Nice use for your Rapsberry :) » TorPi - Raspberry Pi Tor Access Point https://3os.org/raspberryPi/TOR-Pi/
Kimsuky Phishing Operations Putting In Work https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/
ThreatConnect | Intelligence-Driven Security Operations
Kimsuky Phishing Operations Putting In Work - ThreatConnect | Intelligence-Driven Security Operations
Executive Summary Recently, an international NGO that provides threat sharing and analysis support to frequently targeted communities reached out to ThreatConnect wanting to learn more about the origins of a targeted phishing attack they were researching.…
Interesting post on attribution » The Emerald Connection: EquationGroup collaboration with Stuxnet https://fmmresearch.wordpress.com/2020/09/28/the-emerald-connection-equationgroup-collaboration-with-stuxnet/
Facundo Muñoz Research
The Emerald Connection: EquationGroup collaboration with Stuxnet
Introduction This article is part of a continued ongoing effort in my research of the use of a series of libraries called Exploit Development Framework (EDF) created by EquationGroup for the develo…
GitHub - RCE via git option injection (almost) - $20,000 Bounty https://devcraft.io/2020/10/18/github-rce-git-inject.html
devcraft.io
GitHub - RCE via git option injection (almost) - $20,000 Bounty
It had been a while since I’d looked into GitHub, so I thought it would be good to spin up a fresh enterprise trial and see what I could find. The GHE code is obfuscated, but it’s just to discourage customers from messing around and if you do a bit of googling…
LodaRAT Update: Alive and Well https://blog.talosintelligence.com/2020/09/lodarat-update-alive-and-well.html
Cisco Talos Blog
LodaRAT Update: Alive and Well
By Chris Neal.
* During our continuous monitoring of LodaRAT, Cisco Talos observed changes in the threat that add new functionality.
* Multiple new versions of LodaRAT have been spotted being used in the wild.
* These new versions of LodaRAT abandoned…
* During our continuous monitoring of LodaRAT, Cisco Talos observed changes in the threat that add new functionality.
* Multiple new versions of LodaRAT have been spotted being used in the wild.
* These new versions of LodaRAT abandoned…
An overview of targeted attacks and APTs on Linux https://securelist.com/an-overview-of-targeted-attacks-and-apts-on-linux/98440/
Securelist
An overview of targeted attacks and APTs on Linux
The GReAT team at Kaspersky publishes regular summaries of APT activity. In this report, we focus on the targeting of Linux resources by APT threat actors.
I Like to Move It: Windows Lateral Movement Part 3: DLL Hijacking https://www.mdsec.co.uk/2020/10/i-live-to-move-it-windows-lateral-movement-part-3-dll-hijacking/
MDSec
I Like to Move It: Windows Lateral Movement Part 3: DLL Hijacking - MDSec
Overview In the past two posts of this series, we’ve covered lateral movement through WMI event subscriptions and DCOM, detailing approaches to improve the OpSec of our tradecraft. In the...
CVE-2019-8081 in Adobe Experience Manager https://pankajupadhyay.in/2020/10/02/cve-2019-8081-in-adobe-experience-manager/
Pankaj Upadhyay
CVE-2019-8081 in Adobe Experience Manager
Adobe Experience Manager is a suite of online cloud-based services provided by Adobe for content and digital asset management. It includes a set of analytics, social, adver…
Arbitrary code execution on Facebook for Android through download feature https://medium.com/@dPhoeniixx/arbitrary-code-execution-on-facebook-for-android-through-download-feature-fb6826e33e0f
Medium
Arbitrary code execution on Facebook for Android through download feature
TL;DR
Frida Android Binder hooking example (on GitHub) https://github.com/mame82/misc/blob/master/native_binder.ts
GitHub
misc/native_binder.ts at master · mame82/misc
Contribute to mame82/misc development by creating an account on GitHub.
From Zero to main(): Bare metal C https://interrupt.memfault.com/blog/zero-to-main-1
Interrupt
From Zero to main(): Bare metal C
Throughout the Zero to main() series of posts, we demystify what happens between when power is applied and your main function is called. In the process, we’ll learn how to bootstrap a C environment, implement a bootloader, relocate code, and more!
Sysmon Internals - From File Delete Event to Kernel Code Execution https://undev.ninja/sysmon-internals-from-file-delete-event-to-kernel-code-execution/
undev.ninja
Sysmon Internals - From File Delete Event to Kernel Code Execution
Sysmon File Delete Event Internals and Kernel Code Execution
XDSpy: Stealing government secrets since 2011 https://www.welivesecurity.com/2020/10/02/xdspy-stealing-government-secrets-since-2011/
WeLiveSecurity
XDSpy: Stealing government secrets since 2011
ESET researchers uncover a new APT group that has been stealing sensitive documents from several governments in Eastern Europe and the Balkans since 2011.
Crouching T2, Hidden Danger https://ironpeak.be/blog/crouching-t2-hidden-danger/
ironpeak.be
Crouching T2, Hidden Danger - ironPeak Blog
MITRE ATT&CK turned purple – Part 1: Hijack execution flow https://blog.nviso.eu/2020/10/06/mitre-attack-turned-purple-part-1-hijack-execution-flow/
NVISO Labs
MITRE ATT&CK turned purple – Part 1: Hijack execution flow
The MITRE ATT&CK framework is probably the most well-known framework in terms of adversary emulation and by extent, red teaming.It features numerous TTPs (Tactics, Techniques, and Procedures) a…
Microsoft Digital Defense Report, September 2020: Insights about the threat intelligence landscape https://www.microsoft.com/en-us/download/details.aspx?id=101738
Microsoft Download Center
Digital Defense Report, September 2020
Insights about the threat intelligence landscape and guidance from experts, practitioners, and defenders at Microsoft
Bug in New Function ExAllocatePoolZero Results in Security Vulnerability and Crashes
https://www.osr.com/blog/2020/07/14/bug-in-new-function-exallocatepoolzero-results-in-security-vulnerability-and-crashes/
https://www.osr.com/blog/2020/07/14/bug-in-new-function-exallocatepoolzero-results-in-security-vulnerability-and-crashes/
OSR
Bug in New Function ExAllocatePoolZero Results in Security Vulnerability and Crashes
Update: Late in December 2020 Microsoft issued an update to the WDK/EWDK that includes mitigations for this security issue. See our blog post describing these updates. tl;dr Last week (week of 5 Ju…
Ryuk’s Return https://thedfirreport.com/2020/10/08/ryuks-return/
The DFIR Report
Ryuk's Return - The DFIR Report
Intro The Ryuk group went from an email to domain wide ransomware in 29 hours and asked for over $6 million to unlock our systems. They used tools such as Cobalt Strike, AdFind, WMI, vsftpd, PowerShell, PowerView, and Rubeus to accomplish their objective.…
Security Analysis of CHERI ISA https://github.com/microsoft/MSRC-Security-Research/blob/master/papers/2020/Security%20analysis%20of%20CHERI%20ISA.pdf
GitHub
MSRC-Security-Research/Security analysis of CHERI ISA.pdf at master · microsoft/MSRC-Security-Research
Security Research from the Microsoft Security Response Center (MSRC) - MSRC-Security-Research/Security analysis of CHERI ISA.pdf at master · microsoft/MSRC-Security-Research