Sandbox detection and evasion techniques. How malware has evolved over the last 10 years https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/
ptsecurity.com
Sandbox detection and evasion techniques. How malware has evolved over the last 10 years
In most cases, hackers
The Story of Jian – How APT31 Stole and Used an Unknown Equation Group 0-Day https://research.checkpoint.com/2021/the-story-of-jian/
Check Point Research
The Story of Jian - How APT31 Stole and Used an Unknown Equation Group 0-Day - Check Point Research
Research by: Eyal Itkin and Itay Cohen There is a theory which states that if anyone will ever manage to steal and use nation-grade cyber tools, any network would become untrusted, and the world would become a very dangerous place to live in. There is another…
ImHex: A Hex Editor for Reverse Engineers, Programmers and people that value their eye sight when working at 3 AM https://github.com/WerWolv/ImHex
GitHub
GitHub - WerWolv/ImHex: 🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3…
🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM. - WerWolv/ImHex
SrClient DLL Hijacking: a Windows Server 2012 0-day that won't be patched https://blog.vonahi.io/srclient-dll-hijacking/
Vonahi Security's Blog
SrClient DLL Hijacking: a Windows Server 2012 0-day that won't be patched
This blog discusses a DLL hijacking vulnerability affecting all versions of Windows Server 2012 (but not Server 2012 R2). This 0-day vulnerability can be exploited for privilege escalation by any regular user and does not require a system reboot, yet it will…
Hancitor Infection Chain Analysis: An Examination of its Unpacking Routine and Execution Techniques https://threatresearch.ext.hp.com/hancitors-return-analyzing-its-latest-infection-chain/
HP Wolf Security
Hancitor Infection Chain Analysis: An Examination of its Unpacking Routine and Execution Techniques | HP Wolf Security
Don’t let cyber threats get the best of you. Read our post, Hancitor Infection Chain Analysis: An Examination of its Unpacking Routine and Execution Techniques, to learn more about cyber threats and cyber security.
Big kudos to @vxunderground, very nice content here! » https://twitter.com/vxunderground/status/1365904863603941377?s=09
Twitter
vx-underground
In case you missed it - we created a GitHub repo called "WinAPI Tricks". We've added a little bit of content to it. *All content is in C *Attached image lists current examples *A LOT more to come Check it out here: https://t.co/Xb2Y4ojjSq
Some anti-debug and anti-memory dump for Android OS https://github.com/darvincisec/AntiDebugandMemoryDump
GitHub
GitHub - darvincisec/AntiDebugandMemoryDump: Anti-Debug and Anti-Memory Dump for Android
Anti-Debug and Anti-Memory Dump for Android. Contribute to darvincisec/AntiDebugandMemoryDump development by creating an account on GitHub.
CheckPoint cybersec report 2021, good details on critical vulnerabilities exploited in 2020 https://www.checkpoint.com/downloads/resources/cyber-security-report-2021.pdf
CVE-2020-8625: A Fifteen-Year-Old RCE Bug Returns in ISC BIND Server https://www.zerodayinitiative.com/blog/2021/2/24/cve-2020-8625-a-fifteen-year-old-rce-bug-returns-in-isc-bind-server
Zero Day Initiative
Zero Day Initiative — CVE-2020-8625: A Fifteen-Year-Old RCE Bug Returns in ISC BIND Server
The Patch The patched versions are BIND 9.16.12 and BIND 9.11.28. To fix BIND 9.16, ISC fixed the buffer allocation size at (1). In BIND 9.11, they applied the patch as well. Conclusion This bug shows how vulnerabilities can reside undetected for years…
Nice chart about the connections between cybercrime groups » https://www.zdnet.com/article/this-chart-shows-the-connections-between-cybercrime-groups/
ZDNET
This chart shows the connections between cybercrime groups
CrowdStrike puts together a list of connections and how cybercrime groups cooperate with each other.
1Password has none, KeePass has none... So why are there seven embedded trackers in the LastPass Android app? https://www.theregister.com/2021/02/25/lastpass_android_trackers_found/
The Register
1Password has none, KeePass has none... So why are there seven embedded trackers in the LastPass Android app?
Third-party code in security-critical apps is obviously suboptimal, but company says you can opt out
Network Graph Analysis for Suricata and Zeek using Brim and NetworkX https://medium.com/brim-securitys-knowledge-funnel/visualizing-network-cyber-attacks-with-suricata-and-zeek-using-brim-and-networkx-332dd265d4b6
Medium
Visualizing Network Cyber Attacks with Suricata and Zeek using Brim and NetworkX
Gaining meaningful Insights out of Security Data
VMware vCenter Server CVE-2021-21972 Remote Code Execution Vulnerability checker https://github.com/alt3kx/CVE-2021-21972
GitHub
GitHub - alt3kx/CVE-2021-21972
Contribute to alt3kx/CVE-2021-21972 development by creating an account on GitHub.
An Exploration of JSON Interoperability Vulnerabilities https://labs.bishopfox.com/tech-blog/an-exploration-of-json-interoperability-vulnerabilities
Bishop Fox
An Exploration & Remediation of JSON Interoperability Vulnerabilities
Learn more about how the same JSON document can be parsed with different values across microservices, leading to a variety of potential security risks.
Nice discussion on the need of changing CVSS, as it does not reflect appropriately the risks to a vulnerable system » "Time to Change the CVSS?" https://ieeexplore.ieee.org/abstract/document/9382369
ieeexplore.ieee.org
Time to Change the CVSS?
According to its creators, the Common Vulnerability Scoring System (CVSS) "provides a way to capture the principal characteristics of a vulnerability ... reflecting its severity ... to help organizations properly assess and prioritize their vulnerability…
POCs for Shellcode Injection via Callbacks https://github.com/ChaitanyaHaritash/Callback_Shellcode_Injection
GitHub
GitHub - ChaitanyaHaritash/Callback_Shellcode_Injection: POCs for Shellcode Injection via Callbacks
POCs for Shellcode Injection via Callbacks. Contribute to ChaitanyaHaritash/Callback_Shellcode_Injection development by creating an account on GitHub.
It's always important to refresh our knowledge » A brief introduction to PE format https://medium.com/ax1al/a-brief-introduction-to-pe-format-6052914cc8dd
Medium
A brief introduction to PE format
good idea » A Journey Combining Web Hacking and Binary Exploitation in Real World! https://blog.orange.tw/2021/02/a-journey-combining-web-and-binary-exploitation.html
Orange Tsai
A Journey Combining Web Hacking and Binary Exploitation in Real World!
Hi, this blog post is just a short post to address the technique part in one of my Red Team cases last year. I believe it’s worth sharing, so I reproduced this in my lab environment and made this topi