Simple Spyware: Androids Invisible Foreground Services and How to (Ab)use Them
This simple to implement spyware shows that Androids permission model can't prevent an excessive use of permissions and that the limitations do not prevent the collection of the user's sensitive data. In order to prevent such attacks, it would be necessary to constantly monitor the apps permission usage or to revoke the permissions after every use. Such prevention mechanisms already exist but aren't widely used, which sets the users privacy and security at risk. We will show what users can do in order to guard themselves against such spyware attacks. Furthermore, we will introduce our solution ideas to detect such spyware on Android. By Thomas Sutter and Bernhard Tellenbach
https://youtu.be/EuInUW77CPo
This simple to implement spyware shows that Androids permission model can't prevent an excessive use of permissions and that the limitations do not prevent the collection of the user's sensitive data. In order to prevent such attacks, it would be necessary to constantly monitor the apps permission usage or to revoke the permissions after every use. Such prevention mechanisms already exist but aren't widely used, which sets the users privacy and security at risk. We will show what users can do in order to guard themselves against such spyware attacks. Furthermore, we will introduce our solution ideas to detect such spyware on Android. By Thomas Sutter and Bernhard Tellenbach
https://youtu.be/EuInUW77CPo
YouTube
Simple Spyware: Androids Invisible Foreground Services and How to (Ab)use Them
This simple to implement spyware shows that Androids permission model can't prevent an excessive use of permissions and that the limitations do not prevent the collection of the user's sensitive data. In order to prevent such attacks, it would be necessary…
Zyxel "zyfwp" Backdoor Account (Hardcoded Credential)
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
https://www.rapid7.com/db/vulnerabilities/zyxel-cve-2020-29583/
Firmware version 4.60 of Zyxel USG devices contains an undocumented account (zyfwp) with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges.
https://www.rapid7.com/db/vulnerabilities/zyxel-cve-2020-29583/
Rapid7
Zyxel "zyfwp" Backdoor Account (Hardcoded Credential)
Rapid7's VulnDB is curated repository of vetted computer software exploits and exploitable vulnerabilities.
Forwarded from @Phantasm_Lab
w0rk3r's Windows Hacking Library
https://news.1rj.ru/str/windowshackinglibrary
All about offensive tricks to test, improve and subvert windows security, and no, there are no books here.https://news.1rj.ru/str/windowshackinglibrary
Telegram
w0rk3r's Windows Hacking Library
Manual job, I'm not a bot ;)
@BlueTeamLibrary
@W0rk3r
@BlueTeamLibrary
@W0rk3r
Forwarded from w0rk3r's Windows Hacking Library (Jonhnathan Jonhnathan Jonhnathan)
AppDomainManager Injection and Detection
https://pentestlaboratories.com/2020/05/26/appdomainmanager-injection-and-detection
@WindowsHackingLibrary
https://pentestlaboratories.com/2020/05/26/appdomainmanager-injection-and-detection
@WindowsHackingLibrary
Pentest Laboratories
AppDomainManager Injection and Detection
Microsoft .NET framework is being heavily utilized by threat actors and red teams for defense evasion and staying off the radar during operations. Every .NET binary contains application domains whe…
Hacking the Oce Colorwave printer: when a quick security assessment determines the success of a Red Team exercise.
Back in September 2019, as Red Timmy Security group, we have been involved in a Red Team exercise. We had to simulate the scenario of a malicious insider plugging a Raspberry Pi device in to the network to potentially use as a C&C, and to check how much time the guys monitoring the environment would have spent to detect it. Furthermore, the place where to hide our device had to be tricky enough to spot, with the aim to pour a pinch of extra pepper on the challenge against the blue team.
https://www.redtimmy.com/tag/csrf/
Back in September 2019, as Red Timmy Security group, we have been involved in a Red Team exercise. We had to simulate the scenario of a malicious insider plugging a Raspberry Pi device in to the network to potentially use as a C&C, and to check how much time the guys monitoring the environment would have spent to detect it. Furthermore, the place where to hide our device had to be tricky enough to spot, with the aim to pour a pinch of extra pepper on the challenge against the blue team.
https://www.redtimmy.com/tag/csrf/
Red Timmy Security
CSRF Archives - Red Timmy Security
Forwarded from w0rk3r's Blue team Library (Jonhnathan Jonhnathan Jonhnathan)
Quickpost: Decrypting Cobalt Strike Traffic
https://blog.didierstevens.com/2021/04/26/quickpost-decrypting-cobalt-strike-traffic
@BlueTeamLibrary
https://blog.didierstevens.com/2021/04/26/quickpost-decrypting-cobalt-strike-traffic
@BlueTeamLibrary
Didier Stevens
Quickpost: Decrypting Cobalt Strike Traffic
I have been looking at several samples of Cobalt Strike beacons used in malware attacks. Although work is still ongoing, I already want to share my findings. Cobalt Strike beacons communicating ove…
Forwarded from DARKNET BR
This media is not supported in your browser
VIEW IN TELEGRAM
Forwarded from DARKNET BR
Digital-Exhaust-Opt-Out-Guide-for-Law-Enforcement.pdf
15.1 MB