cyberveille.decio.ch

cyberveille.decio.ch

5334 bookmarks
Custom sorting
#NoFilter - Abusing Windows Filtering Platform for Privilege Escalation
#NoFilter - Abusing Windows Filtering Platform for Privilege Escalation
This blog is based on a session we presented at DEF CON 2023 on Sunday, August 13, 2023, in Las Vegas. Privilege escalation is a common attack vector in the Windows OS. There are multiple offensive tools in the wild that can execute code as “NT AUTHORITY\SYSTEM” (Meterpreter, CobaltStrike, Potato tools), and they all usually do so by duplicating tokens and manipulating services. This allows them to perform attacks like LSASS Shtinkering.
#deepinstinct#EN#2023#NoFilter#DEFCON2023#Privilege#escalation
·deepinstinct.com·
#NoFilter - Abusing Windows Filtering Platform for Privilege Escalation
macOS 0day: App Management
macOS 0day: App Management
App Management is a new macOS security feature in Ventura introduced at WWDC last year: If an app is modified by something that isn't signed by the same development team and isn't allowed by an NSUpdateSecurityPolicy, macOS will block the modification and notify the user that an app wants to manage other apps. Clicking on the notification sends people to System Settings, where they can allow an app to update and modify other apps.
#lapcatsoftware#EN#2023#macOS#0-day#AppManagement
·lapcatsoftware.com·
macOS 0day: App Management
Brazilian hacker claims Bolsonaro asked him to hack into the voting system ahead of 2022 vote | AP News
Brazilian hacker claims Bolsonaro asked him to hack into the voting system ahead of 2022 vote | AP News
A Brazilian hacker claimed at a congressional hearing Thursday that then-President Jair Bolsonaro wanted him to hack into the country’s electronic voting system to expose its alleged weaknesses ahead of the 2022 presidential election.
#apnews#EN#2023#Brazil#Bolsanero#hacker#voting#system
·apnews.com·
Brazilian hacker claims Bolsonaro asked him to hack into the voting system ahead of 2022 vote | AP News
New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode
New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode
Cybersecurity researchers have documented a novel post-exploit persistence technique on iOS 16 that could be abused to fly under the radar and maintain access to an Apple device even when the victim believes it is offline. The method "tricks the victim into thinking their device's Airplane Mode works when in reality the attacker (following successful device exploit) has planted an artificial Airplane Mode which edits the UI to display Airplane Mode icon and cuts internet connection to all apps except the attacker application," Jamf Threat Labs researchers Hu Ke and Nir Avraham said in a report shared with The Hacker News.
#thehackernews#EN#2023#iOS#apple#airplanemode#exploit
·thehackernews.com·
New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode
Approximately 2000 Citrix NetScalers backdoored in mass-exploitation campaign
Approximately 2000 Citrix NetScalers backdoored in mass-exploitation campaign
Fox-IT (part of NCC Group) has uncovered a large-scale exploitation campaign of Citrix NetScalers in a joint effort with the Dutch Institute of Vulnerability Disclosure (DIVD). An adversary appears to have exploited CVE-2023-3519 in an automated fashion, placing webshells on vulnerable NetScalers to gain persistent access. The adversary can execute arbitrary commands with this webshell, even when a NetScaler is patched and/or rebooted. At the time of writing, more than 1900 NetScalers remain backdoored. Using the data supplied by Fox-IT, the Dutch Institute of Vulnerability Disclosure has notified victims.
#fox-it#EN#2023#CVE-2023-3519#citrix#NetScalers#backdoored
·blog.fox-it.com·
Approximately 2000 Citrix NetScalers backdoored in mass-exploitation campaign
PowerHell: Active Flaws in PowerShell Gallery Expose Users to Attacks
PowerHell: Active Flaws in PowerShell Gallery Expose Users to Attacks
Recent findings by Aqua Nautilus have exposed significant flaws that are still active in the PowerShell Gallery's policy regarding package names and owners. These flaws make typosquatting attacks inevitable in this registry, while also making it extremely difficult for users to identify the true owner of a package. Consequently, these flaws pave the way for potential supply chain attacks on the registry's vast user base.
#aquasec#EN#2023#PowerHell#PowerShell#Gallery#typosquatting
·blog.aquasec.com·
PowerHell: Active Flaws in PowerShell Gallery Expose Users to Attacks
This $70 device can spoof an Apple device and trick you into sharing your password
This $70 device can spoof an Apple device and trick you into sharing your password
Attendees at Def Con, one of the world’s largest hacking conferences, are used to weird shenanigans, such as a seemingly innocuous wall of computer screens that display people’s passwords sniffed over the conference Wi-Fi network. But at this year’s event, even conference veterans were confused and concerned when their iPhones started showing pop-up messages prompting them to connect their Apple ID or share a password with a nearby Apple TV.
#techcrunch#EN#2023#defcon#Apple#iPhone#pop-up#messages#AppleTV
·techcrunch.com·
This $70 device can spoof an Apple device and trick you into sharing your password