Clik here to view.
PEMU: A PIN Highly Compatible Out-of-VM Dynamic Binary Instrumentation...
You can view this new open source DBI frameworkby clicking on this following link here.........https://github.com/utds3lab/pemuand read the papar with abstract provided below...
View ArticleClik here to view.
Multiple reflecting/stored XSS- and SQLi-vulnerabilities in openEMR v.4.2.0
Advisory: Multiple reflecting/stored XSS- and SQLi-vulnerabilities inopenEMR v.4.2.0Advisory ID: SROEADV-2015-08Author: Steffen RösemannAffected Software: openEMR v.4.2.0 (Release-date: 28th Dec...
View ArticleClik here to view.
Reverse Engineering Android Part 1(Smali Intro)
In my recent studies in reverse engineering android apps I have taken to learning the smali assembler/disassembler. It is my opinion that smali is a powerful tool and learning its syntax and usage...
View ArticleClik here to view.
Is your VirtualBox reading your E-Mail? The Palinopsia Bug: Recovering...
html version with images available here: https://hsmr.cc/palinopsia# The Palinopsia Bug## Is your VirtualBox reading your E-Mail? Reconstruction ofFrameBuffers from VRAMThis document describes a method...
View ArticleClik here to view.
OpenSSL DoS tester now available (CVE-2015-0291)
Vendors/organizations interested in diagnosing exposure of theirOpenSSL-based services to the recently-disclosed sigalgs Dosvulnerability (CVE-2015-0291) can use mancha's clientnullo tester [1] andread...
View ArticleClik here to view.
Paper: A look at the PGP ecosystem through the key server data
Abstract: PGP-based encryption systems use a network of key servers to share public keys. These key server operate on an add only basis, thus the data gives us access to PGP public keys from over 20...
View ArticleClik here to view.
rdtsc x86 instruction to detect virtual machines
We are going to look at rdtsc instruction technique, and how it is used to detect VMs here.....http://blog.badtrace.com/post/rdtsc-x86-instruction-to-detect-vms/
View ArticleClik here to view.
Phishing and the .gov TLD
Brand owners frequently use SPF and DKIM to protect their brands from email forgery. For example, a brand owner could register the same domain name under multiple top-level domains (TLDs) (such as...
View ArticleClik here to view.
Automating WPA/WPA2 cracking with Raspberry Pi
The idea was to automate both WPA / WPA2 handshake capture and preshared key cracking (ideally on a high-end GPU or even multiple GPUs). There were a few restrictions: (1) the device should be portable...
View ArticleClik here to view.
Paper: On the Effectiveness of Full-ASLR on 64-bit Linux
ABSTRACTAddress-Space Layout Randomization (ASLR) is a techniqueused to thwart attacks which relies on knowing thelocation of the target code or data. The effectiveness ofASLR hinges on the entirety of...
View ArticleClik here to view.
Tails 1.3.1 Released
Tails security/privacy/anonymity focused Debian-based Linux distribution has just released version 1.3.1 here......https://tails.boum.org/download/index.en.html
View ArticleClik here to view.
Dell System Detect RCE vulnerability
I recently discovered a serious flaw with Dell System Detect that allowed an attacker to trigger the program to download and execute an arbitrary file without any user interaction. Below is a summary...
View ArticleClik here to view.
Data Obfuscation: Now you see me... Now you don't...
This blog post shows how malware authors use Adobe Flash files to hide their creations' 'sensitive' data. I'll be using 2 recent Neutrino EK and 1 FlashPack malvertising samples to demonstrate it. In...
View ArticleClik here to view.
BitWhisper: The Heat is on the Air-Gap
Researcher Mordechai Guri, guided by Prof. Yuval Elovici, has uncovered a new method to breach air-gapped systems. Our last finding on air-gap security was published in August of 2014, using a method...
View ArticleClik here to view.
Johnson Controls Metasys Vulnerabilities – Part I
Last week, ICS-CERT released an advisory on a set of Johnson Control MetaSys vulnerabilities I reported. You can find the advisory here: https://ics-cert.us-cert.gov/advisories/ICSA-14-350-02It’s...
View ArticleClik here to view.
How I hacked India’s biggest startup
A few weeks ago I was monitoring my phone traffic from a proxy server. While doing that I saw Ola API calls going from my phone (since I was booking a cab).For those who don’t know about Ola, Ola Cabs...
View ArticleClik here to view.
"A CONFEDERACY OF 'PRIVACY' DUNCES": WHAT WE FOUND UNDER THE HOOD OF...
Everyday we hear about a newfangled mobile app or "Internet Of Things" (IoT) device. Kickstarter and IndyGoGo are rife with IoT ridiculousness. (Crowdfunding is the new "Skymall" after all.) Mobile...
View ArticleClik here to view.
Announcing the new version of SecureDrop, with the results from our third...
Today, we’re announcing the latest major release of SecureDrop, our open-source whistleblower submission system. SecureDrop 0.3 uses the same basic architecture found in 0.2, but contains numerous...
View ArticleClik here to view.
Important Notice About Your Twitch Account
There may have been unauthorized access to some Twitch user account informationmre here..........http://blog.twitch.tv/2015/03/important-notice-about-your-twitch-account/
View ArticleClik here to view.
Unauthorized digital certificates for several Google domains
On Friday, March 20th, we became aware of unauthorized digital certificates for several Google domains. The certificates were issued by an intermediate certificate authority apparently held by a...
View Article