TrickBot Bolsters Layered Defenses to Prevent Injection Research
PoC
https://securityintelligence.com/posts/trickbot-bolsters-layered-defenses-prevent-injection/
PoC
https://securityintelligence.com/posts/trickbot-bolsters-layered-defenses-prevent-injection/
Security Intelligence
TrickBot Bolsters Layered Defenses to Prevent Injection Research
The cyber crime gang that operates the TrickBot Trojan has been escalating activity. See how it operates in 'beautified' code.
Sys-Admin InfoSec
Oracle Critical Patch Update Pre-Release Announcement - January 2022 https://www.oracle.com/security-alerts/cpujan2022.html ~ Safari 15 IndexedDB Leaks What is this vulnerability and who is affected? You can test this demo on all affected browsers: Safari…
Apple released Safari patch:
https://support.apple.com/en-us/HT213058
https://support.apple.com/en-us/HT213058
Apple Support
About the security content of Safari 15.3
This document describes the security content of Safari 15.3.
CVE-2022-0185 – What does the newest kernel exploit mean for Kubernetes users and how to detect it?
https://www.armosec.io/blog/cve-2022-0185-kubernetes-users/
Exploit
This repo contains demo exploits for CVE-2022-0185
https://github.com/Crusaders-of-Rust/CVE-2022-0185
https://www.armosec.io/blog/cve-2022-0185-kubernetes-users/
Exploit
This repo contains demo exploits for CVE-2022-0185
https://github.com/Crusaders-of-Rust/CVE-2022-0185
ARMO
What the newest kernel exploit - CVE-2022-0185 - mean for Kubernetes?
In the last few days, Linux maintainers disclosed a broadly available Linux kernel vulnerability - CVE-2022-0185- what does it mean for Kubernetes?
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
8 ways to speed up your Ansible playbooks
https://www.redhat.com/sysadmin/faster-ansible-playbook-execution
https://www.redhat.com/sysadmin/faster-ansible-playbook-execution
Redhat
8 ways to speed up your Ansible playbooks
Ansible is a simple and powerful open source automation tool that can streamline many of your IT infrastructure operations. You can automate simple tasks lik...
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Active Directory Certificate Services (AD CS): weaponizing the ESC7 attack
New vectors in different engagements throughout the last months, mainly to escalate and keep the acquired privileges. In this context, the techniques labeled as ESC1 and ESC8 were the most used, being the attacks most well documented on the internet due to their effectiveness.
https://www.blackarrow.net/adcs-weaponizing-esc7-attack/
New vectors in different engagements throughout the last months, mainly to escalate and keep the acquired privileges. In this context, the techniques labeled as ESC1 and ESC8 were the most used, being the attacks most well documented on the internet due to their effectiveness.
https://www.blackarrow.net/adcs-weaponizing-esc7-attack/
Tarlogic Security
BlackArrow - Offensive security services
BlackArrow is the offensive and defensive security services division of Tarlogic Security. A team of high level professionals
Financially Motivated Mobile Scamware Exceeds 100M Installations
https://blog.zimperium.com/dark-herring-android-scamware-exceeds-100m-installations/
https://blog.zimperium.com/dark-herring-android-scamware-exceeds-100m-installations/
Zimperium
Financially Motivated Mobile Scamware Exceeds 100M Installations - Zimperium
Research by Aazim Bill SE Yaswant and Nipun Gupta While some financially motivated scams may seem simple on the surface, the truth of the matter is that
Forwarded from Yevgeniy Goncharov
News: Анонс нового анонса сервиса Sys-Admin BLD
Yo! Всем приветы! Ближайший месяц планирую сделать апдейт Сервиса Sys-Admin BLD
Напомню, что с недавних пор к набору сервисов BLD “Black-Box”, BLD “Open” прибавился BLD+
В рамках проекта BLD+ планирую сделать апдейт BLD с добавлением новых фич.функциональности итак текущий BLD из себя представляет:
- Main если хотите Core - стек всего BLD и несет в себе прежде всего блокировку малвари, рамсовари, фишинга и рекламы
- Добавится Main+Children/Family - Удобно будет блокировать всякую шляпу у детей, типа сайтов порно и игр типа ROBLOX
- Добавится Main+Office - Удобно для корпоратов и офисов, здесь будет блокировка всяких сайтов типа - знакомств
- Добавится Main+Children+Office - Включает все из вышеприведенного, полезно может быть для учебных учреждений
Как это будет рбаотать, на сайт добавится специальный конструктор, где пользователь сам себе выберет или создаст нужный DoH профиль, который будет иметь примерный вид:
-
или
-
Скопирует, вставит в браузер или роутер. Done!
P.S. О самом проекте можно прочитать и подключить здесь - https://lab.sys-adm.in/
Yo! Всем приветы! Ближайший месяц планирую сделать апдейт Сервиса Sys-Admin BLD
Напомню, что с недавних пор к набору сервисов BLD “Black-Box”, BLD “Open” прибавился BLD+
В рамках проекта BLD+ планирую сделать апдейт BLD с добавлением новых фич.функциональности итак текущий BLD из себя представляет:
- Main если хотите Core - стек всего BLD и несет в себе прежде всего блокировку малвари, рамсовари, фишинга и рекламы
- Добавится Main+Children/Family - Удобно будет блокировать всякую шляпу у детей, типа сайтов порно и игр типа ROBLOX
- Добавится Main+Office - Удобно для корпоратов и офисов, здесь будет блокировка всяких сайтов типа - знакомств
- Добавится Main+Children+Office - Включает все из вышеприведенного, полезно может быть для учебных учреждений
Как это будет рбаотать, на сайт добавится специальный конструктор, где пользователь сам себе выберет или создаст нужный DoH профиль, который будет иметь примерный вид:
-
https://bld.sys-adm.in/childrenили
-
https://bld.sys-adm.in/all Скопирует, вставит в браузер или роутер. Done!
P.S. О самом проекте можно прочитать и подключить здесь - https://lab.sys-adm.in/
CVE-2022-23968: Xerox vulnerability allows unauthenticated users to remotely brick network printers
https://neosmart.net/blog/2022/xerox-vulnerability-allows-unauthenticated-network-users-to-remotely-brick-printers/
https://neosmart.net/blog/2022/xerox-vulnerability-allows-unauthenticated-network-users-to-remotely-brick-printers/
The NeoSmart Files
CVE-2022-23968: Xerox vulnerability allows unauthenticated users to remotely brick network printers (UPDATED)
In the world of network security, it pays to always remember that many (if not most!) security bugs start off their lives as seemingly innocuous “regular” bugs, and it’s only by d…
NEW THREAT CAMPAIGN IDENTIFIED: ASYNCRAT INTRODUCES A NEW DELIVERY TECHNIQUE
Through a simple email phishing tactic with an html attachment, threat attackers are delivering AsyncRAT (a remote access trojan) designed to remotely monitor and control its infected computers through a secure, encrypted connection:
https://blog.morphisec.com/asyncrat-new-delivery-technique-new-threat-campaign
Through a simple email phishing tactic with an html attachment, threat attackers are delivering AsyncRAT (a remote access trojan) designed to remotely monitor and control its infected computers through a secure, encrypted connection:
https://blog.morphisec.com/asyncrat-new-delivery-technique-new-threat-campaign
Morphisec
New Threat Campaign: AsyncRAT Introduces a New Delivery Technique
Morphisec Labs identified a new threat campaign. Through a simple phishing tactic with an HTML attachment, threat attackers are delivering AsyncRAT.
Linux kernel: use-after-free of user namespace on shm and mqueue destruction
Exploiting this issue for privilege escalation requires the availability
of unprivileged user namespaces.
https://www.openwall.com/lists/oss-security/2022/01/29/1
Exploiting this issue for privilege escalation requires the availability
of unprivileged user namespaces.
https://www.openwall.com/lists/oss-security/2022/01/29/1
/ North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign
https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
/ Abusing Microsoft Office Using Malicious Web Archive Files
https://www.netskope.com/blog/abusing-microsoft-office-using-malicious-web-archive-files
https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
/ Abusing Microsoft Office Using Malicious Web Archive Files
https://www.netskope.com/blog/abusing-microsoft-office-using-malicious-web-archive-files
ThreatDown by Malwarebytes
North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign
How one of North Korea’s most sophisticated APTs tries to avoid detection by using legitiate tools during its attacks.
This vulnerability allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfs_fruit
CVE-2021-44142https://www.samba.org/samba/security/CVE-2021-44142.html
/ Critical Vulnerability Fixed In Essential Addons for Elementor Plugin (WordPress)
https://patchstack.com/articles/critical-vulnerability-fixed-in-essential-addons-for-elementor-plugin/
/ In January 2021, PwC observed a phishing page that prompted an investigation into a new threat actor we now call ‘White Tur’
https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html
/ BotenaGo strikes again - malware source code uploaded to GitHub
https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github
https://patchstack.com/articles/critical-vulnerability-fixed-in-essential-addons-for-elementor-plugin/
/ In January 2021, PwC observed a phishing page that prompted an investigation into a new threat actor we now call ‘White Tur’
https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/threat-actor-of-in-tur-est.html
/ BotenaGo strikes again - malware source code uploaded to GitHub
https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github
/ An In-Depth Look At The 23 High-Impact Vulnerabilities
..
Today, we are announcing the discovery of 23 high-impact vulnerabilities in one of the major Independent BIOS Developers (IBV) software:
https://www.binarly.io/posts/An_In_Depth_Look_at_the_23_High_Impact_Vulnerabilities/index.html
/ StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations
https://www.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations
..
Today, we are announcing the discovery of 23 high-impact vulnerabilities in one of the major Independent BIOS Developers (IBV) software:
https://www.binarly.io/posts/An_In_Depth_Look_at_the_23_High_Impact_Vulnerabilities/index.html
/ StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations
https://www.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations
Cybereason
StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations
Cybereason discovered an undocumented RAT dubbed StrifeWater attributed to Iranian APT Moses Staff who deploy destructive ransomware following network infiltration and the exfiltration of sensitive data...
/ New PowerShell Backdoor for Espionage
https://www.cybereason.com/blog/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage
/ Critical Vulnerabilities in Trend Micro Deep Security Agent for Linux
https://www.modzero.com/advisories/MZ-21-02-Trendmicro.txt
/ Local privilege escalation vulnerability fixed in ESET products for Windows
https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows
https://www.cybereason.com/blog/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage
/ Critical Vulnerabilities in Trend Micro Deep Security Agent for Linux
https://www.modzero.com/advisories/MZ-21-02-Trendmicro.txt
/ Local privilege escalation vulnerability fixed in ESET products for Windows
https://support.eset.com/en/ca8223-local-privilege-escalation-vulnerability-fixed-in-eset-products-for-windows
Cybereason
PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage
Cybereason discovered a new toolset developed by Iranian APT Phosphorus which revealed a connection to Memento ransomware and includes the newly discovered PowerLess Backdoor that evades detection by running PowerShell in a .NET context...
City of Dallas - Data Loss Report
https://dallascityhall.com/departments/ciservices/Pages/Report-on-Data-Loss.aspx
I love such reports, if you have links of data losses / breaches, will send links to me please)
P.S. Thx for the link dear subscriber ✌️
https://dallascityhall.com/departments/ciservices/Pages/Report-on-Data-Loss.aspx
I love such reports, if you have links of data losses / breaches, will send links to me please)
P.S. Thx for the link dear subscriber ✌️
Dallascityhall
Information & Technology Services
Report on Data Loss
Report on Data Loss
/ Active Exploitation of Zero-day XSS Vulnerability in Zimbra Details
The campaigns came in multiple waves across two attack phases. The initial phase was aimed at reconnaissance and involved emails designed to simply track if a target received and opened the messages. The second phase came in several waves that contained email messages luring targets to click a malicious attacker-crafted link.
/ Cisco Small Business RV Series Routers Vulnerabilities Details
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers.
/ Scanning for Generalized Transient Execution Gadgets in the Linux Kernel Details
We confirm our findings by demonstrating an end-to-end proof-of-concept exploit for one of the gadgets found.
/ CISA Adds One Known Exploited Vulnerability to Catalog Details
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below.
/ Path traversal and dereference of symlinks when passing Helm value files Details
All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts.
/ ACTINIUM targets Ukrainian organizations Details
Phishing again. ⚡️ Already blocked in Sys-Admin BLD (https://lab.sys-adm.in/)
BLD DNS - Обновление в сторону скорости и безопасности. Краткий отчет.
Уже почти, как полгода открытый превентивный DoT/DoH BLD DNS сервис бесплатно приносит пользу блокируя малварные, фишинговые, трекинговые и рекламные домены, экономя трафик, время и мозговые ресурсы своим пользователям.
За это время были заблокировано множество фишинговых кампаний (типа franken-phish), малварных и рамсомварных компаний (типа Pegasus или Kaseya), про блокировку рекламных и трекинговых доменов говорить наверное и не стоит, можно лишь упомянуть, что их количество превышет 1 миллион поинтов из текущих ~двух.
⚡️ В обшей сложности блокируется ~9%-15% процентов вредоносности из ~10 миллионов запросов в месяц из разных стран мира, это очень радует спасибо всем кто пользуется и привносит вклад в проект .
Что добавилось в этом году:
• новый регион, теперь регионов 4 - Казахстан, Германия, Сингапур, Нидерлады
• несколько сетов по вендорам для нивелирования false-positive срабатываний
• добавлен дуплексный режим DoH (443, 8443)
• надеюсь скоро добавится конструктор сетов блокировок BLD DNS (анонс)
Со своей стороны хочется сделать открытый сервис еще более открытым, доступным, надежным, напомню, что сервис живет благодаря помощи друзей, пользователей, тестировщиков проекта, здесь будет полезна и твоя помощь уважаемый user_name твой вклад, как умственный или временной или финансовый будет неоценим, а твой user_name будет отражен в разделе благодарностей на официальном сайте BLD DNS - https://lab.sys-adm.in 🙂
P.S. Спасибо друзьям из Nitro Team за ряд идей по безопасности проекта.
Всем успехов и добра, с уважением @sysadminkz. Берегите себя. Pace to all ✌️