Forwarded from reconcore
Tor_Pentest_Report.pdf
1.2 MB
Tor Project Pentest - Code audit and network health report 2025.
#netsec #appsec #analytics #offensivesecurity @reconcore
This document outlines the results of a pentest and whitebox security review conducted against a number of Tor Project items. Test Targets: Network Metrics, Visualization Stack, Relay & Network Health Tools, Exit Relay Scanning, Bandwidth Measurement, Tor Core Code Changes
#netsec #appsec #analytics #offensivesecurity @reconcore
❤3
earlyremoval, in the Conservatory, with the Wrench: Exploring Ghidra’s decompiler internals to make automatic P-Code analysis noscripts
https://www.nccgroup.com/research-blog/earlyremoval-in-the-conservatory-with-the-wrench-exploring-ghidra-s-decompiler-internals-to-make-automatic-p-code-analysis-noscripts/
https://www.nccgroup.com/research-blog/earlyremoval-in-the-conservatory-with-the-wrench-exploring-ghidra-s-decompiler-internals-to-make-automatic-p-code-analysis-noscripts/
Ghidriff - Ghidra Binary Diffing Engine
https://i.blackhat.com/SecTor-2023/Presentations/Sector-23-McIntosh-GhidriffGhidraBinaryDiffingEngine-compressed.pdf
https://i.blackhat.com/SecTor-2023/Presentations/Sector-23-McIntosh-GhidriffGhidraBinaryDiffingEngine-compressed.pdf
Forwarded from H
Hi
This is Hosien , currently i'm investigating a malware campaign targeting Iranian spoken users , exploiting winrar (likely cve-2025-6218 or cve-2025-8088) . the code they used are advanced and i think we face APT or skillful cyber-criminals .
i'm asking you to share this message so we can find out how this Threat Actor spread it's malware above images show .rar file & opened decoy .doc file
This is Hosien , currently i'm investigating a malware campaign targeting Iranian spoken users , exploiting winrar (likely cve-2025-6218 or cve-2025-8088) . the code they used are advanced and i think we face APT or skillful cyber-criminals .
i'm asking you to share this message so we can find out how this Threat Actor spread it's malware above images show .rar file & opened decoy .doc file
🔥2
Source Byte
Hi This is Hosien , currently i'm investigating a malware campaign targeting Iranian spoken users , exploiting winrar (likely cve-2025-6218 or cve-2025-8088) . the code they used are advanced and i think we face APT or skillful cyber-criminals . i'm asking…
share here if you find something (any phishing emails , telegram post ....) :
https://news.1rj.ru/str/+SdT344H5Yec2YTRk
https://news.1rj.ru/str/+SdT344H5Yec2YTRk
2022 0-day In-the-Wild Exploitation…so far
As of June 15, 2022, there have been 18 0-days detected and disclosed as exploited in-the-wild in 2022. When we analyzed those 0-days, we found that at least nine of the 0-days are variants of previously patched vulnerabilities. At least half of the 0-days we’ve seen in the first six months of 2022 could have been prevented with more comprehensive patching and regression tests. On top of that, four of the 2022 0-days are variants of 2021 in-the-wild 0-days. Just 12 months from the original in-the-wild 0-day being patched, attackers came back with a variant of the original bug.
https://projectzero.google/2022/06/2022-0-day-in-wild-exploitationso-far.html
As of June 15, 2022, there have been 18 0-days detected and disclosed as exploited in-the-wild in 2022. When we analyzed those 0-days, we found that at least nine of the 0-days are variants of previously patched vulnerabilities. At least half of the 0-days we’ve seen in the first six months of 2022 could have been prevented with more comprehensive patching and regression tests. On top of that, four of the 2022 0-days are variants of 2021 in-the-wild 0-days. Just 12 months from the original in-the-wild 0-day being patched, attackers came back with a variant of the original bug.
https://projectzero.google/2022/06/2022-0-day-in-wild-exploitationso-far.html
❤4
Playing with the Tigress software protection. Break some of its protections and solve their reverse engineering challenges. Automatic deobfuscation using symbolic execution, taint analysis and LLVM.
https://tigress.cs.arizona.edu/challenges.html
https://tigress.cs.arizona.edu/challenges.html
❤3
Source Byte
Playing with the Tigress software protection. Break some of its protections and solve their reverse engineering challenges. Automatic deobfuscation using symbolic execution, taint analysis and LLVM. https://tigress.cs.arizona.edu/challenges.html
www.cs.cornell.edu
Flattening ASTs (and Other Compiler Data Structures)
This is an introduction to data structure flattening, a special case of arena allocation that is a good fit for programming language implementations. We build a simple interpreter twice, the normal way and the flat way, and show that some fairly mechanical…
❤4
Backdoor code found in Trust Wallet browser extension, causing theft of tens of millions of dollars in assets
A new backdoor code was added to version 2.68 of the Trust Wallet cryptocurrency wallet's browser extension, which sends users' mnemonic phrases to attacker servers. Due to the automatic update mechanism, the impact was widespread. On Christmas Day, December 25th, attackers began transferring funds, and according to current estimates, more than tens of millions of dollars in assets have been stolen. The latest version 2.69 has now removed the backdoor code.
😁4🔥1