Memory Safety, Re-Writing Software, and OSS Supply Chains – Omkhar Arasaratnam – PSW #820

I've noticed a couple of these vulnerabilities (and exploits) for unsupported D-Link routers. D-Link won't update them and I bet many are not replacing them with newer models. More fuel for Mirai-inspired botnets?

I think this project is really cool because not only are they highlighting problems, but they created a database to help people fix mis-configured SCCM implementations. I really like this one: https://github.com/subat0mik/Misconfiguration-Manager/blob/main/attack-techniques/CRED/CRED-1/cred-1_description.md - It deals with PXE and attackers that can basically pull an image and dump the creds (e.g. "Attackers may recover domain credentials from this process, the difficulty of which is a direct function of the complexity of the password set on the PXE media file. If a weak password is set, cracking the password is relatively computionally "easy," depending on the hardware.")

OMG, just stop. We know, the Flipper Zero can hack everything (according to the charlatans), but so can a laptop, phone, micro-controllers, Raspberry PIs, etc...

Does it matter if the Windows source code is leaked? The Linux kernel is open-source. What exactly does an attacker gain? This Daily Dave post touches on it: https://seclists.org/dailydave/2024/q1/6

Amazing technical write-up, if nothing else, save this as it could be a reference that will help you with a project in the future. One interesting note came in on the last sentence: "PLC vendors have both the capability and the product expertise to create products that accomplish what Badgerboard set out to do; they just need to be pushed by their customers." - So much yes. We want visibility, not magic boxes that we have to 100% trust the vendor, because, we don't (or at least we shouldn't).

There is a vulnerability in a printer, it's critical, and no one cares. Moving along.

"Knowing both the affected and patched versions is going to mean a patch diff, but with Fortinet being proprietary software, finding these versions and decrypting them is going to be the first battle… which I was lucky enough to bypass via the power of friendship. However, when friendship is lacking one may also be able to get lucky and find the files they need on Grayhat Warfare (less luck needed with a subscription), and then get a nice start on decrypting them with this Bishop Fox writeup." - I've been down this road, it's fun (and frustrating).

Pretty neat attack: "This payload executes the calculator application (calc) on a Windows system through command injection, while also performing a simple arithmetic operation (10+20). When the canary token owner downloads the logs as a CSV file and opens it on a Windows machine, it results in the execution of the payload (opening the calculator app in this case)." Of course, the Thinkst team fixed it!

More digital locks are under attack. Tons of details here. It's neat to see researchers going after locks, I don't believe we as a society will greatly benefit from this research, however, there are some amazing tips and tricks that we can apply to other devices.

This is valid: "Starting with Windows 10 version 1809 (released in October 2018), Microsoft introduced a native SSH client to Windows, which allows users to connect to SSH servers directly from the Windows command prompt or PowerShell. This SSH client is a port of OpenSSH. Ever since we’ve seen that many of our clients have this optional feature enabled by default." - Also, I believe an attacker could easily install SSH (provided they have admin rights) on Windows and use it for all sorts of LOL activities.

We also have one from Microsoft as well: https://duo.com/decipher/microsoft-fixes-critical-windows-hyper-v-flaws. The vulnerabilities are similar in that an attacker has to compromise a guest, and then escape to the host. The thing I keep hearing is just that, somehow downplaying the risk because an attacker needs to be on a guest. Look, it's not the '90s or 2000s any longer, unauthenticated remote code execution vulnerabilities are not as common. The threats we have to look out for occur once an attacker gains control of something in our environments. We have to build our security programs with this in mind: there is already an attacker in our network.

Checks your installed Chrome extensions to see if the developer information listed on the Chrome Web Store has changed. If anything is different, the extension icon will display a red badge, alerting you to the change.

VMware is urging customers to patch critical vulnerabilities that make it possible for hackers to break out of sandbox and hypervisor protections in all versions, including out-of-support ones, of VMware ESXi, Workstation, Fusion, and Cloud Foundation products.

Researchers enlisted the help of a former police officer and covert operative to analyze dark web forum job adverts from June to December 2023. “Our analysis shows that highly skilled individuals are turning to cybercrime. And given the number of people projected to leave the industry, many of those will be desperate enough to seek work in an area that promises large rewards for their already-existing skills and knowledge”

It turns out that Elon was not motivated by a high-minded desire to save humanity from an AI apocalypse. Instead, he demanded control of OpenAI and pulled his funding to pressure them into handing control to him. But other investors provided money and his scheme failed.

Shadowserver and CISA are the top two, followed by Google, Microsoft, and Palo Alto.

The company’s search engine does good business in China, a market Google and Facebook abandoned years ago. Bill Gates has long advocated working closely with China to encourage innovation in health and science—and has dismissed concerns about censorship and the country’s influence on technology.

LexisNexis, which generates consumer risk profiles for the insurers, knew about every trip G.M. drivers had taken in their cars, including when they sped, braked too hard or accelerated rapidly. Drivers feel betrayed. “They’re taking information that I didn’t realize was going to be shared and screwing with our insurance.”

Two of the biggest manufacturers of locks used in commercial safes have been accused of essentially putting backdoors in at least some of their products in a new letter by Senator Ron Wyden.