A brief introduction about CLSID and a bypass found https://medium.com/stolabs/a-brief-introduction-about-clsid-and-a-bypass-found-c11be972a38b
Medium
A brief introduction about CLSID and a bypass found
Hi there! A few days ago I was studying about the CLSID, or Class ID, and I’ve found something interesting! A bypass in the Avast Sandbox…
Test for network leaks, discover a product flaw and get vendor to fix https://medium.com/sensorfu/test-for-network-leaks-discover-a-product-flaw-and-get-vendor-to-fix-c041abbda39a
Medium
Test for network leaks, discover a product flaw and get vendor to fix
Plot twist: this time it is not about us doing vulnerability research and reporting. This is a story about our customer in action, told to…
Analysing the fall 2020 Emotet Campaign https://neurosoft.gr/analysing-the-fall-2020-emotet-campaign/
CVE-2020-17140 Windows SMB Information Disclosure Analysis https://blogs.360.cn/post/CVE-2020-17140-Analysis.html
Brownie is a platform to rapidly prototype and weaponise DLL hijacks https://github.com/slaeryan/AQUARMOURY/tree/master/Brownie
Nice reading about ZK proofs » Reverie: An optimized zero-knowledge proof system https://blog.trailofbits.com/2020/12/14/reverie-an-optimized-zero-knowledge-proof-system/
The Trail of Bits Blog
Reverie: An optimized zero-knowledge proof system
Zero-knowledge proofs, once a theoretical curiosity, have recently seen widespread deployment in blockchain systems such as Zcash and Monero. However, most blockchain applications of ZK proofs make proof size and performance tradeoffs that are a poor fit…
Page Fault Injection in Virtual Machines: Accessing Swapped-Out Pages from HVMI https://hvmi.github.io/blog/2020/12/14/pfinjection.html
emba: an analyzer for Linux-based firmware of embedded devices https://github.com/e-m-b-a/emba
GitHub
GitHub - e-m-b-a/emba: EMBA - The firmware security analyzer
EMBA - The firmware security analyzer. Contribute to e-m-b-a/emba development by creating an account on GitHub.
Root Cause Analysis of a Heap-Based Buffer Overflow in GNU Readline https://insinuator.net/2020/12/root-cause-analysis-of-a-heap-based-buffer-overflow-in-gnu-readline/
Machine learning adversarial attacks are a ticking time bomb https://bdtechtalks.com/2020/12/16/machine-learning-adversarial-attacks-against-machine-learning-time-bomb/
TechTalks
Machine learning adversarial attacks are a ticking time bomb
We are still learning how to cope with adversarial machine learning. Security researchers are used to perusing code for vulnerabilities. Now they must learn to find security holes in AI systems composed of millions of numerical parameters.
Jackalope [from Google] is a customizable, distributed, coverage-guided fuzzer that is able to work with black-box binaries https://github.com/googleprojectzero/Jackalope
GitHub
GitHub - googleprojectzero/Jackalope: Binary, coverage-guided fuzzer for Windows, macOS, Linux and Android
Binary, coverage-guided fuzzer for Windows, macOS, Linux and Android - googleprojectzero/Jackalope
RFID Proximity Cloning Attacks https://www.blackhillsinfosec.com/rfid-proximity-cloning-attacks/
Black Hills Information Security, Inc.
RFID Proximity Cloning Attacks - Black Hills Information Security, Inc.
Ray Felch // Introduction While packing up my KeyWe Smart Lock accessories, and after wrapping up my research and two previous blogs “Reverse Engineering a Smart Lock” and “Machine-in-the-Middle BLE […]
Lazarus Group Goes 'Fileless': an implant w/ remote download & in-memory execution https://objective-see.com/blog/blog_0x51.html
objective-see.org
Lazarus Group Goes 'Fileless'
an implant w/ remote download & in-memory execution
Good book from OWASP about TOCTOU vulnerabilities! » OWASP TimeGap Theory Handbook https://raw.githubusercontent.com/OWASP/TimeGap-Theory/master/OWASP%20TimeGap%20Theory%20Handbook.pdf
[Symbolic Execution 0x0] Solving easy CTFs with Angr and Symbolic Execution http://blog.k3170makan.com/2019/12/symbolic-execution-0x0-solving-easy.html
K3170Makan
[Symbolic Execution 0x0] Solving easy CTFs with Angr and Symbolic Execution
Hacking,Information Security,Penetration Testing,Google Hacking,Google Dorking,Keith Makan,Black Hat,Security Research,InfoSec,Web Site Security
Additional Analysis into the SUNBURST Backdoor https://www.mcafee.com/blogs/other-blogs/mcafee-labs/additional-analysis-into-the-sunburst-backdoor/
McAfee Blogs
McAfee Blogs
McAfee Blog
Additional Analysis into the SUNBURST Backdoor | McAfee Blog
Executive Summary There has been considerable focus on the recent disclosures associated with SolarWinds, and while existing analysis on the broader
Open-sourcing api-diff, a tool for side-by-side evaluations of JSON APIs https://radar.io/blog/open-source-api-diff-library
Radar Blog
Open-sourcing api-diff, a tool for side-by-side evaluations of JSON APIs
We’re open-sourcing our api-diff tool to help developers confidently iterate on their own search and ranking APIs.