#DFIR: First steps with Volatility

https://unminioncurioso.blogspot.com/2019/03/dfir-first-steps-with-volatility.html

Multiple Vulnerabilities in Android’s Download Provider (CVE-2018-9468, CVE-2018-9493, CVE-2018-9546)

Android’s Download Provider is a component of the Android framework and is designed to handle external downloads for other applications, such as web browsers (including Google Chrome), email clients (including Gmail), and the Google Play Store, among many others.

https://ioactive.com/multiple-vulnerabilities-in-androids-download-provider-cve-2018-9468-cve-2018-9493-cve-2018-9546/

Shiina permite esconder un ejecutable en una imagen y luego convertirlo de vuelta en ejecutable interesante para usarlo en un downloader y ocultar el payload de soluciones de seguridad.

https://github.com/Fmk0/scripts

Vía @dragonjar

Hackeados miles de routers D-Link para comprometer sus DNS

https://hipertextual.com/2019/04/routers-dns-dlink

Part 1 : A Journey into the UEFI Land : https://erfur.github.io/down_the_rabbit_hole_pt1/

Part 2 : Analyzing an EFI Application with Radare2 : https://erfur.github.io/down_the_rabbit_hole_pt2/

Down the Rabbit Hole (Part 3) : Patching the Whitelist : https://erfur.github.io/down_the_rabbit_hole_pt3/

PowerShellArsenal

A PowerShell Module Dedicated To Reverse Engineering
https://www.kitploit.com/2019/04/powershellarsenal-powershell-module.html

Elevación de privilegios en Módulo Fibre Channel de 16 Gb HPE Virtual Connect SE para Synergy

Fecha de publicación: 08/04/2019
Importancia: 5 - Crítica

Recursos afectados: 
Módulo Fibre Channel de 16 Gb HPE Virtual Connect SE para Synergy con firmware 5.00.50

Descripción: 
Una vulnerabilidad en el módulo Fibre Channel de 16 Gb HPE Virtual Connect SE para Synergy podría permitir la elevación no autorizada de privilegios local o remota.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/elevacion-privilegios-modulo-fibre-channel-16-gb-hpe-virtual

Múltiples vulnerabilidades en productos de IBM

Fecha de publicación: 08/04/2019
Importancia: 5 - Crítica

Recursos afectados: 
IBM QRadar SIEM 7.3.2 GA - 7.3.2 GA Interim Fix 1
IBM API Connect versión 2018.1-2018.4.1.3

Descripción: 
IBM ha publicado dos vulnerabilidades en dos de sus productos. La explotación exitosa de alguna de ellas podría permitir una evasión de la autenticación o un escalado de privilegios.

https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-productos-ibm-5

MUS CTF DFIR – MOBILE (Nivel 1)

https://www.securityartwork.es/2019/04/08/mus-ctf-dfir-mobile-nivel-1/

Un Exploit que permite escapar del Sandbox de safari con una sola línea de código

https://www.seguridadapple.com/2019/04/un-exploit-que-permite-escapar-del.html

Samba Releases Security Updates

The Samba Team has released security updates to address vulnerabilities in Samba. An attacker could exploit some of these vulnerabilities to take control of an affected system.

https://www.us-cert.gov/ncas/current-activity/2019/04/08/Samba-Releases-Security-Updates

Red Hat Security Advisory

Synopsis: Important: python security update
Advisory ID: RHSA-2019:0710-01
Product: Red Hat Enterprise Linux
Advisory URL:
https://access.redhat.com/errata/RHSA-2019:0710

Issue date: 2019-04-08
CVE Names: CVE-2019-9636

Security researchers discover iOS version of Exodus Android spyware

Exodus iOS spyware used against Italian and Turkmenistan users.

https://www.zdnet.com/article/security-researchers-discover-ios-version-of-exodus-android-spyware/

"Adobe Releases Security Patches for Flash, Acrobat Reader, Other Products"

https://thehackernews.com/2019/04/adobe-security-updates.html

Microsoft Releases April 2019 Security Updates — Two Flaws Under Active Attack

https://thehackernews.com/2019/04/microsoft-patch-updates.html

RSAC 2019: Why attackers need domain fronting

https://www.kaspersky.com/blog/domain-fronting-rsa2019/26352/

Cyber Attack Shuts Down Hoya Corp's Thailand Plant for Three Days

https://www.bleepingcomputer.com/news/security/cyber-attack-shuts-down-hoya-corps-thailand-plant-for-three-days/

Mailman: Multiple vulnerabilities — GLSA201904-10

Multiple vulnerabilities have been found in Mailman, the worst of which could result in the arbitrary execution of code.

https://security.gentoo.org/glsa/201904-10

Samba CVE-2019-3870 Local Insecure File Permissions Vulnerability

https://www.securityfocus.com/bid/107798/info

Verizon Patches Trio of Vulnerabilities in Home Router

https://www.darkreading.com/vulnerabilities---threats/verizon-patches-trio-of-vulnerabilities-in-home-router/d/d-id/1334385

The Death Metal Suite

[...]Death Metal is a toolkit designed to exploit AMT’s legitimate features[...]

[...]
Advice for the Blue Team
The best advice I have at reducing the risks inherent to AMT is to buy systems without it enabled. If that is not possible, provision your systems before someone malicious does, change the password, and disable everything you can.[...]

https://www.coalfire.com/The-Coalfire-Blog/April-2019/The-Death-Metal-Suite