Clik here to view.
Poweliks: the persistent malware without a file Malware that resides in the...
When security researchers talk about malware, they usually refer to files stored on a computer system, which intends to damage a device or steal sensitive data from it. Those files can be scanned by AV...
View ArticleClik here to view.
Paper: Can't you hear me knocking: Identification of user actions on Android...
While smartphone usage become more and more pervasive, people start also asking to which extent such devices can be maliciously exploited as "tracking devices". The concern is not only related to an...
View ArticleClik here to view.
Flashbang
Welcome to project "Flashbang". This tool is an open-source Flash-security helper with a very specific purpose: Find the flashVars of a naked SWF and display them, so a security tester can start...
View ArticleClik here to view.
Spy of the Tiger
A recent report documents a group of attackers known as “PittyTiger” that appears to have been active since at least 2011; however, they may have been operating as far back as 2008. We have been...
View ArticleClik here to view.
Remote code execution on Android devices
We don’t talk about Android much here on the Bromium Labs Blog, but now and again we like to tinker. Recently my colleague Thomas Coudray and I have been looking at an Android remote code execution...
View ArticleClik here to view.
Hidden Tahoe Backup- a clandestine distributed backup system for Tails
This project's objective is to help people in oppressive surveillance states ensure the confidentiality and integrity of their data. A Tahoe-LAFS backup system can have interesting political...
View ArticleClik here to view.
FLARE Team Reversing Repository
This repository contains a collection of IDA Pro scripts and plugins used by the FireEye Labs Advanced Reverse Engineering (FLARE) team.more here...........https://github.com/fireeye/flare-ida
View ArticleClik here to view.
CRACKING PUSHDO AND HOW TO BUST THROUGH MOST CRYPTERS
Pushdo has historically (since 2008) had close ties to the Cutwail botnet, often acting as a dropper for it. The reader, however, is reminded: as malware executes on a system it can do almost anything...
View ArticleClik here to view.
Photo WiFi Transfer 1.01 - Directory Traversal Vulnerability
Document Title:===============Photo WiFi Transfer 1.01 - Directory Traversal VulnerabilityReferences (Source):====================http://www.vulnerability-lab.com/get_content.php?id=1285Release...
View ArticleClik here to view.
Anti-Spoofing, BCP 38, and the Tragedy of the Commons
n the seminal 1968 paper "The Tragedy of the Commons" , Garrett Hardin introduced the world to an idea which eventually grew into a household phrase. In this blog article I will explore whether...
View ArticleClik here to view.
A particularly convincing nefarious ad
As a researcher with the Microsoft Malware Protection Center (MMPC), I see a lot of digital advertising. Recently I came across a nefarious ad that is so convincing I need to warn you about it.more...
View ArticleClik here to view.
Kippo Ansible Playbook
This is an Ansible playbook to install Kippo on Debian hosts.The playbook will setup a node as a database server for kippo hosts to log incoming attacks and will also setup multiple kippo hosts.more...
View ArticleClik here to view.
Samba 4.0.0 to 4.1.10 Remote Code Execution Vulnerability in nmbd
CVE-2014-3560.html:============================================================= Subject: Remote code execution in nmbd==== CVE ID#: CVE-2014-3560==== Versions: Samba 4.0.0 to 4.1.10====...
View ArticleClik here to view.
Fake ID fix- Xposed patch for Android bug 13678484
Fixes the Fake ID vulnerability (bug 13678484).It allows malicious apps to pretend to be signed from certain trusted providers and be loaded assupposedly authorized extensions in certain contexts (e.g....
View ArticleClik here to view.
The Tigress Diversifying C Virtualizer
Tigress is a virtualizer for the C language that supports many novel defenses, both static and dynamic, against well-known de-virtualization attacks. In addition to the virtualization transformation,...
View ArticleClik here to view.
toolsmith - Threats & Indicators: A Security Intelligence Lifecycle
I’ve been feeling as if it’s time to freshen things up a bit with toolsmith and occasionally offer a slightly different approach to our time-tested process. Rather than always focusing on a single tool...
View ArticleClik here to view.
C++11 insecure by default
In this article I will present a conclusion of testing the new 'objective regex' in several implementation of standard c++ library like libcxx (clang) and stdlibc++ (gcc). The results show the weakness...
View ArticleClik here to view.
Thousands of Mozilla developers’ e-mail addresses, password hashes exposed
E-mail addresses and cryptographically protected passwords for thousands of Mozilla developers were exposed through a database glitch that may have been exploited by hackers, Mozilla officials warned...
View ArticleClik here to view.
bt voyager 2091 jtag
Before attempting to flash a router with openwrt, I like to jtag it so I can dump and restore the flash if it all goes horribly wrong. Unlike the the serial console, the jtag connections on the BT...
View ArticleClik here to view.
Outsmarting the smart meter
The Conpot team recently introduced what we call the proxy module. Basically we forward the traffic from one service in Conpot to a service running on a real piece of hardware. This is a very...
View Article