March 10, 2023
So I've been just been briefed on a very disturbing trend of events that I think everyone should know.
Ransomware attackers have been targeting legal firms quite heavily in the last 6 months or so.
I thought this was because pretty poor security, but there's much more.
A đ§”
-
DOJ trying to make it seem sus that people are using âencrypted messaging that canât be read by the governmentâ â WhatsApp. Some good points about how the real concern is actually the pattern of behaviour.
If you use email for years, then right before the crime youâre accused of you use an encrypted messenger, that looks really bad. Lesson learned: always use the strong protection. Make secret secure communications the default and then nothing will stand out as unusual. The old âalways use pgp so when you need it it blends inâ argument. But now with extra legal justification.
https://grandjurytarget.com/2023/02/28/its-not-what-you-say-its-how-you-say-it-encrypted-messaging-as-a-doj-weapon/-
"Our data show no significant change compared to our 2021âs âYear in reviewâ report. The tactics, techniques and procedures have mostly stayed the same as the motivations behind the attacks drive the resulting outcomes."-
The new report from @TheDFIRReport is here! đș
Great content for both #threat hunters who are looking for something to hunt (đș)or #redteam who want to better represent threat actors.
thedfirreport.com/2023/03/06/202âŠ
https://thedfirreport.com/2023/03/06/2022-year-in-review/
@FuzzySec Shout out to
@yarden_shafir who developed the I/ORing primitive we used to obtain arbitrary kernel RW. To our knowledge, this is the first time the primitive has been used in a (public) exploit@FuzzySec Shout out to
@yarden_shafir who developed the I/ORing primitive we used to obtain arbitrary kernel RW. To our knowledge, this is the first time the primitive has been used in a (public) exploit
-
An in-depth look at the history and culture of 8200. Very interesting.
https://css.ethz.ch/content/dam/ethz/special-interest/gess/cis/center-for-securities-studies/pdfs/Cyber-Reports-2019-12-Unit-8200.pdf-
-
Thanks to @chompie1337 and @FuzzySec for sharing
such a good use caseïŒWe caught an in-the-wild sample of afd.sys not long ago, it is different from this exploit, it uses the system mechanism and vulnerability features to achieve privilege escalation
chompie @chompie1337
-
Thanks to @chompie1337 and @FuzzySec for sharing
such a good use caseïŒWe caught an in-the-wild sample of afd.sys not long ago, it is different from this exploit, it uses the system mechanism and vulnerability features to achieve privilege escalation
chompie @chompie1337
-
Fresh đ„ coming out of @Mandiant. New two-part blog post on recent a recent campaign from suspected DPRK espionage actor #UNC2970. mandiant.com/resources/blogâŠ
-
// by @mahal0z mahaloz.re/2023/02/25/pwn⊠The bug: _isoc99_sscanf(result + 12, "%255[^\r\n]", v8); sprintf(v9, "pudil -i %s \"%s\"", a4, (const char *)v8); return (char *)system(v9);-
-
Don't miss what's next. Subscribe to the grugq's newsletter: