August 19, 2022
I highly recommend this write up of a cool bug.
At #Pwn2Own Vancouver, @_manfp won $100K exploiting #Firefox. Now that these bugs are patched, @hosselot details the first part of this exploit in his most recent blog. Part 2 is to come. zerodayinitiative.com/blog/2022/8/17…
-
Following the removal of a Soviet monument, Estonia was subjected to a "cyberattack" (DDoS). Non-event, with no impact. Little reason to overhype it. I would even question reporting it, at all. Mostly an indented Russian/Killnet information operation.
-
*Ransomware is decentralized crime. An affiliate can be in multiple ransomware groups or operate independently. This is why TTP's overlap so heavily and skillset varies so greatly.
*Ransomware groups employ more than "Red Teamers" and "Pentesters".
Here is an ugly picture: 
-
I keep thinking about @vxunderground's tweet about how we've built a shrine to the Russian government for marketing purposes.
-
-
This is amazing. In 2009 someone showed how yelling at disk drives causes I/O problems, and then over a decade later someone else got a CVE with the same technique. Move over ROWHAMMER — there’s a new, and significantly less useful, trick in town!
CVE-2022-38392
A 5400 RPM OEM hard drive, shipped in approximately 2005, allows physically proximate attackers to cause a denial of service (device malfunction and system crash) via a resonant-frequency attack with the audio signal from the Rhythm Nation music video.
-
Find out what we were up to in Q2 to help protect @googlechrome users:
link:
https://www.chromium.org/Home/chromium-security/quarterly-updates/-
In 2020 I predicted "we may be under-estimating the volume of future [HTTP(S)] attacks" and recommended over-provisioning accordingly: cloud.google.com/blog/products/… 1/3
See that red dot with 623 Gbps? That’s Mirai.
-
@RoryCormac on how public perception shape covert operations:
-
The latest drama in infosec.
NEW: In February DEF CON permanently banned social engineering trainer Chris Hadnagy after "multiple code of conduct violation reports." Now he's suing the conference and founder Jeff Moss for defamation. theverge.com/2022/8/18/2331… #DEFCON
-
ASML is the most important company you've never heard of.
The $220B Dutch firm makes the machines that make semiconductors. Each one costs $150m and access to them are a huge geopolitical flashpoint.
Here's a breakdown 🧵
-
Dropping some 🔥APT29 observables this afternoon. Updates to our AADInvestigator and white paper too!
mandiant.com/resources/apt2… APT29 continues to up their opsec game 🥷 targeting #Microsoft365 #DFIR
-
I forgot to tweet out my last video on finding bugs in CPUs 😱
It’s one of my all time favorite videos and I’m very proud of it! A lot of effort went into researching and making the video.
Thanks again @sirmc and @IntelSecurity for making it happen 🥰
youtube.com/watch?v=x_R1De…
-
Now that embargo has been lifted on CVE-2022-30221, additional information has been added to "Fuzzing RDPEGFX with wtf" abstract.
➡️ hexacon.fr/conference/spe…
➡️ msrc.microsoft.com/update-guide/e…
Hexacon @hexacon_fr
-
Being over 40 means these are robots I can relate to. Especially the one that blew out its knee, farted, and fell on its face.
-
From file overwrite with uncontrolled content to root shell 🏴
How to elevate Linux privileges to root when it's only possible to overwrite files with uncontrolled content?
I found a cool trick to do exactly that during our GCP PostgreSQL research we presented at Black Hat 🧵
-
The recent flurry of PPAM-related comments from @d_olex on that @binarly_io presentation pushed me to dig deeper into "PPAM" as a technology and a term. It seems I now understand the positions of both parties, and they are both valid in their own right.🧵
binarly.io/posts/Black_Ha…
-
-
An Experiment Showed that the Military Must Change Its Cybersecurity Approach
Big controversial ideas brewing over in DoD. It seems some people are advocating this thing called “red teaming,” where networks are attacked to find vulnerabilities. Sounds wild to me, but let me know what do you guys think? Sound off in the comments…
https://www.nextgov.com/cybersecurity/2022/08/experiment-showed-military-must-change-its-cybersecurity-approach/376003/-
Quite a nicely execute phishing scam. Abuse a compromised PayPal account to send fake invoices to people and include a number for them to call and complain. The operator then walks them through the typical call centre mediated scam
https://krebsonsecurity.com/2022/08/paypal-phishing-scam-uses-invoices-sent-via-paypal/
Don't miss what's next. Subscribe to the grugq's newsletter: