After the Emotet Incident at Heise, where ERNW has been consulted for Incident Response, we decided to start a blogpost series, in which we want to regularly report on current attacks that we observe. In particular we want to provide details about the utilized…

The iPhone is one of the most popular smartphone devices. Thanks to its huge popularity, the iPhone gets a lot of attention from the forensic community. Multiple acquisition methods exist, allowing forensic users to obtain more or less information with more…

Posted by hugeh0ge, Ricerca Security NOTE: We have decided to make our PoC exclusively available to our customers to avoid abuse by scr...

"If succesfuly exploited, an attacker within NFC range could obtain remote code execution on android device's NFC daemon." https://t.co/T24r3qWNnF

win32k use-after-free poc. Contribute to james0x40/CVE-2020-0624 development by creating an account on GitHub.

started as a a fun way to take notes ... 16 mindmaps so far :) https://t.co/1VA1OUBzQ5

Background

Whenever a “new” DLL hijacking / planting trick is posted on Twitter, it generates a lot of comments. “It’s not a vulnerability!” or “There is a lot of hijackable DLLs on Windows…” are the most common reactions. Though, people often don’t really speak about…

One of the many areas of this field that I really enjoy is the "cat and mouse" game played between RedTeam and BlueTeam, each forcing the other to up their game. Often we see some awesome tools being released to help defenders detect malware or shellcode…

Errata Or Nah? Over the last 2-3 years, Microsoft has inserted various methods of virtualization introspection detection (big brain words) into the workings of patchguard. It shouldn’t come as surprise that this has happened, as subverting kernel patch protection…

#Sysmon 11 is out with a new Event type and several improvements! I’ve published a blog post detailing all new features here: https://t.co/kHcnnX1Ue6 #DFIR #Sysinternals #ThreatHunting

A TCP reset attack is executed using a single packet of data, no more than a few bytes in size. A spoofed TCP segment, crafted and sent by an attacker, tricks two victims into abandoning a TCP connection, interrupting possibly vital communications between…

Instant messaging apps have become the de-facto standard of real-time, text-based communications. The acquisition of instant messaging chats and communication histories can be extremely important for an investigation. In this article, we compare the five…

Hooking C/C++ code in Android application using Frida with introduction and explainations in every step - noob friendly

We are excited to announce that the Rust/WinRT project finally has a permanent and public home on GitHub: https://github.com/microsoft/winrt-rs Rust/WinRT follows in the tradition established by C++/WinRT of building language projections for the Windows Runtime…