0Day-Cybersecurity

Post about Cybersec (vulns, technics, tools, etc), Sharing is caring! Offering cyber security services. 📍France/Vietnam

[GrapheneOS @GrapheneOS]

We're happy to announce a long-term partnership with Motorola. We're collaborating on future devices meeting our privacy and security standards with official GrapheneOS support.

https://t.co/8flkjD52Eg

[Dark Web Informer @DarkWebInformer]

You can find the full Nightmare Eclipse exploits located here:

https://git[.]churchofmalware[.]org/Nightmare_Eclipse/

[Christopher | 🇺🇦  @d4rkshell]

Microsoft has banned Nightmare Eclipse from GitHub: https://t.co/EmeiJnJ0Ps

This is the researcher who disclosed several zero-days after Microsoft also deleted their MSRC account.

They have now moved on to GitLab: https://t.co/Npj0gplSum

(h/t to: @[email protected])

[vx-underground @vxunderground]

Another Windows zero day released by Nightmare Eclipse (sort of)

It turns out Microsoft just straight up didn't patch an old CVE from 2020 correctly.

https://t.co/sNWBtTo4at

[International Cyber Digest @IntCyberDigest]

THEY ARE GOING TO BAN VPNs
THEY ARE GOING TO BAN VPNs
THEY ARE GOING TO BAN VPNs
THEY ARE GOING TO BAN VPNs
THEY ARE GOING TO BAN VPNs
THEY ARE GOING TO BAN VPNs
THEY ARE GOING TO BAN VPNs
THEY ARE GOING TO BAN VPNs
THEY ARE GOING TO BAN VPNs
THEY ARE GOING TO BAN VPNs

[312 -🛡️ 🔑 📡 @Lab312_]

🚨 @GrapheneOS ÉCRASE 3 NOUVELLES FAILLES LINUX CRITIQUES 🔥

Copy Fail, Copy Fail 2 et Dirty Frag?
Trois vulnérabilités kernel Linux fraîchement dévoilées… et GrapheneOS les ignore totalement.

✅Les politiques SELinux d’AOSP bloquent l’exploitation des 3 bugs à la racine.
✅La config GKI standard d’AOSP désactive déjà 2 des 3 fonctionnalités vulnérables.

C’est pas de la chance, c’est du travail de dingue: réduction massive de la surface d’attaque grâce à un SELinux ultra-granulaire + suppression chirurgicale des features inutiles dans le kernel.

GrapheneOS va encore plus loin :

• ioctl autorisés au cas par cas
•user namespaces et io_uring totalement interdits aux apps ET à presque tout le système
•seccomp-bpf en renfort

Résultat ? Ces failles logiques mémoire qui auraient pu tout casser sur n’importe quel autre Android… sont mortes dans l’œuf sur GrapheneOS.

➡️Oui, les élévations de privilèges kernel Linux restent hyper fréquentes.
➡️Oui, la plupart sont des corruptions mémoire (matraquées avec memory tagging hardware + zero-on-free).
Mais même sur ces bugs “logiques”, l’approche de GrapheneOS fait toute la différence.

Linux, c’est un océan de code qui tourne en full privilege sans aucune isolation. Dans un microkernel, ces 3 failles auraient été isolées dans des processus séparés. Le modèle monolithique est clairement à bout de souffle.

La vraie solution à long terme ?
Un langage memory-safe + virtualisation hardware qui progresse à vitesse grand V sur les smartphones. GrapheneOS prépare déjà le terrain.

On peut encore durcir énormément le kernel Linux… mais il est clair qu’il faudra le remplacer un jour.

𝐆𝐫𝐚𝐩𝐡𝐞𝐧𝐞𝐎𝐒 𝐧’𝐚𝐭𝐭𝐞𝐧𝐝 𝐩𝐚𝐬 𝐪𝐮𝐞 𝐥𝐚 𝐩𝐫𝐨𝐜𝐡𝐚𝐢𝐧𝐞 𝐟𝐚𝐢𝐥𝐥𝐞 𝐚𝐫𝐫𝐢𝐯𝐞.
𝐈𝐥 𝐜𝐨𝐧𝐬𝐭𝐫𝐮𝐢𝐭 𝐥’𝐚𝐯𝐞𝐧𝐢𝐫 𝐝𝐞 𝐥𝐚 𝐬𝐞́𝐜𝐮𝐫𝐢𝐭𝐞́ 𝐦𝐨𝐛𝐢𝐥𝐞.
𝐀𝐮𝐣𝐨𝐮𝐫𝐝’𝐡𝐮𝐢.

🔒🛡️💪🏼

#GrapheneOS #AndroidSecurity #LinuxKernel #PrivacyMatters

[International Cyber Digest @IntCyberDigest]

‼️🚨 Microsoft calls this "intended behaviour," so here we go.

How to dump the credentials of every user stored in Microsoft Edge:

1. Open Edge. Don't browse anywhere, just open it.
2. Flip to Task Manager, find Edge, expand the task.
3. Highlight the "browser" sub-task, right-click, and choose "Create Memory Dump."
4. Open the dump file and look for credentials.

The logged-in Windows user can dump every stored Edge credential with no additional rights. Which means any malware that user executes has those credentials for the asking.

Thanks to Rob VandenBrink at SANS: https://t.co/ebtVZxne4L

[impulsive @weezerOSINT]

Windows defender has been compromised.
right now there is a public unpatched exploit that gives any app on your windows PC full system admin access. no password. no popup. nothing

your antivirus doesnt stop it. your antivirus IS the exploit. windows defender is the attack vector

ransomware gangs can use this to encrypt your entire machine and steal every saved password, browser session, and discord token you have. fully patched windows 11. real time protection on

thread

[Abdelhamid Naceri @MSNightmare2000]

Publicly disclosing the bluehammer exploit, at the time of writing this, this vulnerability is still unpatched.
Full PoC source can be found here -
https://t.co/yk80ylIfBV

[Chaofan Shou @shoucccc]

Claude code source code has been leaked via a map file in their npm registry!

Code: https://t.co/jBiMoOzt8G

[vx-underground @vxunderground]

Dawg, I'm going to bed and someone shoots a fucking nuclear missile into the internet

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[GrapheneOS @GrapheneOS]

GrapheneOS will remain usable by anyone around the world without requiring personal information, identification or an account. GrapheneOS and our services will remain available internationally. If GrapheneOS devices can't be sold in a region due to their regulations, so be it.

[sui @birdabo]

🚨counter-surveillance used to cost
thousands. now it’s $20 in your pocket.

someone built an open source device that detects when feds are spying on your phone.

> it’s called rayhunter, a project by EFF.

feds use a tech called stingrays, a fake cell towers use to track EXACT location and has the ability intercept your calls.

> rayhunter detects them in real time and alerts you almost instantly, zero delay.

you simply buy a cheap hotspot, flash it with open-source software, carry it in your pocket and voila. portable counter-surveillance.

this used to cost thousands and requires expert knowledge but not anymore.

[0Day-Cybersecurity @0DayCyberSec]

Breaking down C2 payload internals and building an evasive reflective loader that bypasses a top EDR covering module overloading, NtContinue, call stack spoofing, sleep masking, and Crystal Palace YARA removal.
Nice article!

https://t.co/qnIjQ841Fq

[0Day-Cybersecurity @0DayCyberSec]

@Mathysantoinet1 DM to see if we can advise or help you out

[0Day-Cybersecurity @0DayCyberSec]

Thanks to @TraceLabs for organising the Search party CTF on Saturday.
A collaborative OSINT event dedicated to collecting and structuring open-source intelligence in missing persons cases.
See you next time!
#OSINT #SearchPartyCTF

[Bitshadow @fbgwls245]

The new Lapsus$ clearnet site is OPEN

using cloudflare
lapsus[.]cz

[0Day-Cybersecurity @0DayCyberSec]

Awesome work!

[SpecterOps @SpecterOps]

Every Entra ID assessment ends here: “How do I get a token without triggering Conditional Access controls?” 🤔

@rbnroot built CAPSlock, an offline ROADrecon-based Conditional Access engine that simulates sign-ins & flags gaps without touching the tenant. https://t.co/MRogABIkL2

[Haakon Wibe @HaakonWibe]

Look.. it's a Conditional Access policy simulator built by an infra architect guy who got tired of squinting at What If results 🫠 Shiny graphs yay! 🔗https://t.co/hqKKVDnBFV No sign-in needed, click Sample Data and play around. Or connect to your own data - all's in browser.