pizza planet

[pizza planet @0x251e]

aHR0cHM6Ly95b3V0dWJlLmNvbS9zaG9ydHMvTkVORmhTRTUzeFU/ZmVhdHVyZT1zaGFyZWQ=

[cr3ghost @cr3ghost]

Free malware analysis, reverse engineering, threat hunting, red teaming, web hacking, and CTF content.

Live malware demos. Ransomware analysis. Real vulnerability deep dives. MFA bypass techniques. Cobalt Strike analysis. Dark web investigations. CTF walkthroughs. BurpSuite web app testing. Python and PowerShell for security. Thousands of videos.

https://t.co/49VXZiP7Rl

Author: @_JohnHammond

#MalwareAnalysis #RedTeam #BugBounty

[Panos Gkatziroulis 🦄 @ipurple]

HallWatch - User-mode detector that catches indirect syscalls. Traps Hell's Hall, Tartarus' Gate, RecycledGate, and VEH syscalls & Many more https://t.co/pPc7o9NnwP

[GitHub Projects Community @GithubProjects]

obfus.h is a macro-only library that obfuscates C code at compile time, designed for use with Tiny C (tcc) on Windows.

- Function call obfuscation and control flow code mutation
- Anti-debugging and anti-decompilation techniques built in
- Strings hidden and dynamically constructed at runtime
- Fake signatures and math virtualization for added confusion

Explore it here:
https://t.co/YJAU0aw93V

[Florian Roth ⚡️ @cyb3rops]

Update: the AUR compromise appears to be ongoing

After the initial incident affecting 1,500+ packages, another wave of malicious AUR packages has been discovered. This time the attackers reportedly used code obfuscation to better conceal the malicious behavior.

Affected packages included Node.js packages, Firefox-related packages, LibreWolf extensions, NeoVim plugins and others.

If you’re using #Arch Linux and install software from AUR, I’d review recently updated packages and keep an eye on this story.

https://t.co/4eD3Ola9DH

[Karsten Hahn @struppigel]

🦔 📹 Poison X kernel mode rootkit analysis

➡️ kernel mode driver theory
➡️ Ghidra markup
➡️ basic string deobfuscation

#MalwareAnalysisForHedgehogs
https://t.co/U9aM5XnGMT

[pizza planet @0x251e]

Linux for human beings

[toasts @t0asts]

DIE-Web now comes with certificate parsing and overlay support!

https://t.co/HOVugClpHI
https://t.co/OElTm9JrpE

[ThePrimeagen @ThePrimeagen]

Just don't update..

Also you have to update because of security?

[pizza planet @0x251e]

Arch AUR infected check script
https://t.co/lHKjeESAo8
https://t.co/Br60WDXgAo

[Pirat_Nation 🔴 @Pirat_Nation]

More than 400 packages in the Arch User Repository (AUR) have been found to contain malware in a major supply chain attack.

According to security researchers at Sonatype, attackers took over abandoned AUR packages by posing as trusted maintainers.
They modified the packages to download a malicious npm dependency called atomic-lockfile, which contained code designed to steal information and maintain access to infected systems.

Arch Linux’s official repositories were not affected. The attack impacted only the AUR, a community-maintained collection of package build scripts.

Arch maintainers have removed the malicious packages and blocked the accounts involved. The number of affected packages grew to more than 400 before the campaign was discovered.

Sources: Sonatype researchers and Arch Linux community reports.

[OS Dev @OSdev_]

In windows, APCs(Asynchronous procedure calls) is a mechanism in which a function executes in the context of the specific thread. It's not an independent execution entity like a thread.

void CALLBACK MyCompletionRoutine(...)
{
printf("Read completed!\n");
}

ReadFileEx(..., MyCompletionRoutine); //Async I/O

// Later
SleepEx(INFINITE, TRUE); // Alertable wait

Here, the completion routine runs even before SleepEx returns.

Thread
|
|-- ReadFileEx()
|
|-- SleepEx(INFINITE, TRUE)
| (alertable wait)
|
|<-- I/O completes
|<-- Windows queues User APC
|
|-- MyCompletionRoutine() <-- APC executes
|
|-- SleepEx returns WAIT_IO_COMPLETION
|
|-- Continue execution

That's how the below sequence is possible if you have proper rights to open the process handle to suspend. Btw security software can easily catch this because you're suspending a process and allocating memory etc.

[pizza planet @0x251e]

Koyak

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: More than 400 Arch Linux User Repository packages have been compromised with infostealer malware and a rootkit.

Attacker posed as a trusted maintainer and "adopted" orphaned packages.

Arch maintainers are purging infected packages now. Audit your AUR installs.

[Bjoern Kerler @viperbjk]

Oh boy, it's been a while. Now with AI all the exploiteers are half-a-sleep as AI is doing all the work. But wait ! Here's some food for your brain:
https://t.co/LKIPVCo2Op
I've added a bit more vulnerabilities (29 in total). Have fun !

[OS Dev @OSdev_]

This is best channel for windows Internals by @zodiacon

He's one of the authors of the iconic windows Internals books.

https://t.co/ROndpC8Oue

[Foxy @3ch0W15p]

Anyone ada come across this email?
👉🏻👈🏻

[sysxplore @sysxplore]

Quick Linux tip:

Most people use tree to visualize a directory structure.

What many don't know is that it can also display file permissions, owners, groups, and sizes.

$ tree -pugh -L 3

Here is what each option mean:

-p - file permissions
-u - owner
-g - group
-h - human-readable sizes
-L - limit the depth of the directory tree

This is especially useful when auditing file permissions, troubleshooting access issues, or documenting a project's directory structure.

[Uriel Kosayev @UrielKosayev]

I pulled a random sample from MalwareBazaar last week and it turned out to be a WannaCry dropper with a trick I have seen in several post-2017 variants: garbage bytes prepended before the MZ header.

CFF Explorer, Detect It Easy, and most sandbox parsers silently fail when the file does not start at offset 0 with MZ. Trim the bytes in HxD and everything loads fine.

Inside: a three-layer nested dropper chain using FindResource, LoadResource, WriteFile, and CreateProcess.

The final payload is a 32-bit PE with an encrypted ZIP in the resource section. The classic WannaCry structure with the original hardcoded password still intact.

What struck me most: VirusTotal behavioral telemetry was sparse.

Low TTP coverage from sandboxes is not a clean bill of health. It is a sign the sample is evading behavioral inspection.

Full static analysis walkthrough, including the IDA Pro dropping function analysis:

https://t.co/rK3Rp1bHGF

#CyberSecurity #MalwareAnalysis #ReverseEngineering #DFIR

[BijanBowen @bijanbowen]

Had Claude Fable 5 log network packets and display them as cars on a highway, different car types = different packet types

[Co11ateral @co11ateral]

Hackers can abuse PAM to log SSH credentials in plaintext by modifying authentication modules. Helpful for lateral movement. There are many ways of doing it, but it often comes down to changes in /etc/pam.d/ and /lib/security/

It's a good idea to monitor unauthorized changes in these directories

https://t.co/g6C7mjnR5W

@three_cube @_aircorridor
#dfir #pentesting

[_SiCk @encrypted_past]

This is kinda dope https://t.co/BrBkjQwOE3

@wesmarpl