Как растет и кто помогает расти OpenBLD.net (Q2 2023)
 
В экосистеме OpenBLD произошел эволюционный всплеск, теперь это:
— Anycast/GeoDNS, DNSSEC, DNS-over-HTTPS, DNS-over-TLS, DNS

Благодаря этому появились два новых сервиса - Adaptive (ADA), Strict (RIC) которые заменят A-BLD, BLD (в чем отличие)

Настало время тестирования, я тестирую уже более двух недель и это пушка, кто использует OpenBLD пробуй заменить:

🔸 DoH: https://a-bld.sys-adm.in/dns-query на https://ada.openbld.net/dns-query
🔸 DoT: a-bld.sys-adm.in на ada.openbld.net

🔹 DoH: https://bld.sys-adm.in/dns-query на https://ric.openbld.net/dns-query
🔹 DoT: bld.sys-adm.in на ric.openbld.net

В течении недели, мб двух A-BLD будет полностью смерджен с ADA и перестанет существовать как таковой. Один сервер (109.234.39.72) будет заменен другим (46.151.29.15) более шустрым. Начинай тестирование уже сейчас.

Этого не было бы без поддержки. В этом году OpenBLD проект поддержали:
— Сервисно: ClouDNS, Gcore, JetBrains, UptimeRobot
— Информационо: AST Cyber Lab, Core24/7, qCloudy
— Отдельное спасибо Казахстанским хостерам: Unihost.kz, GOhost.kz 🤜️️️️️️🤛️️️️️️

Ты тоже можешь сделать свой вклад в открытый сервис по фильтрации вредоносного контента, пиши @sysadminkz

Всем Peace ✌️

KeePass 2.X Master Password Dumper

— https://github.com/vdohney/keepass-password-dumper

What is ARP Spoofing

ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker’s MAC address with the IP address of a legitimate computer or server on the network.

DevSecOps Fundamentals from Department of Defence

https://dodcio.defense.gov/Portals/0/Documents/Library/DevSecOpsTools-ActivitiesGuidebook.pdf

Your phone is not your phone: a dive into SMS PVA fraud

https://www.first.org/resources/papers/conf2022/FIRSTCON22-Yourphoneisnotyourphone_pub.pdf

OpenBLD DNS prevented new malicious campaign that spreads through of Google Ads
 
Today I discovered a new malicious company that spreads through of Google Ads side...

In short - "Sponsored" link redirects to malicious site, and boom 💥 I felt "OpenBLD" effect!

OpenBLD.net DNS blocked for me browser-hijacking app which was distributing with Google Ads... Wow 💣, very unexpected and nice as I usually try to be more careful when surfing the internet.

Be safe with free and OpenBLD.net DNS 🤜🤛️️️️️️

• Look about of free and OpenBLD DNS service on project site - lab.sys-adm.in
• Страница проекта на русском - https://lab.sys-adm.in/ru

P.S. What is xg4ken and how to removal

Host Header Vulnerability Scanner Automated Tool

https://github.com/hemantsolo/Host-Header-Injection-Vulnerability-Scanner

Whisker is a C# tool for taking over Active Directory user

..and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account:

— https://github.com/eladshamir/Whisker

"Pre-Owned" malware in ROM for AllWinner H616/H618 & RockChip RK3328 Android TV Boxes

https://github.com/DesktopECHO/T95-H616-Malware/tree/main

Expose Smartphone Fingerprint Authentication to Brute-force Attack

PowerShell Obfuscation Bible

— repo: https://github.com/t3l3machus/PowerShell-Obfuscation-Bible
— video: https://www.youtube.com/watch?v=tGFdmAh_lXE

MaccaroniC2 - Empowering Command & Control using AsyncSSH

MaccaroniC2 is a proof-of-concept Command and Control framework that utilizes the powerful AsyncSSH Python library which provides an asynchronous client and server implementation of the SSHv2 protocol and use PyNgrok wrapper for ngrok integration. This tool is inspired for a specific scenario where the victim runs the AsyncSSH server and establishes a tunnel to the outside, ready to receive commands by the attacker:

— https://github.com/CalfCrusher/MaccaroniC2

Evading MDATP for Full Endpoint Compromise

The purpose of this article will be showcasing the full compromise of an up-to-date Windows 10 endpoint protected by Microsoft's EDR solution Windows Defender Advanced Threat for Endpoint:

— https://www.fo-sec.com/articles/compromising-mdatp-endpoint

Six Best Practices Recommendations for Simplifying Firewall Compliance and Risk Mitigation, based on PCI DSS, ISO 27002

File Archiver In The Browser

This article explores a phishing technique that emulates a file archiver software in the browser while using a .zip domain:

— https://mrd0x.com/file-archiver-in-the-browser/?no-cache=1

/ APT 29 Initial Access Killchain -MITRE ATT@CK Mappin

https://michaelkoczwara.medium.com/apt-29-initial-access-killchain-mitre-att-ck-mapping-f82286fa13ba

/ Analysis of Amadey Bot Infrastructure Using Shodan

Here you'll see how to use a known c2 to craft additional queries based on html content and certificate information. In total, 12 unique servers will be identified:

https://embee-research.ghost.io/amadey-bot-infrastructure/

Dynamically program the kernel for efficient networking, observability, tracing, and security

this is eBPF… mf… where else to find time for all this..

— https://ebpf.io/