Detect RC4 in (malicious) binaries https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries/
0xC0DECAFE.com
Learn to quickly detect RC4 encryption in (malicious) binaries - 0xC0DECAFE.com
This blog post discusses how to detect RC4 encryption with you bare eyes and how you can leverage additional tools like capa or yara for its detection.
CVE-2020-9967 - Apple macOS 6LowPAN Vulnerability https://alexplaskett.github.io/CVE-2020-9967/
Amit Merchant - Software Engineer
CVE-2020-9967 - Apple macOS 6LowPAN Vulnerability
Inspired by Kevin Backhouse’s great work on finding XNU remote vulnerabilities I decided to spend some time looking at CodeQL and performing some variant analysis. This lead to the discovery of a local root to kernel (although documented by Apple as remote)…
CVE-2020-35489: Unrestricted File Upload Vulnerability found in Contact Form 7 plugin affects 5M+ websites https://blog.wpsec.com/contact-form-7-vulnerability/
WPSec
CVE-2020-35489: Unrestricted File Upload Vulnerability found in Contact Form 7 plugin affects 5M+ websites - WPSec
A high-severity Unrestricted File Upload vulnerability, tracked as CVE-2020–35489, was discovered in a popular WordPress plugin called Contact Form 7, currently installed on 5 Million+ websites making them vulnerable to attacks like phishing, complete site…
iBackDoor: High-Risk Code Hits iOS Apps https://www.fireeye.fr/blog/threat-research/2015/11/ibackdoor_high-risk.html
FireEye
iBackDoor: High-Risk Code Hits iOS Apps
FireEye mobile researchers recently discovered potentially “backdoored” versions of an ad library embedded in thousands of iOS apps originally published in the Apple App Store.
SUNBURST Additional Technical Details https://www.fireeye.com/blog/threat-research/2020/12/sunburst-additional-technical-details.html
Google Cloud
Mandiant Cybersecurity Consulting
Transform cyber defense with Mandiant. Engage frontline experts for incident response, threat intelligence services, and cyber risk management.
Mobile Physical Memory Security https://corellium.com/blog/mobile-physical-memory-security
Corellium
Hardware Design Patterns for Better Physical Memory Security | Diagrams
Physical memory security is a key, but often overlooked, element of mobile hardware security. Recognizing design patterns greatly benefits mobile security researchers.
Although the decision was initially to close it, last news is Accenture Security will keep it alive! https://www.securityfocus.com/archive/1/542248 :) https://twitter.com/roman_soft/status/1350426455478566912?s=09
Twitter
☠ Román Medina-Heigl Hernández
Off since ~1y ago but now it's official: Bugtraq mailing list will be closed in 2 weeks :-((((( I'd like to express my gratitude for all these years of continuous service to the Security Community. Thank you Scott, "Aleph1", Ahmad, McKinney and rest of ppl…
Learn about iOS/macOS kernel analysis by doing » Vulnerable iOS/macOS Kext https://fuzzing.science/vulnerable-kext/
Hiding execution of unsigned code in system threads https://secret.club/2021/01/12/callout.html
secret club
Hiding execution of unsigned code in system threads
Anti-cheat development is, by nature, reactive; anti-cheats exist to respond to and thwart a videogame’s population of cheaters. For instance, a videogame with an exceedingly low amount of cheaters would have little need for an anti-cheat, while a videogame…
High-fidelity build instrumentation with blight https://blog.trailofbits.com/2020/11/25/high-fidelity-build-instrumentation-with-blight/
The Trail of Bits Blog
High-fidelity build instrumentation with blight
TL;DR: We’re open-sourcing a new framework, blight, for painlessly wrapping and instrumenting C and C++ build tools. We’re already using it on our research projects, and have included a set of useful actions. You can use it today for your own measurement…
The worst of the two worlds: Excel meets Outlook https://adepts.of0x.cc/vba-outlook/
The worst of the two worlds: Excel meets Outlook |
The worst of the two worlds: Excel meets Outlook | AdeptsOf0xCC
Turning Outlook into a keylogger via VBA macros
A CAN protocol decoder https://kentindell.github.io/2020/12/19/can2-decoder/
Ken Tindell’s blog
A CAN protocol decoder
We said in our previous blog post that “Our next goal is to create a GTKWave filter so that an arbitrary waveform can be decoded” and in an early Christmas present to those who are into the CAN protocol, we’ve done that! But we’ve done even better and we…
Disclosure of 8 0-day vulnerabilities in AVs https://halove23.blogspot.com/2020/12/oh-so-you-have-antivirus-nameevery-bug.html
We have published a new blog post introducing our last research, enjoy! » "Unrelocating Windows Modules (I)" https://reversea.me/index.php/unrelocating-windows-modules-i/
Analyzing Cobalt Strike for Fun and Profit https://www.randhome.io/blog/2020/12/20/analyzing-cobalt-strike-for-fun-and-profit/
A Complete Guide to LLVM for Programming Language Creators https://mukulrathi.co.uk/create-your-own-programming-language/llvm-ir-cpp-api-tutorial/
Mukulrathi
A Complete Guide to LLVM for Programming Language Creators
We'll explain the concepts underlying LLVM IR, and how you can use the LLVM C++ API in your programming language's compiler.
ESILSolve - A python symbolic execution framework using r2 and ESIL https://github.com/radareorg/esilsolve
GitHub
GitHub - radareorg/esilsolve: A python symbolic execution framework using radare2's ESIL (Evaluable String Intermediate Language)
A python symbolic execution framework using radare2's ESIL (Evaluable String Intermediate Language) - radareorg/esilsolve
Never upload ransomware samples to the Internet https://0xc0decafe.com/2020/12/28/never-upload-ransomware-samples-to-the-internet/
0xC0DECAFE.com
Never upload ransomware samples to the Internet - 0xC0DECAFE.com
This post explains what information a ransomware sample contains, why you should never upload ransomware samples to the Internet, and what actually happens if you upload them after all.
Introducing PcapMonkey: an easy way to analyze pcaps using Zeek, Suricata and Elasticsearch https://www.certego.net/en/news/introducing-pcapmonkey/
Certego
Introducing PcapMonkey
PcapMonkey is a project that will provide an easy way to analyze pcap using the latest version of Suricata and Zeek. It can also save...
Analysis of OpenSSL ChaCha20-Poly1305 Heap Buffer Overflow (CVE-2016-7054) https://www.fortinet.com/blog/threat-research/analysis-of-openssl-chacha20-poly1305-heap-buffer-overflow-cve-2016-7054
Fortinet Blog
Analysis of OpenSSL ChaCha20-Poly1305 Heap Buffer Overflow (CVE-2016-7054)
A High-Severity Heap Buffer Overflow vulnerability was recently fixed in a patch by Openssl Project. This vulnerability affects the remote SSL servers that support the ChaCha20-Poly1305 cipher su…