic gases such as carbon monoxide or asphyxiant gases...
CVE-2020-1337 – PrintDemon is dead, long live PrintDemon! https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/
VoidSec
CVE-2020-1337 – PrintDemon is dead, long live PrintDemon! - VoidSec
Vulnerability description, root cause analysis and PoC for CVE-2020-1337: PrintDemon’s (CVE-2020-1048) Patch Bypass via Junction Directory (TOCTOU).
CVE-2020-9715: Exploiting a Use-After-Free in Adobe Reader https://www.zerodayinitiative.com/blog/2020/9/2/cve-2020-9715-exploiting-a-use-after-free-in-adobe-reader
Zero Day Initiative
Zero Day Initiative — CVE-2020-9715: Exploiting a Use-After-Free in Adobe Reader
It’s a great feeling when you wake up in the morning to the smell of a fresh pour-over coffee and find a nice 0-day waiting for you in the queue. That’s my typical day-to-day morning at the ZDI. I won’t lie - some of the submissions can be disappointing but…
N1QL Injection: Kind of SQL Injection in a NoSQL Database https://labs.f-secure.com/blog/n1ql-injection-kind-of-sql-injection-in-a-nosql-database/
F-Secure
Useful online security tips and articles | F‑Secure
True cyber security combines advanced technology and best practice. Get tips and read articles on how to take your online security even further.
Fuzzing the Linux kernel (x86) entry code, Part 2 of 3 https://blogs.oracle.com/linux/fuzzing-the-linux-kernel-x86-entry-code%2c-part-2-of-3
Oracle
Fuzzing the Linux kernel (x86) entry code, Part 2 of 3
Part two of a three-part series that explores how to write a fuzzer targeting the Linux kernel entry code on x86.