NativeDump

NativeDump allows to dump the lsass process using only NTAPIs generating a Minidump file with only the streams needed to be parsed by tools like Mimikatz or Pypykatz (SystemInfo, ModuleList and Memory64List Streams).

https://github.com/ricardojoserf/NativeDump

Pingora

Pingora is a Rust framework to build fast, reliable and programmable networked systems from CF

https://github.com/cloudflare/pingora

Ramsomware 2023-2024 review

Cybercriminal ramsom Russia attacks review:

https://www.facct.ru/blog/ransomware-2023-2024/

/ Vulnerabilities Identified in LG WebOS

WebOS versions 4 through 7 running on LG TVs. These vulnerabilities let us gain root access on the TV after bypassing the authorization mechanism. Although the vulnerable service is intended for LAN access only, so.. Internet-connected devices, identified over 91,000 devices:

https://www.bitdefender.com/blog/labs/vulnerabilities-identified-in-lg-webos/

/ Unauthenticated attacker can execute arbitrary code via FortiClientLinux

[FortiClient Linux] Remote Code Execution due to dangerous nodejs configuration. Official advisory:

https://www.fortiguard.com/psirt/FG-IR-23-087

/ CVE-2024-3273: D-Link NAS RCE Exploited in the Wild

A remote code execution vulnerability in D-Link NAS devices is actively being exploited and is tracked under CVE-2024-3273. The vulnerability is believed to affect as many as 92,000 devices

https://www.greynoise.io/blog/cve-2024-3273-d-link-nas-rce-exploited-in-the-wild

Branch History Injection and Intra-mode Branch Target Injection / CVE-2022-0001, CVE-2022-0002 / INTEL-SA-00598

https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/advisory-guidance/branch-history-injection.html

New Technique to Trick Developers Detected in an Open Source Supply Chain Attack

https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack/

/ How Hackers Can Hijack 2FA Calls with Sneaky Call Forwarding

https://www.404media.co/how-hackers-can-hijack-2fa-calls-with-sneaky-call-forwarding/

/ Security & Risk Management (CISSP Cheat Sheet)

Covers a range of key topics:

- Domain 1: Security and Risk Management
- Domain 2: Asset Security
- Domain 3: Security Architecture and Engineering
- Domain 4: Communication and Network Security
- Domain 5: Identity and Access Management
- Domain 6: Security Assessment and Testing
- Domain 7: Security Operations
- Domain 8: Software Development Security

BatBadBut: You can't securely execute commands on Windows

The root cause of BatBadBut is the overlooked behavior of the CreateProcess function on Windows.

When executing batch files with the CreateProcess function, Windows implicitly spawns cmd.exe because Windows can’t execute batch files without it:

https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows

WIFI Credential Dumping

Techniques to retrieve the PSK from a workstation post-compromise (Windows)

https://www.r-tec.net/r-tec-blog-wifi-credential-dumping.html

JetBrains следуя практикам поддержки Open Source, в этом году поддержал OpenBLD.net и меня новой лицензией

JetBrains - это первая компания, которая поддержала мою инициативу на пути создания моих открытых проектов. Такая поддержка, явилась значимой для меня, моей мотивации и движения вперед. Благодаря таким активностям ты понимаешь, что не тратишь время впустую, что не тянешь это все в одну упряжку, есть те, кто понимает тебя, кто поддерживает тебя и твои идеи и это делает тебя еще сильнее и еще ближе на пути достижения поставленных целей и реализации твоих идей.

Это круто, это приятно и это дает возможность двигаться еще дальше, чем ты есть на сегодня.

Всем кто имеет возможность оказывать помощь людям и проектам в их развитии и поддерживает и оказывает - посвящается. Успехов всем нам! Peace ✌️

JetBrains OSS - https://www.jetbrains.com/opensource/

RCE in Telegram review:

https://youtu.be/6JY3uaLSflk?si=T0N-aPa4mKeDAvqy

Simple categorized list of vulnerability types.

Best Practices for Deploying Secure and Resilient AI Systems

from Canadian Centre for Cyber Security

/ flatpak CVE-2024-32462 : Sandbox escape via RequestBackground

https://www.openwall.com/lists/oss-security/2024/04/18/5

/ Blind Spot: how I get from Docker Registry To RCE

https://medium.com/@red.whisperer/blind-spot-from-docker-registry-to-rce-b0d46e043798

MagicDot

A set of rootkit-like abilities for unprivileged users, and vulnerabilities based on the DOT-to-NT path conversion known issue:

https://github.com/SafeBreach-Labs/MagicDot

/ The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to
crash an application or overwrite a neighbouring variable.

https://sourceware.org/pipermail/libc-announce/2024/000040.html

a new exploitation technique that affects the whole PHP ecosystem, and the compromission of several applications.

CVE-2024-2961

https://security-tracker.debian.org/tracker/CVE-2024-2961