nugxperience

[nugxperience @nugxperience]

Challenge 5 completed. #flareon12

[nugxperience @nugxperience]

Same. #flareon12

[REFINE | Sam Martino @seeaquince]

If Flareon has a million fans, then I am one of them. If Flareon has only one fan then that is me. If Flareon has no fans, then that means I am no longer on earth. If the world is against Flareon, then I am against the world (+60 CP)

[x86matthew @x86matthew]

Another pointless weekend project - a playable version of the old 3DMaze screensaver from Windows 9x.

I reverse-engineered the original screensaver binary and added user-input functionality for the controls (and fixed some other minor issues!)

https://t.co/1X44ubggB2

[nugxperience @nugxperience]

And finishing this year gives me a 50% success rate for FlareOn, a passing grade!
2017 ❌
2018 ❌
2019 ☑️
2020 ❌
2021 ❌
2022 ☑️
2023 ☑️
2024 ☑️

[nugxperience @nugxperience]

FlareOn 11 completed, landed in 78th place. Had a blast as usual. Challenges 5, 7 and 9 were particularly great, and 10 was a very enjoyable capstone after the trials of 9. Thank you to everyone that helps put FlareOn together each year! #flareon11

[nugxperience @nugxperience]

I tracked my time properly for the first time this year. I enjoy when other people share theirs, so here's mine, with a total and a breakdown per challenge. 👀

[nugxperience @nugxperience]

Hey, I found it! Challenge 9 down. #flareon11

[nugxperience @nugxperience]

Oh, they have blockchain in the cloud now? Challenge 8 down, contract closed. #flareon11

[nugxperience @nugxperience]

Had a bit of trouble getting dnSpy tuned in but picked up the signal in the end. 7 down! #flareon11

[nugxperience @nugxperience]

Tinkering with electrical circuits is for the birds. 6 down. #flareon11

[nugxperience @nugxperience]

Cracked case number 5. #flareon11

[Florian Roth ⚡️ @cyb3rops]

I think I found a sample that looks very much like the FrostyGoop malware targeting ICS systems & used in an attack against an energy company in Lviv, Ukraine

They forgot to mention the hash in their report. I also published a YARA rule to detect it.

@DragosInc's report
https://t.co/Gj2heeDU44

Sample
https://t.co/E8gO6QFNPR

YARA rule
https://t.co/FPnerrrXXg

[nugxperience @nugxperience]

@cyb3rops @mthcht This appears to be the version of the script which can be decoded from 5.6.1 (654c673c177a2a06c2b240ee07f81dc9096b1626f82855dc67722a5e10bbf6a1), but with different newline endings. The additions in this version are discussed here: https://t.co/pjlJc8haG4

[Thomas Roccia 🤘 @fr0gger_]

https://t.co/Is8dggM08Y by smx

[Thomas Roccia 🤘 @fr0gger_]

🤯 The level of sophistication of the XZ attack is very impressive! I tried to make sense of the analysis in a single page (which was quite complicated)!

I hope it helps to make sense of the information out there. Please treat the information "as is" while the analysis progresses! 🧐 #infosec #xz

[blasty @bl4sty]

https://t.co/mufUutYyps q3k from @DragonSectorCTF has figured out the string/symbol obfuscation in the xz backdoor! there's appears to be a lot more going on then reported in the initial report.

[nugxperience @nugxperience]

RC4 recognizer here. The AWK portion of the #xz #backdoor decoding script is implementing a modified RC4 algorithm.
- No key, the RC4 state is initialized directly
- "Drop" RC4, discarding 4096 bytes of keystream
- The keystream is applied with an ADD rather than XOR

[nugxperience @nugxperience]

@Myrtus0x0 And here's the byte frequency distribution of an encrypted payload (I'm using kernel32.dll) using a 256 vs 300 byte sbox. This could be a distribution that sets you apart from other things instead of blending in with them. It at least shows one effect sbox size could have.

[nugxperience @nugxperience]

@Myrtus0x0 Graphed is the entropy of the keystream distribution for sbox sizes 256 - 512. First is theoretical, then an actual test with 500KB of keystream. Is this dip in entropy actually going to cause you any grief? Who knows. :)