PSW #777 – Nico Waisman

"On one of the pentest project, an unprivileged account was accessed on rhel 8. It was spelled out in sudoers that the command /usr/bin/systemctl status *random_service could be run from mine user. Coincidentally, the size of my terminal turned out to be small. There is a feature in systemctl which outputs information to pager less instead of cat if the size of the terminal is less than the length of any line output. Pager less has the ability to execute commands, in example you can triger new shell with command !sh."* - Note this did not work on Manjaro; it told me, "Command not available".

"In this blog post, we describe how we were able to successfully execute an EMFI attack on the OTP transfer process of the ESP32 using commercially available tooling. We presented this work at hardwear.io USA 2022."

I learned a lot from these slides, now I want to build one just for fun!

"The problem is believed to stem from how the image file was opened for editing, causing truncated data to be left behind in a saved image and allowing roughly 80% of the original version to be recoverable."

"A proof of concept exploit for Linux only can be found here. It uses the fact that the encryption is authenticated and checks whether the MAC verifies using the key derived from the guessed PIN. It only tests the PINs 0000 through 9999, so you will have to use one of those if you want it to succeed. Make sure to uncheck the "Lock with master password on restart" option (otherwise the required information would need to be read from the Bitwarden application's memory (quite a different attack scenario)). It finds any 4 digit PIN in less than 4 seconds"

I don't know if this is old or new, but its really cool: "Are you starting to get excited yet? If an Exchange server is configured to use ActiveSync with Basic Auth, users are sending username and passwords in every single HTTP request. As we are able to perform HRS, we might be able to intercept these credentials!" - Not gonna lie, I was excited :)

Why I was skeptical of AWS Lightsail...

Tools just keep evolving here, largely from bug bounty hunters.

OMG! The sky is not falling (from: https://doublepulsar.com/a-look-at-cve-2023-23415-a-windows-icmp-vulnerability-mitigations-which-is-not-a-cyber-meltdown-78a9f7e3e538 ): "You need an app listening on raw sockets to be vulnerable — think a port sniffer (app processing all network traffic) or similar. To be clear, this will exist in enterprises (hi people running Wireshark etc)… but it shouldn’t be every Windows PC on earth as a scope. For an app to be listening on raw sockets, it needs admin rights. You need to allow ICMP inbound to be vuln, and the packets to trigger are quite unusual."

I flagged this for later so I could come up to speed on some compliance frameworks.

Blog post of the week for sure! This is a fantastic tutorial, I'm still picking it apart and adding it to my reversing techniques and such.

"The attackers, the company says, exploited a vulnerability in the master service interface that Bitcoin ATMs use to upload videos, which allowed them to upload a JavaScript script and execute it with batm user privileges." - Hacking ATMs is do different now.

This is neat...Who doesn't need a tiny Linux laptop for "things" and "stuff"?

FYI, curl has around 250 command line switches. I would not want to be responsible for this code, let alone anything to do with security. I give the team a ton of credit!

"Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number. " - Yea, I updated my phone recently LOL. (Google Project Zero Post: https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html )

A security flaw in Pixel’s Markup utility allows hackers to un-redact and uncrop edited screenshots. Google has fixed this and released an update to AOSP 13

Mandiant tracked 55 zero-day vulnerabilities that we judge were exploited in 2022. Although this count is lower than the record-breaking 81 zero-days exploited in 2021, it still represents almost triple the number from 2020.

Hormone called FGF21 (undrunk.io) speeds recovery from alcohol poisoning in mice, has potential to save countless lives, researchers say

In what the ATM owner called a security incident of the highest severity, threat actors were able to exploit a zero-day flaw by uploading "his own java application remotely via the master service interface used by terminals to upload videos, and run it using batm user privileges," the advisory released by General Bytes stated.