Sandbox awareness via user behaviour
http://ift.tt/2HVDkv5
Submitted March 23, 2018 at 02:06AM by nervium7331
via reddit http://ift.tt/2DNdl6w
http://ift.tt/2HVDkv5
Submitted March 23, 2018 at 02:06AM by nervium7331
via reddit http://ift.tt/2DNdl6w
GitLab
prisma / Sandbox awareness via user behaviour
A technique to evade sandboxes by identifying real user behavior in a short and reliable way.
What subreddit would be interested in this suspicious disc someone gave me with possibly unknown malware in the image files and maybe some other documents? Is there a malware research section somewhere? Thanks for any input.
The disc contains a bunch of weird conspiracy stuff on it and I presume it is just bait to get the users to run the malware laden files. I haven't done any looking into how the malware works or is installed, but I assume it to be so because of how Windows 10 reacts to opening some of the files. Explorer.exe and the photo viewer app crashing with strange errors and such. The way the guy was talking sounded half like he wanted me to look at the files on a throwaway machine, half that the information needed to get out to the public, but it was suspicious because it was supposed to contain some "revealing" stuff about the US govt.The strange effects do not occur with every app used to open the files, just some of the defaults in Windows 10. I tried it with XP and nothing happens unlike in W10. I doubt anything would be as highly damaging as Conficker, Stuxnet, Duqu 2.0, or Flame, but there is no telling. The guy hinted at court cases.EDIT: I think its nearly 200MB in total.
Submitted March 23, 2018 at 03:42AM by PseudoSecuritay
via reddit http://ift.tt/2DLQad5
The disc contains a bunch of weird conspiracy stuff on it and I presume it is just bait to get the users to run the malware laden files. I haven't done any looking into how the malware works or is installed, but I assume it to be so because of how Windows 10 reacts to opening some of the files. Explorer.exe and the photo viewer app crashing with strange errors and such. The way the guy was talking sounded half like he wanted me to look at the files on a throwaway machine, half that the information needed to get out to the public, but it was suspicious because it was supposed to contain some "revealing" stuff about the US govt.The strange effects do not occur with every app used to open the files, just some of the defaults in Windows 10. I tried it with XP and nothing happens unlike in W10. I doubt anything would be as highly damaging as Conficker, Stuxnet, Duqu 2.0, or Flame, but there is no telling. The guy hinted at court cases.EDIT: I think its nearly 200MB in total.
Submitted March 23, 2018 at 03:42AM by PseudoSecuritay
via reddit http://ift.tt/2DLQad5
reddit
What subreddit would be interested in this suspicious... • r/security
The disc contains a bunch of weird conspiracy stuff on it and I presume it is just bait to get the users to run the malware laden files. I...
Passwords worst authentication method?
I'm a Cyber Security Student, currently writing up an assignment for college.One of my modules is user access and authentication methods. I have detailed passwords, bio-metrics, email/sms one time passwords, and peripheral device recognition.As i was writing it up i got thinking that out of all of these authentication methods passwords surely is the least secure.What do you think?Dan
Submitted March 23, 2018 at 04:58AM by Danjdunham_
via reddit http://ift.tt/2FYws3C
I'm a Cyber Security Student, currently writing up an assignment for college.One of my modules is user access and authentication methods. I have detailed passwords, bio-metrics, email/sms one time passwords, and peripheral device recognition.As i was writing it up i got thinking that out of all of these authentication methods passwords surely is the least secure.What do you think?Dan
Submitted March 23, 2018 at 04:58AM by Danjdunham_
via reddit http://ift.tt/2FYws3C
reddit
Passwords worst authentication method? • r/security
I'm a Cyber Security Student, currently writing up an assignment for college. One of my modules is user access and authentication methods. I...
Week 12 in Information Security, 2018
http://ift.tt/2ueiRzF
Submitted March 23, 2018 at 12:22PM by undercomm
via reddit http://ift.tt/2pxUEzL
http://ift.tt/2ueiRzF
Submitted March 23, 2018 at 12:22PM by undercomm
via reddit http://ift.tt/2pxUEzL
Malgregator
InfoSec Week 12, 2018
Facebook, Google, Cisco, WhatsApp and other industry partners get together to create Message Layer Security as an open standard for...
Intel chipsets also vulnerable to recent CTS-Labs disclosed attack
TL;DR:The client works on AMD Ryzen machines but it also works on any machine that has these ASMedia chipsets and so quite a few motherboards and other PCs are affected by these vulnerabilities as well. If you search online for motherboard drivers, such as the ASUS website, and download ASMedia drivers for your motherboard, then those motherboards are likely vulnerable to the same issues as you would find on the AMD chipset.Excerpt from interview, fulltext here
Submitted March 23, 2018 at 11:29AM by DarkWorld25
via reddit http://ift.tt/2pyJ46p
TL;DR:The client works on AMD Ryzen machines but it also works on any machine that has these ASMedia chipsets and so quite a few motherboards and other PCs are affected by these vulnerabilities as well. If you search online for motherboard drivers, such as the ASUS website, and download ASMedia drivers for your motherboard, then those motherboards are likely vulnerable to the same issues as you would find on the AMD chipset.Excerpt from interview, fulltext here
Submitted March 23, 2018 at 11:29AM by DarkWorld25
via reddit http://ift.tt/2pyJ46p
AnandTech
Our Interesting Call with CTS-Labs
In light of the recent announcement of potential vulnerabilities in Ryzen processors, two stories have emerged. Firstly, that AMD processors could have secondary vulnerabilities in the secure processor and ASMedia chipsets. The second story is behind the…
Drupal 7 and 8 core highly critical release on March 28th, 2018 PSA-2018-001
http://ift.tt/2DHBXOh
Submitted March 23, 2018 at 01:31PM by al-maisan
via reddit http://ift.tt/2pAx0m0
http://ift.tt/2DHBXOh
Submitted March 23, 2018 at 01:31PM by al-maisan
via reddit http://ift.tt/2pAx0m0
Drupal.org
Drupal 7 and 8 core highly critical release on March 28th, 2018 PSA-2018-001
Advisory ID: DRUPAL-PSA-2018-001 Project: Drupal Core Version: 7.x, 8.x Date: 2018-March-21
Bug in Ethereum
http://ift.tt/2puButL
Submitted March 23, 2018 at 11:54AM by Oxf0xtr0t
via reddit http://ift.tt/2GkrGNv
http://ift.tt/2puButL
Submitted March 23, 2018 at 11:54AM by Oxf0xtr0t
via reddit http://ift.tt/2GkrGNv
www.vicompany.nl
From Christmas present in the blockchain to massive bug bounty
Last year we discussed our Christmas present and how we created and distributed it. However, there was one more thing we were working on that we were not allowed to talk about yet until now. It was a system flaw we found for an online crypto currency exchange…
APT2 - An Automated Penetration Testing Toolkit [Updated with Full Sources]
http://ift.tt/29JK4Q0
Submitted March 23, 2018 at 10:12AM by TechLord2
via reddit http://ift.tt/2G0aJYY
http://ift.tt/29JK4Q0
Submitted March 23, 2018 at 10:12AM by TechLord2
via reddit http://ift.tt/2G0aJYY
GitHub
MooseDojo/apt2
apt2 - automated penetration toolkit
CLOUDKiLL3R - Bypasses Cloudflare protection service via TOR Browser
http://ift.tt/2DO3Zrh
Submitted March 23, 2018 at 10:05AM by TechLord2
via reddit http://ift.tt/2GcSMWJ
http://ift.tt/2DO3Zrh
Submitted March 23, 2018 at 10:05AM by TechLord2
via reddit http://ift.tt/2GcSMWJ
GitHub
inurlx/CLOUDKiLL3R
CLOUDKiLL3R bypasses Cloudflare protection service via TOR Browser !
Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction
http://ift.tt/2nT34Rf
Submitted March 23, 2018 at 09:47AM by TechLord2
via reddit http://ift.tt/2pyB9Gd
http://ift.tt/2nT34Rf
Submitted March 23, 2018 at 09:47AM by TechLord2
via reddit http://ift.tt/2pyB9Gd
bohops
Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction
[Source: blog.microsoft.com] What is Vshadow? Vshadow (vshadow.exe) is a command line utility for managing volume shadow copies. This tool is included within the Windows SDK and is signed by Micro…
Deep dive on the most severe Kubernetes vulnerabilities to date - CVE-2017-1002101 and CVE-2017-1002102
http://ift.tt/2IJnqoZ
Submitted March 23, 2018 at 02:27PM by Caleb666
via reddit http://ift.tt/2pyFmKW
http://ift.tt/2IJnqoZ
Submitted March 23, 2018 at 02:27PM by Caleb666
via reddit http://ift.tt/2pyFmKW
Twistlock
Deep dive on the most severe Kubernetes vulnerabilities to date - CVE-2017-1002101 and CVE-2017-1002102 | Twistlock
Deep dive on the most severe Kubernetes vulnerabilities to date - CVE-2017-1002101 and CVE-2017-1002102 from Twistlock. Dev-to-Production Docker and container security for enterprises.
Tracking ransomware end-to-end
http://ift.tt/2G1Deli
Submitted March 23, 2018 at 02:13PM by al-maisan
via reddit http://ift.tt/2pA0AXV
http://ift.tt/2G1Deli
Submitted March 23, 2018 at 02:13PM by al-maisan
via reddit http://ift.tt/2pA0AXV
the morning paper
Tracking ransomware end-to-end
Tracking ransomware end-to-end Huang et al., IEEE Security & Privacy 2018 With thanks to Elie Bursztein for bringing this paper to my attention. You get two for the price of one with today’s pa…
We need to talk about IDS signatures
http://ift.tt/2pmpWcu
Submitted March 23, 2018 at 05:09PM by alexlash
via reddit http://ift.tt/2G3zRdq
http://ift.tt/2pmpWcu
Submitted March 23, 2018 at 05:09PM by alexlash
via reddit http://ift.tt/2G3zRdq
Ptsecurity
We need to talk about IDS signatures
The names Snort and Suricata are known to all who work in the field of network security. WAF and IDS are two classes of security systems...
Trustico Statement In Regard to DigiCert Revocation
http://ift.tt/2udXNt7
Submitted March 23, 2018 at 05:39PM by stugster
via reddit http://ift.tt/2pzcHpe
http://ift.tt/2udXNt7
Submitted March 23, 2018 at 05:39PM by stugster
via reddit http://ift.tt/2pzcHpe
Security In 5: Episode 201 - Tools, Tips and Tricks - MXToolbox.com
http://ift.tt/2HXMOWS
Submitted March 23, 2018 at 06:34PM by BinaryBlog
via reddit http://ift.tt/2pypnfP
http://ift.tt/2HXMOWS
Submitted March 23, 2018 at 06:34PM by BinaryBlog
via reddit http://ift.tt/2pypnfP
Libsyn
Security In Five Podcast: Episode 201 - Tools, Tips and Tricks - MXToolbox.com
This week's Tools, Tips and Tricks talks about MXToolbox.com. A collection of network, email and web testing/monitoring tools. If you run a website or manage an infrastructure there are tools in the MXToolbox that you will find useful. MXToolbox.com Be…
Top Five Ways the Red Team breached the External Perimeter
http://ift.tt/2pBRVoT
Submitted March 23, 2018 at 08:15PM by wootock
via reddit http://ift.tt/2pz9Bl4
http://ift.tt/2pBRVoT
Submitted March 23, 2018 at 08:15PM by wootock
via reddit http://ift.tt/2pz9Bl4
Medium
Top Five Ways the Red Team breached the External Perimeter
I have been performing “red team” breach assessments for many years. Often the goal is penetrating an external network, and gaining access…
Why do banking websites insist on continuing these insecure password requirements? Screenshot taken from Merrill Lynch
https://ift.tt/2G5T6TH
Submitted March 23, 2018 at 10:32PM by peepeeopi
via reddit https://ift.tt/2DPU6JL
https://ift.tt/2G5T6TH
Submitted March 23, 2018 at 10:32PM by peepeeopi
via reddit https://ift.tt/2DPU6JL
What all web application security testing cases can be completed just by using browsers
https://ift.tt/2ILab7i
Submitted March 23, 2018 at 10:37PM by assliekthat
via reddit https://ift.tt/2G6mbyz
https://ift.tt/2ILab7i
Submitted March 23, 2018 at 10:37PM by assliekthat
via reddit https://ift.tt/2G6mbyz
Getmantra
Web app security testing with browsers
A guide on using browser dev-tools for performing web app pentesting
KSMA: Breaking Android kernel isolation and Rooting with ARM MMU features [Blackhat Asia 2018]
https://ift.tt/2GlDoqQ
Submitted March 23, 2018 at 11:41PM by TechLord2
via reddit https://ift.tt/2pDPDVg
https://ift.tt/2GlDoqQ
Submitted March 23, 2018 at 11:41PM by TechLord2
via reddit https://ift.tt/2pDPDVg
return-to-csu: A New Method to Bypass 64-bit Linux ASLR [Paper - Blackhat Asia 2018]
https://ift.tt/2Gm0YE6
Submitted March 23, 2018 at 11:34PM by TechLord2
via reddit https://ift.tt/2G4eKI4
https://ift.tt/2Gm0YE6
Submitted March 23, 2018 at 11:34PM by TechLord2
via reddit https://ift.tt/2G4eKI4
SSRF - Exploiting URL Parser in Trending Programming Languages [Blackhat Asia 2018 Presentation]
https://ift.tt/2GfEkgu
Submitted March 23, 2018 at 11:30PM by TechLord2
via reddit https://ift.tt/2pzoZgs
https://ift.tt/2GfEkgu
Submitted March 23, 2018 at 11:30PM by TechLord2
via reddit https://ift.tt/2pzoZgs