Fabricio

[John @atucom]

I updated my post with a simple python command runner for the Apache Struts 2 exploit CVE-2018-11776: https://t.co/NBbSDhXlhq

[Malwrologist @DissectMalware]

Got really excited during "Protecting the Protector, Hardening Machine Learning Defenses Against Adversarial Attacks" talk at #BH 2018, when I saw familiar stuff...
cc: @nullcookies @James_inthe_box @JRoosen @pollo290987

[Today In Infosec @todayininfosec]

2003: The Nachi worm began infecting Windows computers to remove the Blaster worm and patch the vulnerability exploited by both. Yes, this happened. Got to love it!

[CloakCoin Brasil @Cloak_Brasil]

🇧🇷🇵🇹Com #Cloakcoin vc recebe sempre uma renda de 6% sobre seu capital como incentivo para securizar a rede e até 1% das transações anonimas que vc ajuda a ofuscar. Qualquer carteira pode ser um nó de #privacidade.
#Criptomoedas #blockchain #criptoativos #liberdade

[Malwrologist @DissectMalware]

#linux #bash #obfuscation #technique #string
#bashfuscation using array and for loop in bash

* Similar approach is used by #malware instances to obfuscate #bat scripts (using #dosobfuscation by @danielhbohannon ?)

https://t.co/XN3VkeTQBR

[Vee @Po1Zon_P1x13]

Last workday before Defcon! Overwhelmed is an understatement

[Today In Infosec @todayininfosec]

1998: The Cult of the Dead Cow debuted the program Back Orifice at DEF CON 6. It was written by Sir Dystic.

[nullcookies @nullcookies]

Revised: Intrusive Apple ID phish attempts to fly under the radar with AES 256 and one-time session IDs. Sent via text message. HT @bry_campbell for the URL. hxxp://apple.id.auth-team.com

[David Ledbetter @Ledtech3]

Finally worked out the last bug in my decoder for this sample that @DidierStevens did the video on here https://t.co/G85ET5AuqE for this "type" of Invoke-DOSfuscation

[Binni Shah @binitamshah]

Evilginx 2 - Next Generation of Phishing 2FA Tokens : https://t.co/eL9uBKMt74 ,evilginx2 : Standalone MITM attack framework used for phishing login credentials along with session cookies, alowing to bypass 2-factor authentication : https://t.co/g5kiJtcpub

[Emad Shanab - أبو عبد الله @Alra3ees]

Bug Bounty Hunter Methodology by @Jhaddix @Bugcrowd

[M @mcmc231c]

Great slide from @aprilwensel showing how we should shift the stereotypical tech culture to be more positive.

[Fabio Assolini @assolini]

Cibercriminosos brasileiros fazem de tudo para roubar sua conta bancária, usam inclusive extensões maliciosas no Google Chrome, hospedadas na loja oficial. Algumas delas são bastante engenhosas https://t.co/DydhwaXZXt

[nullcookies @nullcookies]

Login panel hidden in fake 404 Not Found. Posting again because these are easy to overlook and becoming commonplace.

Lesson: Hiding in plain sight is sometimes the best camouflage. Consider where you'd hide a login panel.

URL: hxxp://www.jeremoabofm.com.br/promocao/bc0de.php

[Omri Segev Moyal @GelosSnake]

This potential #Carbanak code is very well documented. Example from the lateral movement section.

[Fernando - Código Falado @CodigoFalado]

Notícia: "Livro digital não decola no Brasil"
Especialistas não conseguem entender o motivo. Talvez seja preciso encomendar um estudo caro e demorado para descobrir as razões por trás disso, né?

[CyberWar Books @CyberToolsBooks]

#Cyberwar #Anonymous Sneakers https://t.co/pJvMz8gqH4

[Parisa Tabriz @laparisa]

coconut milk + pineapple + mango chunks = mission accomplished 🍍🌴

[Paula Grangeiro @paulagrangeiro]

Lula contribuiu com 21 projetos open source em 57 dias de prisão.

Se cada projeto tem 14259 linhas, seriam mais de 5200 linhas por dia. Ele teria que codar no mínimo 656 linhas/hora em 8hrs.

Todo mundo que ao menos contribuiu com um projeto sabe que isto é irreal. Apenas parem.

[Ayub | Internet propriamente dita @ayubio]

Na internet da Idade da Pedra, packet loss era um problema muito comum. https://t.co/IbwoH3Y8b1