nixfreax

#serverside

[Ohm-I (Oh My) @mcohmi]

After years of work, I'm excited to share Cirro! It maps your Azure environment beyond permissions, showing how resources themselves interact. I built it to visualize the full attack surface, not just the management plane. https://t.co/kEW2kkqTpN #Azure #Security #CloudSecurity

[nixfreax @nixfreax]

Also, https://t.co/4NeQC9pNFm 😎

[nixfreax @nixfreax]

webshell, bat, powershell, side load

post ex, drop 3 files- 3p signed host exe, side load dll, encrypted stage

[ESET Research @ESETresearch]

In July 2024, #ESETresearch discovered that the 🇨🇳-aligned #FamousSparrow APT group, thought at the time to have been inactive since 2022, compromised the network of a 🇺🇸 trade group and a 🇲🇽 research institute. https://t.co/Lceo7DA2HE 1/5

[nixfreax @nixfreax]

boku loader, ekko/cronos/foliage, anti sandbox via openCL GPU execution, and domain generation algorithm (DGA)

[Zscaler ThreatLabz @Threatlabz]

☕ ThreatLabz has discovered a new sophisticated malware threat that we have named CoffeeLoader. The malware is a loader that implements numerous stealthy techniques to evade antivirus and EDRs via call stack spoofing, sleep obfuscation, and Windows fibers. The malware is also protected using a packer that leverages GPU code to thwart sandboxes and virtual environments. On the network side, CoffeeLoader implements a custom encrypted binary protocol, uses a DGA as a backup channel, and performs certificate pinning to prevent TLS introspection.

CoffeeLoader is currently being distributed through SmokeLoader and the two share some interesting behavioral similarities.

Read our full technical analysis here: https://t.co/35CML5fG5z

[Cvewhen? @cvewhen]

(1/n): In a recent engagement, I had to audit a legacy C,C++ code base which is older than me. Some things I did and you can do to traverse large codebases with ease:

[nyxgeek @nyxgeek]

Oh, look! A technological gift from our adversaries!

[nixfreax @nixfreax]

TL; DR

objcopy supports redefining symbol names in object files using the --redefine-sym or --redefine-syms flag

[Matt Ehrnschwender @M_alphaaa]

I'm trying to get better at keeping up with and publishing more on my blog. Here's a new post I just released on "Writing Beacon Object Files Without DFR" https://t.co/khMuKLdv7S

[Christophe Tafani-Dereeper @christophetd]

Fun with Google Cloud's default service accounts (and how to leverage them for offensive purposes)

https://t.co/tCeGtjqsGn

[Ryan Naraine @ryanaraine]

This is the 23rd 'exploited-as-0day' issue in Microsoft products this year 🚒

[Zeke Gabrielse @_m27e]

@evilsocket Not gonna lie, I lost it at this meme:

[Ben Lincoln @0x00C651E0]

I'm really excited to finally be able to share this.

[nixfreax @nixfreax]

So not only do they ban researchers from competing internationally, punish by law if a discovered vulnerability is not reported to gov first to decide if it will be a weapon or public knowledge, but they're also supposedly doing some Ender's Game CTFs with their universities?

[Who said what? @g0njxa]

Google Chrome implemented an update that caused a major outage in cookie collection from infostealers, and users are experimenting several issues

Vidar talks about the usage of "a TPM module for encryption"

Vidar, Lumma and StealC are already working on this issue to fix it

[Haifei Li @HaifeiLi]

Alright, so MSRC told me they couldn't reproduce the two bugs I recently discovered in Excel despite I have provided the full write-up and stack trace etc. Guess for the 1st time I have to make screen videos for them.. Sigh..

[nixfreax @nixfreax]

How not to host your 2nd stage:
- straight up sheelcode in a file hosted publicly to all

How TO host it:
- obfuscate it (encode and/or encrypt)
- hide it (make it look like all the rest)
- protect it (access controls)

Bonus: key your damn stager

[chompie @chompie1337]

This is what I mean when I say working with MSRC is degrading. They want everything: write up, stack traces, PoC, exploit source, analysis, life advice, approval on anything you will ever publish. In return they will patch your bug whenever they feel like it and not tell you

[Philippe Delteil @PhilippeDelteil]

I don't give a F about your points. Pay me, don't scam me.

I was able to takeover many NS zones of root domain https://t.co/aIzPvYO3hV. I created many subdomains serving web content in domains like https://t.co/VZ2l38GVWt, also using valid email addresses with sender 1/2

[Ryan Naraine @ryanaraine]

the world's most important software maker 👇

[nixfreax @nixfreax]

@nullenc0de Yeah just don't forget to disable truff's auto validation, THAT'S ON BY DEFAULT 🤯, or you'll be spamming your secrets all over the place

[nixfreax @nixfreax]

@serf_bort @TheLotRadio back 🤑😍

[nixfreax @nixfreax]

@TheLotRadio fred again... overmono gone?!? 😭😭