Open SysConf'22 - Анонс всех докладов на завтра (14 Октября)
 
До дня Х осталось меньше суток, завтра по плану будет:

— 11:00 - Вступительное слово
— 11:15 - Сабыржан "novitoll" Тасболатов: Практический опыт с 4G, 5G
— 12:15 - Нурбиби "R0b0Cat": Шаблонизация Linux систем в организациях
— 13:00 - Обед
— 14:00 - Дмитрий "ватман": CDC
— 14:50 - Kutlymurat "manfromkz" Mambetniyazov: История одного CVE
— 15:20 - Roman "sysroman": Ansible AWX by Oracle
— 15:45 - кофе-брейк
— 16:00 - Shelldon "Sh3lldon": DEP vs ROP
— 16:50 - Ilyas B Arinov "t2micro": Старый... Но не бесполезный IRC
— 17:20 - Айдар Оспанбеков: Сети (хуети) в современном датацентре
— 18:05 - Yevgeniy "sysadminkz": Неявный превентинг констракшн

План может меняться, уж не обессудьте. Заряжаем себя и друзей, находим силы и возможности и проводим нашу встречу в добром здравии и отношении.

☀️ Завтра встречаем Вас на первом этаже - ул. Байзакова 280 в SmartPoint, г.Алматы
⚡️ Кто не зарегистрировался, зарегистрируйтесь пожалуйста иначе мест Вам может не хватить, детали здесь: https://sysconf.io

Всем Peace ✌️

P.S. Зал SmartArt

/ Alchimist: A new attack framework in Chinese for Mac, Linux and Window

https://blog.talosintelligence.com/2022/10/alchimist-offensive-framework.html

/ Various Linux Kernel WLAN security issues (RCE/DOS) found

https://www.openwall.com/lists/oss-security/2022/10/13/2

/ Threat Alert: Private npm Packages Disclosed via Timing Attacks

https://blog.aquasec.com/private-packages-disclosed-via-timing-attack-on-npm

FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684)

PoC

https://www.horizon3.ai/fortios-fortiproxy-and-fortiswitchmanager-authentication-bypass-technical-deep-dive-cve-2022-40684/

/ Zimbra - Attacker managed to upload files into Web Client directory

https://forums.zimbra.org/viewtopic.php?t=71153

/ A vulnerability was found in Zoom Client for Meetings up to 5.11.x on macOS (Unified Communication Software). It has been classified as critical

...debugging port misconfiguration..:

https://vuldb.com/?id.210867

/ Introducing the Fleet Public Preview

I tried it.. Not bad.. not bad:

https://blog.jetbrains.com/fleet/2022/10/introducing-the-fleet-public-preview/

Additional info:

https://www.jetbrains.com/fleet/

/ Microsoft Office 365 Message Encryption Insecure Mode of Operation

https://labs.withsecure.com/advisories/microsoft-office-365-message-encryption-insecure-mode-of-operation

/ Git security vulnerabilities announced

Today, the Git project released new versions to address a pair of security vulnerabilities (CVE-2022-39253, and CVE-2022-39260) that affect versions 2.38 and older. These affect Git’s --local clone optimization and git shell‘s interactive command mode:

https://github.blog/2022-10-18-git-security-vulnerabilities-announced

How We Managed to Abuse a Custom Role User Using CSTI and Stored XSS in Azure Fabric Explorer

https://orca.security/resources/blog/fabrixss-vulnerability-azure-fabric-explorer/

/ New Fully Undetectable PowerShell Backdoor (high-level overview FUD PowerShell backdoor)

In this research report, we will provide a high-level overview of this FUD PowerShell backdoor, including when it first appeared and what it does. We’ll also provide insight into the operations security mistakes made by the threat actor responsible for the tool that we were able to logically exploit to access and decrypt the encrypted C2 commands for each victim. One of the commands is an execution of a full PowerShell code for Active Directory users enumeration and remote desktop enumeration, which probably will be used later in a lateral movement phase…

https://www.safebreach.com/resources/blog/safebreach-labs-researchers-uncover-new-fully-undetectable-powershell-backdoor/

Netlas.io - Discover, Research and Monitor any Assets Available Online
 
Internet intelligence apps that provide accurate technical information on IP addresses, domain names, websites, web applications, IoT devices, and other online assets:

• Web crawler
• Domain names
• DNS lookups
• Whois
• Internet scanner

This service has API and Free "Community" access for registered users:

• Tool: https://app.netlas.io/

/ K30425568: Overview of F5 vulnerabilities (October 2022)

https://support.f5.com/csp/article/K30425568

/ New Scanner For Text4shell

https://blog.silentsignal.eu/2022/10/18/our-new-scanner-for-text4shell/

Additionl info - CVE-2022-42889: Keep Calm and Stop Saying "4Shell”

https://www.rapid7.com/blog/post/2022/10/17/cve-2022-42889-keep-calm-and-stop-saying-4shell/

/ Vulnerability Spotlight: Vulnerabilities in Abode Systems home security kit could allow attacker to take over cameras, remotely disable them

https://blog.talosintelligence.com/2022/10/vuln-spotlight-abode-.html

/ About the security content of iOS 16.1 and iPadOS 16

https://support.apple.com/en-us/HT213489

/ “Dormant Colors”: Live Campaign With Over 1M Data Stealing Extensions Installed

Evil browser extention, technical analysis:

https://guardiosecurity.medium.com/dormant-colors-live-campaign-with-over-1m-data-stealing-extensions-installed-9a9a459b5849

/ Stranger Strings: An exploitable flaw in SQLite

https://blog.trailofbits.com/2022/10/25/sqlite-vulnerability-july-2022-library-api/

/ ClamAV 1.0.0 release candidate now available

many good changes in clamav you can read on official release page:

https://blog.clamav.net/2022/10/clamav-100-release-candidate-now.html