Excellent writeup on Windows kernel vulnerable drivers and how to identify them
Takahiro Haruyama (@VMware)
https://t.co/PnIAH0b5wN
#cybersecurity#Windows
Just published our (8th) annual:
"The Mac Malware of <Year>" white paper: https://t.co/ntDJJQaJ8m
It's a technical deep dive into every new macOS malware specimen of 2023, detailing:
💉 Infection
💾 Persistence
📡 Capabilities
...plus samples, detections, & more! 👾🍎💻
@lcavallaro & I are thrilled to announce “Benefits and Outlook of Program Analysis for Systems Security”.
This COSE special issue seeks technical & vision papers capitalizing on the rich cross-pollination ongoing among Computer Security, PL, and SE research.
RTs appreciated! ▶️🧵
The rtf format of the “ms-msdt” 0day is using the URL Monkier to load and run the IE engine, which does remind me of my own presentation years ago. Same/similar bug, different paths.
https://t.co/BoeHP0YQwP
#youneverreallyknowCOM
The "PCW.debugreport.xml" file inside %localappdata%\Diagnostics and %localappdata%\ElevatedDiagnostics (for elevated instances) is generated when executing the #follina thingy and it contains the payload. Maybe good for #dfir
Did anyone look into this?
This blog post sums up my yearlong Windows Drivers research, detailing my own methodology for reverse engineering drivers, finding possible vulnerabilities, and understanding their exploitability: https://t.co/iPJGGlDnzB
Some time ago, I wrote a proof-of-concept implant framework called Shlyuz that took some design cues from the CIA Assassin implant framework as described in #vault7.
I'm happy to finally be able to share it with the world; but first, some background:
https://t.co/aDr5yCKsPJ
Such a marvelous conf. An icebreaker opportunity for me since it was my first time as a speaker. If you are curious go take a look at our talk. @dcdelia
💡 Bit of advice for #ransomware devs... Use SetFilePointerEx, 🛑 NOT 🛑 SetFilePointer.
Don't be like AvosLocker, who fuck up tons of data in the middle of 4GB+ files because they ignore the high move value and return... Pays to read the damn documentation. 📚