We found malicious apps that work together to compromise devices and collect user data. One of the apps, called Camero, exploits CVE-2019-2215, a flaw that exists in Binder. This is the first instance in the wild that exploits said UAF vulnerability.

Есть в мире вещи, которые мы принимаем как нечто само собой разумеющееся, хотя они являются истинными шедеврами. Одними из таких вещей являются утилиты Linux, та...

Regular Expression Tester with highlighting for Javascript and PCRE. Quickly test and debug your regex.

Generic Signature Format for SIEM Systems. Contribute to Neo23x0/sigma development by creating an account on GitHub.

2020 is upon us, folks. We'd like to wish everyone reading this a happy new year, wherever you are. As you take your first steps of the new year, figuring out what your next move is, you may find it comforting to know that there's a new Firefox release to try out! Version 72 to be exact.

In this post, I’m going to reveal the fastest, easiest P1 that I’ve ever reported – multiple times! It’s the sort of oversight that seems so simple to avoid, but surprisingl…

Contribute to bluefrostsecurity/CVE-2019-1215 development by creating an account on GitHub.

Windows operating systems provide the functionality to allow custom DLL’s to be loaded into the address space of almost all application processes. This can give the opportunity for persistenc…

We built an attack against Windows CFG that completely evades integrity checks and transfers control to any location, thus obtaining arbitrary code execution. In this talk, we will present how we noticed this design vulnerability, how we built our attack on top of it, and its prospected impact.

By  Andrea Biondo & Mauro Conti & Daniele Lain

Ful Abstract & Presentation Materials: https://www.blackhat.com/asia-18/briefings.html#back-to-the-epilogue-how-to-evade-windows-control-flow-guard-with-less-than-16-bytes

This talk will present an in-depth security analysis of Wi-Fi Direct protocol including an architectural overview, description of the discovery process, description of the connection process and a description of the frame formats. Additionally, we will use Android, HP Printers, and Samsung Smart TVs among others as an example of vulnerable implementations. At the end of the presentation, we will release PoC for the vulnerabilities and a tool for fingerprinting devices supporting Wi-Fi Direct protocol.

By Andrés Blanco

Full Abstract & Presentation Materials: https://www.blackhat.com/eu-17/briefings.html#wi-fi-direct-to-hell-attacking-wi-fi-direct-protocol-implementations

This paper reveals the most serious vulnerabilities found in each language. It includes practical examples identifying which undocumented functions could allow OS command execution, when sensitive file contents may be partially exposed in error messages, how native code is being unexpectedly interpreted – locally and remotely – and when constant's names could be used as regular strings for OS command execution.

By Fernando Arnaboldi

Full Abstract & Presentation Materials: https://www.blackhat.com/eu-17/briefings.html#exposing-hidden-exploitable-behaviors-in-programming-languages-using-differential-fuzzing

As the rest of the Android security infrastructure improves, the Android/Linux kernel is well on its way to becoming the "weakest link," being responsible fo...

In this talk, we present a novel Web hacking technique that enables an attacker to circumvent most XSS mitigations. In order to do so, the attacker abuses so-called script gadgets. A script gadget Is a legitimate piece of JavaScript in a page that reads elements from the DOM via selectors and processes them in a way that results in script execution

By Sebastian Lekies, Krzysztof Kotowicz & Eduardo Vela

Full Abstract & Presentation Materials: https://www.blackhat.com/us-17/briefings.html#dont-trust-the-dom-bypassing-xss-mitigations-via-script-gadgets

We propose a new exploit technique that brings a whole-new attack surface to bypass SSRF (Server Side Request Forgery) protections. This is a very general at...

Botnets and C&C servers are taking over the internet and are a major threat to all of us ... but what happens when these botnets and C&C servers start existing and operating inside the walls of our organisations? What if these botnets and C&C servers could bypass all of our network controls? What if these botnets and C&C servers could communicate internally across our security zones and organisations? What if micro-segmentation suddenly became useless?

By Ty Miller & Paul Kalinin

Full Abstract & Presentation Materials: https://www.blackhat.com/us-17/briefings.html#the-active-directory-botnet

SQLite is widely used as embedded database software for local/client storage in application software, such as web browsers and mobile applications. As a relational database, SQLite is vulnerable to SQL injection attack, which has been well-studied for a long time. Memory corruption bugs in SQLite are usually not considered security issues, since they are normally unlikely to be exploitable. In this talk, we will study several remotely exploitable memory corruption cases to show the dangerous attack surface in SQLite.

By Siji Feng & Zhi Zhou & Kun Yang

Full Abstract & Presentation Materials: https://www.blackhat.com/us-17/briefings.html#many-birds-one-stone-exploiting-a-single-sqlite-vulnerability-across-multiple-software

Creating a custom command and control (C&C) server for someone else's malware has a myriad of benefits. If you can take over a domain, you then may able to fully hijack other hackers' infected hosts. A more prosaic benefit is expediting analysis. While hackers and governments may be more interested in the former, malware analysts can benefit from the latter.

By Patrick Wardle

Read More: https://www.blackhat.com/us-17/briefings/schedule/#offensive-malware-analysis-dissecting-osxfruitfly-via-a-custom-cc-server-6743