raptor

securefirmware, 3 months ago to random German

Short overview of some of the latest EMBA highlights. Including the absolute new binary analysis engine based on the amazing work by https://infosec.exchange/@raptor

video/mp4

raptor, 3 months ago to random

Apparently, @github pages IP addresses have been blacklisted by spamhaus https://github.com/orgs/community/discussions/106991

raptor, 3 months ago to random

This project looks very cool (and useful)!

The #HTTP Garden is a collection of HTTP #servers and #proxies configured to be composable, along with scripts to interact with them in a way that makes finding #vulnerabilities much much easier.

https://github.com/narfindustries/http-garden

For some cool demos of the stuff that you can find with the HTTP Garden, check out our #ShmooCon 2024 talk.

https://invidious.slipfox.xyz/watch?v=aKPAX00ft5s&t=2h19m0s

ryanc, 3 months ago (edited 3 months ago) to random

It's been ten years, so a short story about the "gotofail" bug.

Someone came to me about a catastrophic vulnerability in Apple's TLS implementation.

I shit you not, they'd overheard someone at a bar drunkenly bragging about how they were going to sell it to a FVEY intelligence agency for six figures.

They didn't know exactly what it was, just some vague details and the key point that it allowed use of the real certificate.

This was enough for me to find the bug (yay open source), which would go on to be known as "gotofail", and produce a working exploit in less than a day.

The details were anonymously back channelled to Apple, who released a fix.

@matthew_d_green posted on Twitter about it, concerned by Apple's vague release notes.

I used a burner phone to share the details with him anonymously.

Then everyone forgot about the whole thing because heartbleed.

¯_(ツ)_/¯

raptor, 3 months ago to random

For the algorithm lovers: Nontransitive comparison functions lead to
out-of-bounds read & write in #glibc's qsort() by @qualys

• can’t stop thinking about possible targets for this memory corruption 🤔

https://www.qualys.com/2024/01/30/qsort.txt

raptor, 3 months ago to security

I've made #MSRC’s 2023 Q4 Top #Security Researchers Leaderboard!

It was a pleasure working with @microsoft to improve the security posture of their #Azure ecosystem. Some coordinated disclosure advisories and writeups are coming, so stay tuned on the @hnsec blog.

https://msrc.microsoft.com/blog/2024/01/congratulations-to-the-top-msrc-2023-q4-security-researchers/

buherator, 3 months ago to random

[RSS] [Computing] I hacked a train toilet

https://www.devever.net/~hl/traintoilet

raptor, 3 months ago to windows

#Windows Time Travel #Debugging - Overview

https://learn.microsoft.com/en-us/windows-hardware/drivers/debuggercmds/time-travel-debugging-overview

raptor, 3 months ago to windows

A Practical Guide to #Windows #PrintNightmare in 2024 by @itm4n

https://itm4n.github.io/printnightmare-exploitation/

raptor, 3 months ago to jenkins

Excessive Expansion: Uncovering Critical Security #Vulnerabilities in #Jenkins by @SonarResearch

https://www.sonarsource.com/blog/excessive-expansion-uncovering-critical-security-vulnerabilities-in-jenkins/

Exploit is here:
https://github.com/gquere/pwn_jenkins

raptor, 3 months ago to random

*nix #libX11: Uncovering and exploiting a 35-year-old #vulnerability – Part 2 of 2

https://jfrog.com/blog/xorg-libx11-vulns-cve-2023-43786-cve-2023-43787-part-two/

buherator, 3 months ago to random

I guess I have to add another item to my "reflective XSS exploited in the wild" list (still less than 5 elements though)

https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations/

Lee_Holmes, 3 months ago to random

If you are at all engaged at work in protecting your company or organization, you need to really look at this Postman issue: https://infosec.exchange/deck/

Your company likely has policies around where it is safe to store secrets and credentials (i.e.: with companies that care and account for that in their threat model), and I'm sure that Postman isn't one of them.

We've done some analysis in our organization while eliminating Postman and you'll be surprised what's there.

timb_machine, 4 months ago to security

Interesting links of the week:

Strategy:

• https://freedomnews.org.uk/2024/01/20/david-cameron-advised-continuing-arms-exports-to-israel/ - insufficient bombing detected
• https://www.performance.gov/cyber/ - keeping score on US federal agencies
• https://www.gov.uk/government/news/business-leaders-urged-to-toughen-up-cyber-attack-protections - y0, patch your shit, yells HMG
• https://www.ncsc.gov.uk/blog-post/landing-at-the-ncsc-glad-i-brought-my-towel - @ollie_whitehouse and his first 60 days keeping us safe and what he wants by way of new capability
• https://therecord.media/katie-moussouris-vulnerability-disclosure-china-european-union - @k8em0 talks disclosure

Standards:

• https://niccstandards.org.uk/publications/ - how UK telco plc plans to address the rigour of TSAs

Threats:

• https://arstechnica.com/security/2024/01/hackers-can-id-unique-apple-airdrop-users-chinese-authorities-claim-to-do-just-that/ - .cn in your Mac, AirDropping your ID
• https://pbom.dev/ - s/january24/february25/g and other tall tales
• https://www.jamf.com/blog/jtl-malware-pirated-applications/ - as if OS X wasn't terrible enough

Detection:

• https://www.microsoft.com/en-us/security/blog/2023/12/05/microsoft-incident-response-lessons-on-preventing-cloud-identity-compromise/ - hardening the cloud
• https://www.mandiant.com/sites/default/files/2022-06/wp-proactive-prep-and-hardening-wp.pdf - turn about is fair play, if Microsoft wants to defend the cloud, Google wants to defend AD
• https://www.honeycomb.io/blog/alerts-are-fundamentally-messy - alerts are hard, let's go shopping!

Exploitation:

• https://alecmuffett.com/article/108789 - @alecm gives us a history lesson

Bugs:

• https://blog.trailofbits.com/2024/01/16/leftoverlocals-listening-to-llm-responses-through-leaked-gpu-local-memory/ - @trailofbits demonstrate why it's important to make sure you regularly purge your robot's short term memory
• https://jfrog.com/blog/xorg-libx11-vulns-cve-2023-43786-cve-2023-43787-part-one/ - popping X11
• https://www.varonis.com/blog/outlook-vulnerability-new-ways-to-leak-ntlm-hashes - Outlook not quite so sunny
• https://lists.apache.org/thread/h9bjqdd0odj6lhs2o96qgowcc6hb0cfz - can't find the page you want, here's one I made earlier
• https://security.humanativaspa.it/nothing-new-under-the-sun/ - more bugz, @raptor plz

Hard hacks:

• https://privatedrop.github.io/ - the original AirDrop privacy report
• https://kirbah.github.io/apc-ups/Smart-protocol/ - speak to the source of power

Nerd:

• https://blog.emfcamp.org/2024/01/21/emf-2024-ticket-sales/ - EMFCamp 2024 on the horizon

#security, #research

raptor, 4 months ago to programming

Modern C++ #Programming #Course (C++11/14/17/20) by @fedebusato

https://github.com/federico-busato/Modern-CPP-Programming

raptor, 4 months ago to writing

#Writing to #Think

“Writing is the process by which you realize that you do not understand what you are talking about.”

https://fs.blog/writing-to-think/

raptor, 4 months ago to random

The Confusing History of #F5 BIG-IP RCE #Vulnerabilities

https://www.labs.greynoise.io/grimoire/2024-01-14-f5-rce-explained/

raptor, 4 months ago to TodayILearned

“Don't be afraid to get your hands dirty! Recreate a #virus, an #exploit PoC, or a system component. Single step through your #programs, or even the #kernel. Look up what you don't know. Listen to stories told by others. #Share what you #learn. #Challenge your own assumptions. See how you can apply this thinking to other things too.” 💯

https://tmpout.sh/3/01.html

raptor, 4 months ago to random

#VirtualBox is collapsing: a n-day story by @lukegix 🔥

https://exploiter.dev/blog/2023/Virtualbox-research.html

raptor, 4 months ago to random

Exploring object #file #formats

https://maskray.me/blog/2024-01-14-exploring-object-file-formats

raptor, 4 months ago to random

*nix #libX11: Uncovering and exploiting a 35-year-old #vulnerability – Part 1 of 2 by @jfrog

https://jfrog.com/blog/xorg-libx11-vulns-cve-2023-43786-cve-2023-43787-part-one/

Happy to see that other researchers are building upon my previous work

https://security.humanativaspa.it/nothing-new-under-the-sun/

https://github.com/0xdea/advisories/blob/master/HNS-2022-01-dtprintinfo.txt

GossiTheDog, 4 months ago to random

⚠️ want a highly impactful, actively exploited border gateway zero days situation to wake you up?

Ivanti Pulse Secure aka Ivanti Connect Secure and Ivanti Policy Secure Gateway customers - prepare to deploy mitigations and await follow on patches.

In the wild exploitation, probable nation state - includes authentication (including MFA) bypass and code execution.

Looks like Ivanti have done a really good job identifying.

I call it ConnectAround. #threatintel #connectaround