M. Sami Karaca

digital forensics

[M. Sami Karaca @msamikaraca_]

@cay_sald @PedramTurkoglu @m3vzu Net tanı için kafa üzerini görmek iyi olur ama sikkeli yılan gibi görünüyor. Zehirsiz

[M. Sami Karaca @msamikaraca_]

@_JohnHammond Not widely talked topic authentication backdoors, e.g. NTLM auth backdoor https://t.co/a1PjFIJUXB

[M. Sami Karaca @msamikaraca_]

@vxdb Looks like he had some practice

[Gergely Orosz @GergelyOrosz]

This is both amusing and predicable.

What is your reaction, as a dev, when you realize your efforts to help other devs with their problems (by answering questions on StackOverflow) is now a way for StackOverflow to sell this data for OpenAI train ChatGPT to perform better?

[Robin @digininja]

@fs0c131y By the time you realise you need good OPSEC it is already too late.

[Alisa Esage Шевченко @alisaesage]

Deep State of Cybersecurity: a Probabilistic Perspective

1. Fail to install updates timely and get hacked with N-day exploits.
2. Install updates too eagerly and get hacked with yet-uncaught supply chain implants.
3. You are always affected by 0-day exploits.
4. Statistically, the odds of being hacked tend to infinity as time goes.

Conclusion: high value "targets" who have used a computer for long enough, are already pwned with a near-1 probability

[Boris Larin @oct0xor]

We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it. https://t.co/hsQo6JIPMJ

[Craig Rowland - Agentless Linux Security @CraigHRowland]

I've been in intrusion detection development my entire career. Allow me to offer some advice: It's OK to shut off signatures that are causing lots of noise.

Don't spend hours tuning them. Just shut them off. You are not participating in a Mitre Eval. No need to goose results.

You don't need to spot every single attack. You don't even need to spot most of them. What you need are high-fidelity alerts. Attackers do many things after they get initial entry onto a network. By watching for too much you will miss significant problems in the noise.

Don't let security marketers gaslight you into believing that unless you have 100% attack coverage you are vulnerable. It's actually the opposite. 100% coverage will often drown you in noise and make you less effective.

[M. Sami Karaca @msamikaraca_]

@BelginA25 @muratagirel Kaçmaya yönelik tespitler dediği şeyin diğer maddelerle alakalı olması şart değil. Adres değişikliği genelde arama-el koyma kararı ihtimaline karşı hedef şaşırtma ve zaman kazanma amacıyla yapılır. Dolayısıyla delil karartma şüphesi uyandığı için gözaltı tedbiri uygulanmış

[M. Sami Karaca @msamikaraca_]

The attackers appear to be quite 'confident' with their repetitive intrusion attempts. Or they/their client had 'significant' reasons to take the risk of being noticed during that attack time frame. In either case, they demonstrate an intriguing level of persistence as a threat:D

[M. Sami Karaca @msamikaraca_]

Great work! The solution to obtain the attachment was really clever. The thread by @billmarkzac is also nicely written, drawing from his experience on this topic

[Bill Marczak @billmarczak]

NEW: Kaspersky releases full details on how they captured the “Triangulation” (suspected US Government) exploits and iPhone spyware targeting their employees. https://t.co/Krladw07eD

[Bill Marczak @billmarczak]

Some interesting new details from Kaspersky about the Triangulation (suspected US Government) iPhone hacking campaign. TLDR: Seems like attackers making more highly questionable operational security decisions… https://t.co/9hGAxE5eaa

[Mattia Epifani @mattiaep]

iOS 15 Image Forensics Analysis and Tools Comparison - Processing details and general device information

https://t.co/lfb8dAzGcp

#DFIR #mobileforensics

[Andrzej Dyjak @andrzejdyjak]

Why hasn't anyone hacked @Synology devices at @Pwn2Own_Contest or @TianfuCup 2021?

A brilliant presentation by two researchers (@spaceraccoonsec & @angelystor) answers this question. While they managed to identify vulnerabilities in Synology's products, they ultimately failed to exploit them.

And they weren't alone – other teams faced this wall too.

Why? In previous years, Synology experienced several security setbacks, leading them to a point similar to where @Microsoft found itself 20 years earlier.

MS's answer was to establish the Trusted Computing program and the Secure Development Lifecycle process. Synology's response was akin, but they didn't need to create a Secure SDLC; they merely applied it.

What specifically did they do? According to the study's authors:

1️⃣ They streamlined the authentication and authorization process through centralization (well-executed, this significantly reduces the attack surface).

2️⃣ They fortified the usage of standard functions in their libraries (e.g., replacing sprintf() with snprintf()).

Nota bene: MS did the exact same thing in Visual Studio.

3️⃣ They centralized critical functionalities in individual libraries and then practiced using them instead of directly calling relevant functions (thus, for instance, every database request passes through one point where the input is sanitized).

All these steps ensured that the researchers couldn't exploit the vulnerabilities they discovered.

Yes, post-2021, other exploitable vulnerabilities appeared on Synology devices, but that's not the point. The objective in security isn't 100% protection (doomed from the outset as it's unattainable).

The goal is to make a product secure enough, and finding that balance between sufficient and insufficient security within a specific budget is the real art.

On a side note, last month, a brief blog post appeared on Synology's blog detailing other practices they employ in their #SSDLC process. It lists standard actions like Security Reviews (Design phase), SAST and DAST (Development phase), and Security Testing (Verification phase).

More details here:
[1] https://t.co/PEKDZ2aiHH
[2] https://t.co/ehpRPRvgN2

[Ben Hawkes @benhawkes]

"The WebP 0day" -- a full technical analysis the recently patched vulnerability in the WebP image library that was exploited in the wild (CVE-2023-4863). https://t.co/6yUcE9sOZa

[M. Sami Karaca @msamikaraca_]

Femoral artery? @AmerikanAynasiz

[Conflict @ConflictTR]

🔴 Antalya’da annesini bıçakla rehin alıp bıraktıktan sonra çağırılan polislere çamaşır suyu atarak eve girmelerini engelleyen, 4 saat direndikten sonra bacağından vurularak yakalanan Fırat Altun (28), tedaviye alındığı hastanede yaşamını yitirdi.

[M. Sami Karaca @msamikaraca_]

@osmanmakal @flightlesstux yok web'de de aynıydı denediğimde. Input'la alakalı. Şimdi biraz denedim ve şu kanaate vardım: bina adında taksim ardından numerik değerle başlarsa patlıyor, harf olursa sorun yok. Örneğin "No: 10/A_APARTMAN" sıkıntı yok, "No:10/1A_APARTMAN" olursa 404

[M. Sami Karaca @msamikaraca_]

@osmanmakal @flightlesstux Şimdi abone ol deyince 404 döndü

[M. Sami Karaca @msamikaraca_]

@coderdreamer Teknoloji ne kullanıyorsunuz?

[Bill Marczak @billmarczak]

NEW: Last week, we @citizenlab captured a "zero-click" exploit used to install Pegasus on the latest version of iOS, 16.6. The exploit installed Pegasus without any interaction from the victim, and was virtually invisible https://t.co/MxPrAThwa1