Clik here to view.
Windows: CreateProcessAsUser Impersonation Token Bypass
The CreateProcessAsUser function is implemented by passing a token handle via a special Attribute (value 0x60002) to the underlying NtCreateUserProcess system call. All documentation indicates that...
View ArticleClik here to view.
Whitelisting goes wrong
Last December, I did testing on one of the client's web application. Going to share one of the findings that for me quite interesting.This application used purposely for state mapping service. A user...
View ArticleClik here to view.
[ TECHNICAL ANALYSIS: SCOOP.APK ]
I started to write about this particular malware before Christmas in 2014 but it was left sitting in the draft for so long until i decided to take a break from #EquationAPT today. It all started when i...
View ArticleClik here to view.
Another hunting post
I often see statements like “people need to know their network like the back of their hand to be able to identify evil”. While I don’t disagree with this, I think there are many other things that...
View ArticleClik here to view.
Shooting Elephants: (Analysis of French Government Spyware Known As Babar...
Subject of this analysis is a fascinating piece of malware, which invades Windows desktopmachines and aims at..well, all the things. The analyzed malware consists of a dropper and animplant, which...
View ArticleClik here to view.
Angry Android hacker hides Xbot malware in popular application icons
In the past few weeks, the Avast Mobile Security analysts have been focusing on Android malware which targets users in Russia and Eastern Europe. One of the families that caught our interest was the...
View ArticleClik here to view.
Did GCHQ illegally spy on you? Here’s how to find out
Want to know if UK intelligence agency GCHQ has been covertly spying on you? Now here’s your chance.Surveillance and privacy watchdog Privacy International has launched an initiative to help people...
View ArticleClik here to view.
Agora Marketplace CSRF to Steal Bitcoins (agorahooawayyfoe.onion)- The...
Ladies and gentlemenBoys and girlsIt come to our attention that a brave warrior for the people RossWilliam Ulbricht was unlawfully convicted by the corporation known asthe American government.This...
View ArticleClik here to view.
Crushftp 7.2.0 - Multiple CSRF & XSS Vulnerabilities
======================================================== I. Overview ======================================================== Multiple CSRF & Cross-Site Scripting (XSS) vulnerabilities have been...
View ArticleClik here to view.
Tracking down a segfault in grep
I was happily tooling around on my macbook at the command line, poking around in the MAME source code as you do, and then this happened:$ grep -f pats listing704 ./powerpc724 ./m68000872 ./i3861092...
View ArticleClik here to view.
Multiple vulnerabilities on GLPI
Multiple vulnerabilities have been identified in GLPI (http://www.glpi-project.org).1/ Arbitrary file uploadSeverity: ImportantVersions Affected===========All versions between 0.85 and...
View ArticleClik here to view.
Use-After-Free in VLC 2.1.x
tldr; I found a vulnerability in VLC while creating a training course on fuzzing. I reported it to the VLC maintainers but they declined to fix it. I contend it’s a security vulnerability. Here is the...
View ArticleClik here to view.
Reflected File Download in AOL Search Website
Oren Hafif reported a new kind of attack called Reflected File Download (https://www.blackhat.com/eu-14/briefings.html#reflected-file-download-a-new-web-attack-vector)in Black Hat Europe 2014...
View ArticleClik here to view.
More on Babar: espionage software finally found and put under the microscope...
Almost a year after Operation SNOWGLOBE was publicly mentioned for the first time by the famous French newspaper Le Monde, security experts have now laid hands on malware samples that match the...
View ArticleClik here to view.
Initially Posted A Little Less Than a Year Ago "An Exploration of ARM...
ARM TrustZone technology has been around for almost a decade. It was introduced at a time when the controversial discussion about trusted platform-modules (TPM) on x86 platforms was in full swing...
View ArticleClik here to view.
Reflecting XSS- and SQL injection-vulnerabilities in the administrative...
Advisory: Reflecting XSS- and SQL Injection vulnerability in CMS Piwigo <=v. 2.7.3Advisory ID: SROEADV-2015-06Author: Steffen RösemannAffected Software: CMS Piwigo <= v. 2.7.3 (Release date: 9th...
View ArticleClik here to view.
PHP Code Execution in jui_filter_rules Parsing Library
PHP Code Execution in jui_filter_rules Parsing Library======================================================Researcher: Timo Schmid <tschmid@ernw.de>Description===========jui_filter_rules[1] is a...
View ArticleClik here to view.
Onion.city - a search engine bringing the Dark Web into the light
The Dark Web is reflecting a little more light these days.more here......https://nakedsecurity.sophos.com/2015/02/18/onion-city-a-search-engine-bringing-the-dark-web-into-the-light/
View ArticleClik here to view.
Paper: EdgeMiner: Automatically Detecting Implicit Control Flow Transitions...
Abstract—A wealth of recent research proposes static data flow analysis for the security analysis of Android applications. One of the building blocks that these analysis systems rely upon is the...
View ArticleClik here to view.
Top Adult Site RedTube Compromised, Redirects to Malware
We’ve documented adult sites leading to malware before on this blog, but this one is a little bit different.This time around, the source of the problem is not malvertising, but rather a malicious...
View Article