BlueHatIL 2019 Slides/Videos
http://bit.ly/2EdgEaG
Submitted February 16, 2019 at 08:07PM by campuscodi
via reddit http://bit.ly/2N7W1zw
http://bit.ly/2EdgEaG
Submitted February 16, 2019 at 08:07PM by campuscodi
via reddit http://bit.ly/2N7W1zw
reddit
r/netsec - BlueHatIL 2019 Slides/Videos
1 vote and 0 comments so far on Reddit
REST-ler: Automatic Intelligent REST API Fuzzing
http://bit.ly/2N8Wx0g
Submitted February 16, 2019 at 11:26PM by sudo-chmod-777
via reddit http://bit.ly/2GtRZkA
http://bit.ly/2N8Wx0g
Submitted February 16, 2019 at 11:26PM by sudo-chmod-777
via reddit http://bit.ly/2GtRZkA
Illegal streams, decrypting m3u8's, and building a better stream experience
http://bit.ly/2SXjw3N
Submitted February 17, 2019 at 07:32AM by JonLuca
via reddit http://bit.ly/2NhoWl3
http://bit.ly/2SXjw3N
Submitted February 17, 2019 at 07:32AM by JonLuca
via reddit http://bit.ly/2NhoWl3
JonLuca’s Blog
Illegal streams, decrypting m3u8’s, and building a better stream experience
Having not lived in the US for the majority of my life, I often needed to rely on illegal streams to watch America sports games. The experience on these streams is, to say the least, extremely poor. Most have some sort of crypto miner running in the background…
Latest Ursnif Trojan Campaign Highlights Need to Improve Anti-Phishing Defenses
http://bit.ly/2IwrOf9
Submitted February 17, 2019 at 11:51AM by kotmana456
via reddit http://bit.ly/2Gtpaol
http://bit.ly/2IwrOf9
Submitted February 17, 2019 at 11:51AM by kotmana456
via reddit http://bit.ly/2Gtpaol
SpamTitan
Latest Ursnif Trojan Campaign Highlights Need to Improve Anti-Phishing Defenses - SpamTitan
A new Ursnif Trojan campaign has been detected that uses a new variant of the malware which uses fileless techniques to avoid detection. In addition to the banking Trojan, GandCrab ransomware is also downloaded.
Tracking the trackers. Draw connections between noscripts and domains on website.
http://bit.ly/2GIMXA9
Submitted February 17, 2019 at 07:08PM by Mysterii8
via reddit http://bit.ly/2EdqklN
http://bit.ly/2GIMXA9
Submitted February 17, 2019 at 07:08PM by Mysterii8
via reddit http://bit.ly/2EdqklN
Medium
Tracking the trackers. Draw connections between noscripts and domains on website.
TL;DR
Build JA3 fingerprint mappings with Bro-Sysmon
https://sforce.co/2I82Imm
Submitted February 17, 2019 at 09:17PM by neslog
via reddit http://bit.ly/2BE132r
https://sforce.co/2I82Imm
Submitted February 17, 2019 at 09:17PM by neslog
via reddit http://bit.ly/2BE132r
Salesforce Engineering
How to Test Bro-Sysmon
How to stand up an environment to test Bro-Sysmon
Electrohunt Part 1: Hunting for the phishing campaigns on the Electrum network
http://bit.ly/2Ih2jhD
Submitted February 18, 2019 at 02:56AM by iphelix
via reddit http://bit.ly/2tpakqt
http://bit.ly/2Ih2jhD
Submitted February 18, 2019 at 02:56AM by iphelix
via reddit http://bit.ly/2tpakqt
The Coinbase Blog
Electrohunt Part 1: Hunting for the phishing campaigns on the Electrum network
Coinbase Blockchain Security Engineer, Peter Kacherginsky, tracks phishing campaigns on the Electrum network.
Blockchain Digital Identity Management | Empowering Individual Data Ownership
https://www.linkedin.com/feed/update/urn:li:activity:6502151319514636288
Submitted February 18, 2019 at 02:49PM by Anubhav-Singh
via reddit https://www.reddit.com/r/netsec/comments/arvfqg/blockchain_digital_identity_management_empowering/?utm_source=ifttt
https://www.linkedin.com/feed/update/urn:li:activity:6502151319514636288
Submitted February 18, 2019 at 02:49PM by Anubhav-Singh
via reddit https://www.reddit.com/r/netsec/comments/arvfqg/blockchain_digital_identity_management_empowering/?utm_source=ifttt
Linkedin
Blockchainoodles on LinkedIn: "Along with numerous other benefits, digital identity management with blockchain can enable us to…
February 15, 2019: Blockchainoodles posted an article on LinkedIn
CVE-2019-8372: Local Privilege Elevation in LG Device Manager. Tutorial on auditing kernel drivers and token stealing via arbitrary read/write primitives.
http://bit.ly/2SZbBD2
Submitted February 18, 2019 at 09:04PM by xVIoct
via reddit http://bit.ly/2Se3m1G
http://bit.ly/2SZbBD2
Submitted February 18, 2019 at 09:04PM by xVIoct
via reddit http://bit.ly/2Se3m1G
Phishing by Venezuelan government puts activists and internet users at risk, uses DNS injection
http://bit.ly/2GUdXwm
Submitted February 18, 2019 at 01:53AM by andresazp
via reddit http://bit.ly/2tsOBy0
http://bit.ly/2GUdXwm
Submitted February 18, 2019 at 01:53AM by andresazp
via reddit http://bit.ly/2tsOBy0
Vesinfiltro
Phishing by Venezuelan government puts activists at risk.
Report: voluntariosxvenezuela.com, a site to register humanitarian aid volunteers, has suffered a state-sponsored phishing campaign empowered by DNS injection.
Security vulnerabilities discovered in MiniUPnP
http://bit.ly/2BEZsta
Submitted February 18, 2019 at 09:25PM by ShinjuIoT
via reddit http://bit.ly/2V2PB7F
http://bit.ly/2BEZsta
Submitted February 18, 2019 at 09:25PM by ShinjuIoT
via reddit http://bit.ly/2V2PB7F
VDOO
Security Issues Discovered in MiniUPnP
VDOO research team found and responsibly disclosed vulnerabilities in MiniUPnP
Multiple attack vectors against GPS trackers - security and privacy issues
Interesting paper dealing with GPS trackers covering different attack scenariosabstract: Pierre Barre, Chaouki Kasmi, Eiman Al Shehhi (Submitted on 14 Feb 2019)Tracking expensive goods and/or targeted individuals with high-tech devices has been of high interest for the last 30 years. More recently, other use cases such as parents tracking their children have become popular. One primary functionality of these devices has been the collection of GPS coordinates of the location of the trackers, and to send these to remote servers through a cellular modem and a SIM card. Reviewing existing devices, it has been observed that beyond simple GPS trackers many devices intend to enclose additional features such as microphones, cameras, or Wi-Fi interfaces enabling advanced spying activities. In this study, we propose to describe the methodology applied to evaluate the security level of GPS trackers with different capabilities. Several security flaws have been discovered during our security assessment highlighting the need of a proper hardening of these devices when used in critical environments.
https://arxiv.org/abs/1902.05318
Submitted February 16, 2019 at 11:27PM by ernoego
via reddit http://bit.ly/2IktNCR
Interesting paper dealing with GPS trackers covering different attack scenariosabstract: Pierre Barre, Chaouki Kasmi, Eiman Al Shehhi (Submitted on 14 Feb 2019)Tracking expensive goods and/or targeted individuals with high-tech devices has been of high interest for the last 30 years. More recently, other use cases such as parents tracking their children have become popular. One primary functionality of these devices has been the collection of GPS coordinates of the location of the trackers, and to send these to remote servers through a cellular modem and a SIM card. Reviewing existing devices, it has been observed that beyond simple GPS trackers many devices intend to enclose additional features such as microphones, cameras, or Wi-Fi interfaces enabling advanced spying activities. In this study, we propose to describe the methodology applied to evaluate the security level of GPS trackers with different capabilities. Several security flaws have been discovered during our security assessment highlighting the need of a proper hardening of these devices when used in critical environments.
https://arxiv.org/abs/1902.05318
Submitted February 16, 2019 at 11:27PM by ernoego
via reddit http://bit.ly/2IktNCR
arXiv.org
Spy the little Spies - Security and Privacy issues of Smart GPS trackers
Tracking expensive goods and/or targeted individuals with high-tech devices has been of high interest for the last 30 years. More recently, other use cases such as parents tracking their children...
WireGuard for macOS
http://bit.ly/2X8lYDB
Submitted February 18, 2019 at 10:47PM by jackasstacular
via reddit http://bit.ly/2SSzr3t
http://bit.ly/2X8lYDB
Submitted February 18, 2019 at 10:47PM by jackasstacular
via reddit http://bit.ly/2SSzr3t
reddit
r/netsec - WireGuard for macOS
2 votes and 1 comment so far on Reddit
Azure AD Connect for Red Teamers
http://bit.ly/2Xa32Ex
Submitted February 18, 2019 at 11:33PM by 0xdea
via reddit http://bit.ly/2NbpQ2e
http://bit.ly/2Xa32Ex
Submitted February 18, 2019 at 11:33PM by 0xdea
via reddit http://bit.ly/2NbpQ2e
XPN InfoSec Blog
Azure AD Connect for Red Teamers
With clients increasingly relying on cloud services from Azure, one of the technologies that has been my radar for a while is Azure AD. For those who have not had the opportunity to work with this, the concept is simple, by extending authentication beyond…
ROP-ing on Aarch64
http://bit.ly/2NbyqOu
Submitted February 19, 2019 at 01:26AM by ret2got
via reddit http://bit.ly/2GU3y49
http://bit.ly/2NbyqOu
Submitted February 19, 2019 at 01:26AM by ret2got
via reddit http://bit.ly/2GU3y49
reddit
r/netsec - ROP-ing on Aarch64
4 votes and 0 comments so far on Reddit
pwnable.kr - fd , Understanding Linux File Denoscriptors and creating a simple exploit with python pwntools
http://bit.ly/2GN8S9e
Submitted February 19, 2019 at 04:26AM by Ahm3d_H3sham
via reddit http://bit.ly/2Ei9iTm
http://bit.ly/2GN8S9e
Submitted February 19, 2019 at 04:26AM by Ahm3d_H3sham
via reddit http://bit.ly/2Ei9iTm
0xRick Owned Root !
pwnable.kr - fd , Understanding Linux File Denoscriptors and creating a simple exploit with python pwntools
Introduction Hey guys , Lately I have been doing pwn challenges and I decided to share some stuff with you from time to time like I do with the other write-ups. Today we will solve fd from pwnable.kr , it’s a very easy one but as always we will go in detail.…
2.7M phone calls to Swedish medical advice service left on unauthenticated web server
http://bit.ly/2ttdSYR
Submitted February 19, 2019 at 10:41AM by midael
via reddit http://bit.ly/2IimlIu
http://bit.ly/2ttdSYR
Submitted February 19, 2019 at 10:41AM by midael
via reddit http://bit.ly/2IimlIu
How To Make The Best Out Of Security Conferences
http://bit.ly/2V6G4fP
Submitted February 19, 2019 at 05:45PM by mdpy
via reddit http://bit.ly/2ttlXNh
http://bit.ly/2V6G4fP
Submitted February 19, 2019 at 05:45PM by mdpy
via reddit http://bit.ly/2ttlXNh
eLearnSecurity Blog
How To Make The Most Out Of Security Conferences
The RSA Conference is just around the corner, and this year once again, we're glad to be sponsoring and attending this world-renowned security event. Attending security conferences can be a smart car
macOS: how to gain root with CVE-2018-4193 in < 10s
http://bit.ly/2Gy2KSY
Submitted February 19, 2019 at 07:08PM by mabote
via reddit http://bit.ly/2NeNgUv
http://bit.ly/2Gy2KSY
Submitted February 19, 2019 at 07:08PM by mabote
via reddit http://bit.ly/2NeNgUv
A look at how red teams and attackers craft an end to end spear-phishing campaign, from start to initial access.
http://bit.ly/2Ejwd0Q
Submitted February 19, 2019 at 07:44PM by exortius
via reddit http://bit.ly/2V6RGiV
http://bit.ly/2Ejwd0Q
Submitted February 19, 2019 at 07:44PM by exortius
via reddit http://bit.ly/2V6RGiV
Sublime Thoughts
Red Team Techniques: Gaining access on an external engagement through spear-phishing
There have been a lot of posts about crafting red team phishing campaigns, and most are incomplete. Today, we're going to walk through one of our recent external engagements from start to initial access.
Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!
http://bit.ly/2BJjgeL
Submitted February 19, 2019 at 08:27PM by albinowax
via reddit http://bit.ly/2TTTTxW
http://bit.ly/2BJjgeL
Submitted February 19, 2019 at 08:27PM by albinowax
via reddit http://bit.ly/2TTTTxW
Orange
Hacking Jenkins Part 2 - Abusing Meta Programming for Unauthenticated RCE!
This is 🍊 speaking