Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
Malware AV/VM evasion - part 14: encrypt/decrypt payload via A5/1. Bypass Kaspersky AV. Simple C++ example.
This post is the result of research on try to evasion AV engines via encrypting payload with another function: GSM A5/1 algorithm:
— https://cocomelonc.github.io/malware/2023/03/24/malware-av-evasion-14.html
This post is the result of research on try to evasion AV engines via encrypting payload with another function: GSM A5/1 algorithm:
— https://cocomelonc.github.io/malware/2023/03/24/malware-av-evasion-14.html
/ March 20 ChatGPT outage: Here’s what happened
An update on our findings, the actions we’ve taken, and technical details of the bug:
https://openai.com/blog/march-20-chatgpt-outage
An update on our findings, the actions we’ve taken, and technical details of the bug:
https://openai.com/blog/march-20-chatgpt-outage
Openai
March 20 ChatGPT outage: Here’s what happened
An update on our findings, the actions we’ve taken, and technical details of the bug.
GitHub Actions extension for VS Code
GitHub announced workflow extension:
— https://github.blog/2023-03-28-announcing-the-github-actions-extension-for-vs-code/
GitHub announced workflow extension:
— https://github.blog/2023-03-28-announcing-the-github-actions-extension-for-vs-code/
The GitHub Blog
Announcing the GitHub Actions extension for VS Code
Today, we’re excited to announce the release of the public beta of the official GitHub Actions VS Code extension, which provides support for authoring and editing workflows and helps you manage workflow runs without leaving your IDE.
/ Spyware vendors use 0-days and n-days against popular platforms
Your missed parcel included 0-days (CVE-2022-42856; CVE-2022-4135)...
iOS, Android, Samsung Internet Browser..:
https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/
Your missed parcel included 0-days (CVE-2022-42856; CVE-2022-4135)...
iOS, Android, Samsung Internet Browser..:
https://blog.google/threat-analysis-group/spyware-vendors-use-0-days-and-n-days-against-popular-platforms/
Google
Spyware vendors use 0-days and n-days against popular platforms
Google’s Threat Analysis Group (TAG) tracks actors involved in information operations (IO), government backed attacks and financially motivated abuse. For years, TAG has…
/ BingBang: The AAD misconfiguration that led to Bing.com results manipulation and account takeover explained
— https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration
— https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration
wiz.io
BingBang: AAD misconfiguration led to Bing.com results manipulation and account takeover | Wiz Blog
How Wiz Research found a common misconfiguration in Azure Active Directory that compromised multiple Microsoft applications, including a Bing management portal
/ Super FabriXss: From XSS to an RCE in Azure Service Fabric Explorer by Abusing an Event Tab Cluster Toggle (CVE-2023-23383)
Super FabriXss (CVE-2023-23383) is a dangerous Cross-Site Scripting (XSS) vulnerability discovered by the Orca Research Pod that affects Azure Service Fabric Explorer (SFX). This vulnerability enables unauthenticated remote attackers to execute code on a container hosted on a Service Fabric node:
— https://orca.security/resources/blog/super-fabrixss-azure-vulnerability/
Super FabriXss (CVE-2023-23383) is a dangerous Cross-Site Scripting (XSS) vulnerability discovered by the Orca Research Pod that affects Azure Service Fabric Explorer (SFX). This vulnerability enables unauthenticated remote attackers to execute code on a container hosted on a Service Fabric node:
— https://orca.security/resources/blog/super-fabrixss-azure-vulnerability/
After Happy Backup Day (31 March)
▫️ Make backups
▫️ Make them automatic
▫️ Make sure they work
.. and will be happy 🏆🎉🧘
▫️ Make backups
▫️ Make them automatic
▫️ Make sure they work
.. and will be happy 🏆🎉🧘
/ Moobot Strikes Again - Targeting Cacti And RealTek Vulnerabilities
— https://www.fortinet.com/blog/threat-research/moobot-strikes-again-targeting-cacti-and-realtek-vulnerabilities
— https://www.fortinet.com/blog/threat-research/moobot-strikes-again-targeting-cacti-and-realtek-vulnerabilities
Fortinet Blog
Moobot Strikes Again - Targeting Cacti And RealTek Vulnerabilities
FortiGuard Labs examined several attacks targeting Cacti and Realtek vulnerabilities. Understand the payloads of these attacks and their resulting behavior of spreading ShellBot and Moobot malware.…
AppSecFest - Осталось меньше месяца (21 апреля)
• The Evolution of Software Supply Chain Attacks Summary (En)
• От SDLC к Secure SDLC: актуальные вопросы о безопасной разработке
• Как без выделенных ресурсов построить систему управления ИБ, соответствующую SOC2
• Как собрать AppSec-отдел с нуля без смс и регистрации
• DevSecOps пайплайн на опенсорс инструментах
• Задача поиска точек ввода данных (DEP) при динамическом анализе современных веб-приложений
• Концепции Incident Management в процессах DevSecOps
Отдельно хочется сказать о докладе:
• Построение процессов безопасности в финтехе в США
• Докладчик Михаил Фленов - тот самый автор журнала Хакер, написавший несколько книг из серии "Глазами Хакера"
Детали и регистрация здесь - appsecfest.kz
• The Evolution of Software Supply Chain Attacks Summary (En)
• От SDLC к Secure SDLC: актуальные вопросы о безопасной разработке
• Как без выделенных ресурсов построить систему управления ИБ, соответствующую SOC2
• Как собрать AppSec-отдел с нуля без смс и регистрации
• DevSecOps пайплайн на опенсорс инструментах
• Задача поиска точек ввода данных (DEP) при динамическом анализе современных веб-приложений
• Концепции Incident Management в процессах DevSecOps
Отдельно хочется сказать о докладе:
• Построение процессов безопасности в финтехе в США
• Докладчик Михаил Фленов - тот самый автор журнала Хакер, написавший несколько книг из серии "Глазами Хакера"
Детали и регистрация здесь - appsecfest.kz
/ Dangerous SFX
How Falcon OverWatch Investigates Malicious Self-Extracting Archives, Decoy Files and Their Hidden Payloads:
— https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/
How Falcon OverWatch Investigates Malicious Self-Extracting Archives, Decoy Files and Their Hidden Payloads:
— https://www.crowdstrike.com/blog/self-extracting-archives-decoy-files-and-their-hidden-payloads/
CrowdStrike.com
Self-Extracting Archives, Decoy Files and Their Hidden Payloads
CrowdStrike recently observed the use of a seemingly empty SFX archive as part of an interactive intrusion that has the potential to provide a persistent backdoor.
/ Rorschach – A New Sophisticated And Fast Ransomware
— https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/
— https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/
Агрегатор доменов для Pi-Hole, AdGuard, Blocky, Open BLD
хей хо, кто юзает pi-hole, adguard, blocky, open-bld.. а так же блокирует вредоносные IP через ipset, firewalld или ip2drop
Я запустил новый cactusd пайплайн который два раза в сутки (каждые 12 часов) агрегирует зловредные доменные имена и айпи адреса в мега-листы, которые в том числе юзаются на bld и ip2drop эндпоинтах, кто хочет использовать self hosted решение, конфиги приведены там же в README.md:
— https://github.com/m0zgen/cactusd
хей хо, кто юзает pi-hole, adguard, blocky, open-bld.. а так же блокирует вредоносные IP через ipset, firewalld или ip2drop
Я запустил новый cactusd пайплайн который два раза в сутки (каждые 12 часов) агрегирует зловредные доменные имена и айпи адреса в мега-листы, которые в том числе юзаются на bld и ip2drop эндпоинтах, кто хочет использовать self hosted решение, конфиги приведены там же в README.md:
— https://github.com/m0zgen/cactusd
Sys-Admin InfoSec pinned «Агрегатор доменов для Pi-Hole, AdGuard, Blocky, Open BLD хей хо, кто юзает pi-hole, adguard, blocky, open-bld.. а так же блокирует вредоносные IP через ipset, firewalld или ip2drop Я запустил новый cactusd пайплайн который два раза в сутки (каждые 12 часов)…»
/ Certain HP Enterprise LaserJet and HP LaserJet Managed printers - Potential information disclosure
critical
https://support.hp.com/us-en/document/ish_7905330-7905358-16/hpsbpi03838
critical
https://support.hp.com/us-en/document/ish_7905330-7905358-16/hpsbpi03838
/ Rilide: A New Malicious Browser Extension for Stealing Cryptocurrencies
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rilide-a-new-malicious-browser-extension-for-stealing-cryptocurrencies/
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/rilide-a-new-malicious-browser-extension-for-stealing-cryptocurrencies/
Trustwave
Rilide: A New Malicious Browser Extension for Stealing Cryptocurrencies | Trustwave
Trustwave SpiderLabs uncovered a new strain of malware that it dubbed Rilide, which targets Chromium-based browsers such as Google Chrome, Microsoft Edge, Brave, and Opera.
/ Azure AD PowerShell Deprecation as June Deadline Approaches
https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/migrate-your-apps-to-access-the-license-managements-apis-from/bc-p/3783180?WT.mc_id=M365-MVP-9501
https://techcommunity.microsoft.com/t5/microsoft-entra-azure-ad-blog/migrate-your-apps-to-access-the-license-managements-apis-from/bc-p/3783180?WT.mc_id=M365-MVP-9501
TECHCOMMUNITY.MICROSOFT.COM
Migrate your apps to access the license managements APIs from Microsoft Graph | Microsoft Community Hub
On June 30, 2022, apps using Azure AD Graph after this time will no longer receive responses from the Azure AD Graph endpoint.
Открытый практикум DevOps by Rebrain: Запускаем MySQL, Percona Server и MariaDB с помощью Docker
• 11 Апреля (Вторник), 19:00 по МСК. Регистрация
Программа:
• Посмотрим, как можно одновременно запустить три варианта MySQL на одном хосте с помощью Docker
• Обсудим, как проводить базовые операции с базами данных в контейнерах
• И другие особенности работы в Docker
Ведет:
• Николай Лавинский - Веб-разработчик более 15 лет. Специализация: ускорение сайтов и веб-приложений
• 11 Апреля (Вторник), 19:00 по МСК. Регистрация
Программа:
• Посмотрим, как можно одновременно запустить три варианта MySQL на одном хосте с помощью Docker
• Обсудим, как проводить базовые операции с базами данных в контейнерах
• И другие особенности работы в Docker
Ведет:
• Николай Лавинский - Веб-разработчик более 15 лет. Специализация: ускорение сайтов и веб-приложений
/ Multiple vulnerabilities in the restricted shell of Cisco EPNM/ISE allow an authenticated, local attacker to escape the restricted shell and gain root privileges on the underlying operating system
-- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-adeos-MLAyEcvk
-- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-adeos-MLAyEcvk
Cisco
Cisco Security Advisory: Cisco Evolved Programmable Network Manager, Cisco Identity Services Engine, and Cisco Prime Infrastructure…
Multiple vulnerabilities in the restricted shell of Cisco Evolved Programmable Network Manager (EPNM), Cisco Identity Services Engine (ISE), and Cisco Prime Infrastructure could allow an authenticated, local attacker to escape the restricted shell and gain…
/ Actively exploited. About the security content of iOS 16.4.1 and iPadOS 16.4.1
— https://support.apple.com/en-us/HT213720
— https://support.apple.com/en-us/HT213720
Apple Support
About the security content of iOS 16.4.1 and iPadOS 16.4.1
This document describes the security content of iOS 16.4.1 and iPadOS 16.4.1.
Forwarded from Sys-Admin Up (Yevgeniy Goncharov)
50 Methods For Lsass Dump(RTC0002)
https://redteamrecipe.com/50-Methods-For-Dump-LSASS/
Img raw:
https://raw.githubusercontent.com/elementalsouls/DumpLSASS/main/50_Methods%20for%20LSASS%20Dump.png
https://redteamrecipe.com/50-Methods-For-Dump-LSASS/
Img raw:
https://raw.githubusercontent.com/elementalsouls/DumpLSASS/main/50_Methods%20for%20LSASS%20Dump.png
/ Balada Injector: Synopsis of a Massive Ongoing WordPress Malware Campaign
https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
https://blog.sucuri.net/2023/04/balada-injector-synopsis-of-a-massive-ongoing-wordpress-malware-campaign.html
Sucuri Blog
Balada Injector: Synopsis of a Massive Ongoing WordPress Malware Campaign
A synopsis of the massive ongoing WordPress malware campaign: Balada Injector, including common techniques, functionalities, and vulnerability exploits used in attacks.