Had a great talk on #redteam yesterday. A new experience talking to our own selves but as per the discord reviews, people loved it :)
Its still live on youtube (not for long) if you want to have a look at.
Thanks @hackinthebox for the platform as always.
https://t.co/dUvWuooy3W
Last year, @Raspberry_Pi hired us to test the security of the RP2350 - and using electro-magnetic fault-injection we were able to successfully bypass the OTP security measures!
This allowed us to read and modify the OTP locks, essentially bypassing the RP2350 secure-boot.
Chandrayaan-3 Mission:
'India🇮🇳,
I reached my destination
and you too!'
: Chandrayaan-3
Chandrayaan-3 has successfully
soft-landed on the moon 🌖!.
Congratulations, India🇮🇳!
#Chandrayaan_3#Ch3
Just recreated this awesome @SpecterOps (@zyn3rgy, @0xthirteen) technique for initial access by #backdooring a random #ClickOnce application with a Cobalt Strike stager. While I became a ClickOnce addict🙃, compiled a short writeup about my journey: https://t.co/nOerSwV8r1
RE: The 3CX VOIP supply chain attack, vendors have stated that macOS was also targeted - but I couldn't find any specific technical details (yet) 🍎🐛☠️
One vendor stated, "we cannot confirm that the Mac installer is similarly trojanized"
...let's dive in! 1/n 🧵
Played with Outlook CVE-2023-23397. Made a simple PoC email builder & sender featuring malicious reminder (just a Msg, no need to use a Task or Cal. Ev.).
Critical 0-click account takeover on internal networks even after MS patch, no need to open the message on the victim side.
Five hours ago, an attacker stole 2 million BNB (~$566M USD) from the Binance Bridge. During that time, I've been working closely with multiple parties to triage and resolve this issue. Here's how it all went down.
CVE-2022-26923 ("Certifried") combined with KrbRelayUp: domain user to domain admin without the requirement for adding/owning previously a computer account. Step-by-step write-up of the attack in a pure Windows environment: https://t.co/0Vnp4NpTEo
⚠️ In macOS 12 (beta 6), Apple patched an intriguing flaw. Discovered by Gordon Long (@ethicalhax), CVE-2021-30853 allowed attackers to bypass:
▫️Gatekeeper
▫️Notarization
▫️File Quarantine
Interested in exactly how?
Read: "Where's the Interpreter!?"
https://t.co/N3aZhkSW0L
@zapstiko@0xmahmoudJo0@shodanhq That sqli payload is incorrect. It will throw an erro. (given that one still finds this in reality on a paid target) Should be:
admin' or 1=1--
Or
admin' or '1'='1