Justin Lentz

Experienced thrunter and detectioneer; amateur abbreviator. May the forensic data be with you and show you the answers.

[Justin Lentz @CrimEvader]

The scope of the vulnerabilities is unknown as to if it affects SaaS versions of the product, but we can confirm that CVE-2024-57968 had a temporary fix released for on-prem customers of VeraCore to apply, removing the upload feature from the application.

[Justin Lentz @CrimEvader]

Checkout the latest research collab between @solissecurity and @IntezerLabs' own @NicoleFishi19 where we identified a shift in techniques utilized by XE Group and the discovery of two 0-day vulnerabilities that have been exploited for at least 4 years.
https://t.co/Tf1YKjpJBa

[Justin Lentz @CrimEvader]

Over 4 year timespan, the actor maintained persistence, even updating the web shells deployed and further stealing data and attempting to deploy Meterpreter on the server.

[Nicole @NicoleFishi19]

[1/] In joint research with @crimevader from @Solis Security, we uncovered two zero-day exploits in the VeraCore application actively used by XE Group: an Upload Validation Bypass and an SQL Injection flaw.

[Germán Fernández @1ZRR4H]

⚠️ En este momento, 3 anuncios activos en @GoogleAds conducen a sitio fraudulento que suplanta a @CryptoMKT en Chile 🇨🇱

Además, me doy cuenta que los anunciantes ni siquiera deben estar verificados para publicar anuncios maliciosos en Google 👎 (+ https://t.co/MklUQ3n36z).

Redirectores:
https://portifoliocrypt[.]xyz
https://escritorio-2viaenergia[.]lpages[.]co
https://karteraamkt[.]shop

URL #phishing:
https://cryptos[.]mkte[.]za[.]com/app/login

Otro dominio relacionado:
mydomains[.]click

H/T @hall9000C

[Laughing Legends @LaughingLegend0]

@ScottPresler Meet the next Secretary Of Health And Human Services, Robert F. Kennedy Jr:

[Justin Lentz @CrimEvader]

@america 1911. 8 U.S.C. 1325 -- Unlawful Entry, Failure To Depart, Fleeing Immigration Checkpoints, Marriage Fraud, Commercial Enterprise Fraud

[Joey Yochheim @joeyyochheim]

You’ve been lied to.

The American Health system wants you obese.

Debunking 15 nutrition myths they taught you in school:

1. Myth: Eggs Raise Your Cholesterol

[Florian Roth ⚡️ @cyb3rops]

What people often overlook in #DetectionEngineering is that there’s no "one-size-fits-all" rule to detect a threat. It depends on your goals.

How specific should the rule be? Are you tracking a threat actor, detecting the tool/malware, or focusing on the technique? Should it be based on code, content, form, or metadata?

Just like in art, you can create an abstract, impressionist, or realistic painting of the same subject, and all can be masterpieces in their own right

[Ian Carroll @iangcarroll]

In April, @samwcyo and I discovered a way to bypass airport security via SQL injection in a database of crewmembers. Unfortunately, DHS ghosted us after we disclosed the issue, and the TSA attempted to cover up what we found.

Here is our writeup:
https://t.co/g9orwwgoxt

[Karli Bonne’ 🇺🇸 @KarluskaP]

WOW

[BlackRoomSec @blackroomsec]

Please share this far and wide. As far and wide as you can. NIST Password Guidelines for 2024 are in the process of being updated.

This is a HUGE pet-peeve of mine (when vendors in particular are still operating like its 2017 and keep changing passwords every 60 days, STOP DOING THIS, it's outdated and has been shown to put you MORE at risk than less -- NIST explains why it does in this document, meticulously outlining user behavior**) so I'm sharing this in the hopes all of you will pass it along to your bosses.

The Special Publication series governing passwords is SP 800-63 "Digital Identity Guidelines".

The 2024 version is 800-63-4.

Here: https://t.co/oX8YEJHxXg

The companion docs are also on that link. They are 800-63A, 800-63B and 800-63C. These are different documents for different scenarios in play at your org.

The previous update was in2020.

The changes in the 2020 version from the 2017 version were numerous but one of them was that the password verification method should NO LONGER require passwords be changed at specific intervals (i.e. every 60 days) but in the following circumstances instead:

1. After a breach/compromise
2. User request

2024 repeats this and adds a bunch more guidlines but here is a screenshot of page 13 of the new 800-63-4 (note the # 4 after it) which outlines how your systems should now and moving forward, be handling passwords.

This goes for Active Directory, too. All your systems which have passwords should align with these guidelines provided there isn't another standard or framework you must adhere to which overrules this.

Most frameworks, however, have moved away from arbitrary password resets and complexity rules.

**We cybersec researchers and hackers use wordlists from breaches in a variety of different ways. Hackers use them in tooling to crack passwords whereas researchers use breach dumps to see the kinds of passwords users are creating and the psychology behind them.

Using complexity rules gets you the user psychology of:

Password1
Password2
and so on

Use phrasing instead and allow for spaces, which is important. Humans type phrases with spaces. They also mention phish-resistant methods and most vendors are on-board with MS going to be turning off all Legacy Auth next month, across all free accounts and tenancies.

I'm so excited for the new changes!

Ok I'm off my soapbox.

Share the love! Thank you!

[The Haag™ @M_haggis]

🚨 LOLRMM Day 1 and 2 update 🚨

🔥 Spec created. Everything validates against it.
🔥 328~ RMM YAML's. Filled with artifacts.
We're still working to clean a few things up - dupes, incorrect items added. We're going to need the most ❤️ here from the community.
🔥CSV, JSON API Routes
🔥 @streamlit App is now complete - matching spec, built in validation, create new, review current, update and ship. We will publish when things are final.
🔥 Site is now generating. 😱 Find your favorite RMM, click through fancy pages.

Massive thanks to @_josehelps , @nas_bench , @Kostastsale for jumping in this weekend to push a fresh project out. Also much much Thank You to all those who reached out with RMM lists and artifacts. We will ship a blog when things are done and reference you all!

Teasers:

[Justin Lentz @CrimEvader]

@Kostastsale It was dropping already prior to today. Icing on the cake, too early to buy.

[Justin Lentz @CrimEvader]

@cyb3rops You forgot ransom note/threat actor extortion emails/calls

[Justin Lentz @CrimEvader]

Has Microsoft never heard of infostealers?

[Justin Lentz @CrimEvader]

@GossiTheDog @TheTrentHarvey So many people don't understand how encryption works. Considering most encryption used in practice by Microsoft or browsers to protect databases use a method with known decryption method. No confidentiality is being achieved.