Persistence, lateral movement

VED - Linux kernel threat detection and prevention system LKM version of VED goes public finally.

Thanks to Brad Duncan for sharing this pcap! https://www.malware-traffic-analysis.net/2022/04/19/index2.html We did a quick analysis of this...

In this post I’ll exploit CVE-2022-22057, a use-after-free in the Qualcomm gpu kernel driver, to gain root and disable SELinux from the untrusted app sandbox on a Samsung Z flip 3. I’ll look at various mitigations that are implemented on modern Android devices…

In April of this year, FreeBSD patched a 13-year-old heap overflow in the Wi-Fi stack that could allow network-adjacent attackers to execute arbitrary code on affected installations of FreeBSD Kernel. This bug was originally reported to the ZDI program by…

On January 11, 2022, we published a blog post describing the details of CVE-2022-21893, a Remote Desktop vulnerability that we found and reported to Microsoft. After analyzing the patch that fixed...

In early February 2022, we came across a tweet from ShadowChasing1 identifying a SideWinder-related word document which referenced a template URL. In this article, we share our insights from…

The attack comprises of performing command injection vulnerability in Lambda Functions in order to steal the AWS keys and access AWS resources as the stolen keys of the IAM role.

Technical analysis of the Matanbuchus malware with focus on network traffic and commands

Thanks to Brad Duncan for sharing this pcap! https://www.malware-traffic-analysis.net/2022/06/16/index.html We did a quick analysis of this ...

The mobile banking malware BRATA keeps evolving into an APT. Read here the new Technical Report, which explains in detail how it monitors banks' account and how to prevent it.

Getting your foot in the door or finding your next gig in cyber security is sometimes a daunting task. Just like hacking, a methodology is needed to succeed. Here's how I see the core components (this methodology will evolve over time): Aquire Skillsets /…

Integrates logging with a custom application testing checklist.

A self-hosted scheduler app that will upgrade or downgrade your EC2 servers for you. - GitHub - ajaidanial/gipsy_avenger: A self-hosted scheduler app that will upgrade or downgrade your EC2 servers...

Cloud Engineer | Hobbyist Hacker. RoseSecurity has 17 repositories available. Follow their code on GitHub.

Posted by Mr-R3b00t - 7 votes and 4 comments

Introduction Rootkits are dangerous pieces of malware. Once in place, they are usually really hard to detect. Their code is typically more challenging to write than other malware, so developers resort to code reuse from open source projects. As rootkits are…