Search cyberveille.decio.ch

Found 15 bookmarks

Custom sorting

Unveiling sedexp: A Stealthy Linux Malware Exploiting udev Rules

Stroz Friedberg identified a stealthy malware, dubbed “sedexp,” utilizing Linux udev rules to achieve persistence and evade detection. This advanced threat, active since 2022, hides in plain sight while providing attackers with reverse shell capabilities and advanced concealment tactics.

#aon #EN #2024 #sedexp #Linux #Malware #udev #Rules

·aon.com·Aug 25, 2024

Unveiling sedexp: A Stealthy Linux Malware Exploiting udev Rules

Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine (part 1)

A few months ago, I stumbled upon a 24 years old buffer overflow in the glibc, the base library for linux programs. Despite being reachable in multiple well-known libraries or executables, it proved rarely exploitable — while it didn't provide much leeway, it required hard-to-achieve preconditions. Looking for targets lead mainly to disappointment. On PHP however, the bug shone, and proved useful in exploiting its engine in two different ways.

#ambionics #EN #2024 #cve-2024-2961 #glibc #linux #PHP

·ambionics.io·Jun 25, 2024

Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine (part 1)

RansomHub Draws in Affiliates with Multi-OS Capability and High Commission Rates

Discover how RansomHub's ransomware-as-a-service targets Windows, Linux, and ESXi systems.

#recordedfuture #EN #2024 #analysis #RansomHub #ESXi #Linux #Multi-OS

·recordedfuture.com·Jun 24, 2024

RansomHub Draws in Affiliates with Multi-OS Capability and High Commission Rates

XZ backdoor behavior inside OpenSSH

In this article, we analyze XZ backdoor behavior inside OpenSSH, after it has achieved RSA-related function hook.

#securelist #EN #2024 #Backdoor #Cyber-espionage #Linux #Malware #Malware-Descriptions #Malware-Technologies #SSH #Targeted-attacks #XZ

·securelist.com·Jun 24, 2024

XZ backdoor behavior inside OpenSSH

Kaspersky analysis of the backdoor in XZ

Kaspersky analysis of the backdoor recently found in XZ, which is used in many popular Linux distributions and in OpenSSH server process.

#securelist #EN #2024 #Backdoor #Cyber-espionage #Linux #Malware #analysis #Malware-Descriptions #Malware-Technologies #SSH #XZ

·securelist.com·Apr 13, 2024

Kaspersky analysis of the backdoor in XZ

The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind

The thwarted XZ Utils supply chain attack was years in the making. Now, clues suggest nation-state hackers were behind the persona that inserted the malicious code.

#wired #EN #2024 #XZ #vulnerabilities #linux #open-source #hackers #JiaT75

·wired.com·Apr 3, 2024

The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind

Check if you're vulnerable to CVE-2024-3094

CVE-2024-3094 is the new hot one and it’s extremely critical; however, impact should be limited as most normal linux distros are unaffected. Here’s some stuff to know:

#latio.tech #EN #2024 #CVE-2024-3094 #check #linux #xz #vulnerability-check

·latio.tech·Apr 1, 2024

Check if you're vulnerable to CVE-2024-3094

XZ Utils backdoor

This page is short for now but it will get updated as I learn more about the incident. Most likely it will be during the first week of April 2024. The Git repositories of XZ projects are on git.tukaani.org. xz.tukaani.org DNS name (CNAME) has been removed. The XZ projects currently don’t have a home page. This will be fixed in a few days.

#tukaani #EN #2024 #XZ #backdoor #linux

·tukaani.org·Mar 30, 2024

XZ Utils backdoor

Easy privilege escalation exploit lands for Linux kernels

CVE-2024-1086 turns the page tables on system admins

#theregister #EN #2024 #CVE-2024-1086 #Local-Privilege-Escalation #Linux #PoC #Kernel

·theregister.com·Mar 29, 2024

Easy privilege escalation exploit lands for Linux kernels

Urgent security alert for Fedora 41 and Fedora Rawhide users

Red Hat Information Risk and Security and Red Hat Product Security learned that the latest versions of the “xz” tools and libraries contain malicious code that appears to be intended to allow unauthorized access.

#redhat #EN #2024 #xz #backdoor #linux

·redhat.com·Mar 29, 2024

Urgent security alert for Fedora 41 and Fedora Rawhide users

Decade-old Linux ‘wall’ bug helps make fake SUDO prompts, steal passwords

A vulnerability has been discovered in the 'util-linux' library that could allow unprivileged users to put arbitrary text on other users' terminals using the 'wall' command.

#bleepingcomputer #EN #2024 #Clipboard-Hijacker #Library #Linux #Passwords #Terminal #WallEscape

·bleepingcomputer.com·Mar 28, 2024

Decade-old Linux ‘wall’ bug helps make fake SUDO prompts, steal passwords

Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques

A tale about exploiting KernelCTF Mitigation, Debian, and Ubuntu instances with a double-free in nf_tables in the Linux kernel, using novel techniques like Dirty Pagedirectory. All without even having to recompile the exploit for different kernel targets once.

#pwning #EN #2024 #KernelCTF #Mitigation #nf_tables #Linux #exploitation #CVE-2024-1086

·pwning.tech·Mar 27, 2024

Flipping Pages: An analysis of a new Linux vulnerability in nf_tables and hardened exploitation techniques

Windows 11, Tesla, and Ubuntu Linux hacked at Pwn2Own Vancouver

On the first day of Pwn2Own Vancouver 2024, contestants demoed Windows 11, Tesla, and Ubuntu Linux zero-day vulnerabilities and exploit chains to win $732,500 and a Tesla Model 3 car.

#bleepingcomputer #EN #2024 #Competition #Exploit #Hacking #Linux #Pwn2Own #Tesla #Windows #Windows-11 #Zero-Day

·bleepingcomputer.com·Mar 21, 2024

Windows 11, Tesla, and Ubuntu Linux hacked at Pwn2Own Vancouver

Linux Foundation Launches Tazama: A Revolutionary Open Source Solution for Real-Time Fraud Management

Tazama is the first open source platform for financial monitoring and fraud detection.

#linuxfoundation #EN #2024 #Linux #Foundation #Tazama #Open-Source #fraud #detection

·linuxfoundation.org·Mar 17, 2024

Linux Foundation Launches Tazama: A Revolutionary Open Source Solution for Real-Time Fraud Management

Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities

Magnet Goblin is a financially motivated threat actor that quickly adopts and leverages 1-day vulnerabilities in public-facing services as an initial infection vector. At least in one case of Ivanti Connect Secure VPN (CVE-2024-21887), the exploit entered the group’s arsenal as fast as within 1 day after a POC for it was published. Campaigns that we were able to attribute to this actor targeted Ivanti, Magento, Qlink Sense and possibly Apache ActiveMQ. Analysis of the actor’s recent Ivanti Connect Secure VPN campaign revealed a novel Linux version of a malware called NerbianRAT, in addition to WARPWIRE, a JavaScript credential stealer. * The actor’s arsenal also includes MiniNerbian, a small Linux backdoor, and remote monitoring and management (RMM) tools for Windows like ScreenConnect and AnyDesk.

#checkpoint #EN #2024 #Magnet-Goblin #1-day #vulnerability #Linux #NerbianRAT

·research.checkpoint.com·Mar 11, 2024

Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities