Byungho Min

Infosec enthusiast, husband, father, son. This tweeter account is mainly for saving and sharing infosec stuff I encounter on the internet.

[Dorsa @dorsa_rohani]

New fastest shortest-path algorithm in 41 years!
Tsinghua researchers broke Dijkstra’s 1984 “sorting barrier,” achieving O(m log^(2/3) n) time. This means faster route planning, less traffic, cheaper deliveries, and more efficient networks - and a CS curriculum revamp =)

[Ron BY @RonB_Y]

Talking at @defcon was fun as always! The source code for the tools is public
https://t.co/aN5pavMiWm
#DEFCON #DEFCON32

[Yarden Shafir @yarden_shafir]

Another method that still works on most EDRs is HVCIDisallowedImages reg key that blocks drivers by filename.
Can take multiple filenames, but requires HVCI to be enabled + reboot.

[Chris Thompson @_Mayyhem]

Just wrapped up DEF CON Demo Labs and published Maestro, a new tool for lateral movement with Intune from C2. Thanks to everyone who came to check it out! I'll be posting a blog and wiki with more info soon, but here's the code and link to today's slides: https://t.co/u6BPKhmcdi

[klez @KlezVirus]

[RELEASE] Following the talk at DEF CON, I'm releasing all the POC projects associated with DriverJack. More info in the repos. For any additional info, hit me up ;)

- https://t.co/VmVpVtNkhD
- https://t.co/Cdzi5RBgVE
- https://t.co/RjN05qKeXg

[Bad Sector Labs @badsectorlabs]

Dropped a new tool at DEF CON 32! Loot SCCM Distribution points via HTTP with https://t.co/3Stfi3v2Wf

We've found credentials, certificates, custom apps, keystores, etc. What will you find?

[Alexandre Borges @ale_sp_brazil]

The eighth article (62 pages) of Malware Analysis Series (MAS) is available on:

https://t.co/yvXoY9uoDH

I am actively writing the following articles:

01. ER_03 (Hyper-V)
02. ER_04 (MacOS/iOS)

My focus is on writing articles in the Exploiting Reversing series (ERs), which is a series of security research on Windows, macOS, hypervisors and browsers. I will eventually write one or two more articles in the Malware Analysis Series to round it out in the meantime.

Finally, I'd like thank @ilfak and @HexRaysSA for their constant and complete support, which made it possible for me to write these articles.

I hope I have news about new articles soon.

Have an excellent day.

#malwareanalysis #macOS #iOS #apple #malware #infosec

[Daniel Weber @weber_daniel]

We found a CPU bug that allows an arbitrary physical memory write, thus allow to *read* and *write* the memory for every process!
Check out the website for more details:
https://t.co/CO9QBTXAr6

[Mobile Hacker @androidmalware2]

Rooting Android: Exploiting Your GPU On Smartphone (CVE-2024-23380) by @vxradius
PoC exploit is not available for download.

[slides] https://t.co/vHkA2AiWk9 #BlackHat

[Michael Bargury @mbrg0]

we got an ~RCE on M365 Copilot by sending an email

by ~RCE I mean full remote control over
its actions - search for sensitive content (sharepoint, email, calendar, teams), execute plugins
and outputs - bypass DLP controls, manipulate references, social engineer its users on our behalf
#BHUSA #DEFCON @tamirishaysh

[Cube0x0 @cube0x0]

Over a year ago, I left my position at WithSecure to start a new journey, create something new, and do my own thing. Today, I'm excited to publicly announce what I've been working on all this time.

Introducing 0xC2, a cross-platform C2 framework targeting Windows, Linux, and MacOS environments: https://t.co/JmxmvNsH63

The first release was back in late 2023, initially only offered to a small circle of red teamers and soon, the registration will be open for new clients who provide threat simulation services.

All agents are written as PIC in C to provide better opsec and to allow operators to be more flexible when designing payloads. To make the agents modular and fully customizable, operators can create a user-defined virtual table that can be hooked by the agent. This can be used to change the default behavior of an agent or extend capabilities, from adding internal commands to implementing P2P protocols.

More details will be available soon.

[Mobile Hacker @androidmalware2]

Heap overflow in JPEG loading in Samsung's Little Kernel in bootloader allows a privileged attacker to execute persistent arbitrary code (it survives reboots and factory reset) CVE-2024-20832 by @quarkslab

Paper: https://t.co/9oXY3z333Q
Slides: https://t.co/o59L0IHaxt

[Tavis Ormandy @taviso]

This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n

[Security Joes @SecurityJoes]

"With the updates from Ghidra, OpenAI, and others, we now have better options for reversing using AskJOE!", said Threat Researcher, @moval0x1, uploading a new version of #AskJoe to our Github 🎉

Download here: https://t.co/902jPhLbWq

Here is the list of updates for this new release:
💠 Ghidrathon added and removed pyhidra
💠 Refactored Code
💠 AI Triage added
💠 Better Name added
💠 Search for crypto constants added
💠 Mandiant CAPA added
Take a look at how the fancy AI Triage works 🐩

[Parker @TeslaEnthusist]

I can’t even open my fridge 😭

[Satya Nadella @satyanadella]

Yesterday, CrowdStrike released an update that began impacting IT systems globally. We are aware of this issue and are working closely with CrowdStrike and across the industry to provide customers technical guidance and support to safely bring their systems back online.

[SANS.edu Internet Storm Center @sans_isc]

And as expected... @crowdstrike ambulance chasing is starting. https://www.crowdstrikeclaim[.]com #crowdstroke

[Ulf Frisk @UlfFrisk]

MemProcFS 5.10 released! Support for Windows 11 24H2 added!

MemProcFS - super fast memory forensics of live memory and memory dumps! https://t.co/inOM3l1GIF

[Satoshi Tanda @standa_t]

Sharing a simple hypervisor for learners in Rust, inspired by @memN0ps 's work
https://t.co/TbuYV9AiSK

✅ Stable Rust
✅ Covers AMD and Intel
✅ Compiles into UEFI and Windows drivers
✅ Can test on a VM with one shortcut key
✅ Builds on 🪟Windows, 🍎macOS and 🐧Ubuntu

Enjoy!