Asaf Eitani

📌 .NET Hooking – Harmonizing Managed Territory 🌐 https://lnkd.in/erU6PtGr #Pentesting #Hacking #Hacker #OffensiveSecurity #Pentest #RedTeam #BugBounty #Vulnerability #Testing #devsecops #OffensiveOperations #window_internals #PenetrationTesting #exploit #blueteam #infosec #cybersecurity #informationsecurity #security

1

This is how responsible disclosure should work... This year at #blackhat2024 Alon Leviev revealed two zero-days, tracked as CVE-2024-38202 (https://lnkd.in/ePMEU9dm) and CVE-2024-21302 (https://lnkd.in/e8kYYmv4), which enable downgrade attacks that can "unpatch" fully updated systems of Windows 10, Windows 11, and Windows Server, reintroducing old vulnerabilities. 💻 How It Works: These downgrade attacks manipulate the Windows update process, tricking it into rolling back OS components such as DLLs and the NT Kernel to outdated versions, while still displaying the system as fully updated. This exposes systems to past vulnerabilities that had been previously patched. 🛡️ Impact: According to Leviev, this means "the term 'fully patched' is meaningless," as this undetectable attack makes even the most secure Windows machines vulnerable to thousands of past threats. Remarkably, this attack bypasses even UEFI locks on virtualization-based security features without needing physical access. ⏲️ Microsoft's Response: Microsoft has acknowledged these vulnerabilities and issued advisories with mitigation advice, but a permanent fix is still in the works, six months after being reported. #CyberSecurity #InfoSec #MicrosoftWindows #VulnerabilityManagement #responsibledisclosure

19

🔒 Mastering Endpoint Security - Best Practices for 2024 🔓 Join our Check Point CheckMates Webinar on Onboarding & Best Practices for Harmony Endpoint (This time in English 😉 ), where Yehonatan Cohen will share his expertise and will dive into the best practices for deploying, optimizing, and boosting your Endpoint security experience with Harmony Endpoint. 📆 When - July 31. 💥 Register here - https://lnkd.in/dEddEWwN #Harmony #EndpointSecurity #BestPractices Check Point Software

64

1 Comment

🔔 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠 𝐀𝐥𝐞𝐫𝐭 :𝐅𝐑𝐄𝐄 𝐋𝐢𝐯𝐞 𝐂𝐫𝐚𝐬𝐡 𝐨𝐧 “𝐁𝐚𝐬𝐢𝐜 𝐌𝐚𝐥𝐰𝐚𝐫𝐞 𝐀𝐧𝐚𝐥𝐲𝐬𝐢𝐬” (2 hours) 📆 25th Sept(Wed) 2024 (7:00 pm IST - 9:00 pm IST) - Total duration 2 hours over zoom 👩‍🎓 𝐓𝐨𝐩𝐢𝐜𝐬 𝐂𝐨𝐯𝐞𝐫𝐞𝐝: 1️⃣ Approaching Malware Analysis and Lab Setup - tool selection 2️⃣Windows Internals quick overview - PE File, Virtual Memory, DLL, Windows API 3️⃣ Basic Malware Analysis - Static Analysis, dynamic Analysis, API logging and Analysis, Memory Analysis 4️⃣ Career options as a Malware Analyst The session would be be helpful if you want to pursue a career in the following areas related to Malware Analysis: 👉IR and Forensics 👉Threat Intelligence 👉SOC Analyst 👉Threat Hunting 👉Antivirus/ EDR/ Sandbox Engineer 👉Malware Detection Engineer 👉Work in Anti-Malware teams or Antivirus or EDR engine Developer in 𝐌𝐜𝐚𝐟𝐞𝐞, 𝐒𝐲𝐦𝐚𝐧𝐭𝐞𝐜, 𝐌𝐢𝐜𝐫𝐨𝐬𝐨𝐟𝐭, 𝐂𝐫𝐨𝐰𝐝𝐬𝐭𝐫𝐢𝐤𝐞, 𝐒𝐞𝐧𝐭𝐢𝐧e𝐥 𝐎𝐧𝐞, 𝐏𝐚𝐥𝐨 𝐀𝐥𝐭𝐨 𝐍𝐞𝐭𝐰𝐨𝐫𝐤𝐬, 𝐌𝐢𝐧𝐝𝐭𝐫𝐞𝐞, 𝐐𝐮𝐢𝐜𝐤 𝐇𝐞𝐚𝐥, 𝐙𝐬𝐜𝐚𝐥𝐞𝐫 and many more.. 👉Malware Developer for Red Teams 👉Other roles related to Malware Research, Malware Analysis and Reverse Engineering ➡ If interested, please fill up the form: https://lnkd.in/gdUc88W5 #Malware #Detection #APIAnalysis #Static #DynamicAnalysis #Ransomware

19

Just reported a Local code execution vulnerability to the Wiz Security Team. This flaw allows an attacker to gain reverse shell full access to a victim’s local workstation. I can’t share more details until the issue is resolved, but I hope it’s fixed soon. I am working with the Wiz security team. They acknowledged the issue in one of their client plugins, the potential impact is a local command injection for affected workstations. I'll provide more details once the Wiz team acknowledges the issue and implements a fix Edit: This issue has been fixed, and Wiz Released an advisory https://lnkd.in/gJp_Y8-W, will be releasing a detailed writeup soon. #infosec #bugbounty #security #sourcecodesecurity #zeroday

406

19 Comments

We can't afford to not have the firewall configured these days. SSH was an impenetrable and reliable system some time ago, although there were vulnerabilities. Now, we have both TerraPIN and RegreSSHion, that were created for the latest versions of SSH on default configurations. Oh the times, they are changing... #network #penetrationtesting #devops #riskmanagement #defence #cyber #cyberrisk #cybersec

2

Detecting & Blocking SQL Injection w/ Cato Networks SQL Injection is still a top attack method in 2024. Discover how Cato Networks safeguards your network from SQL injection attacks. Learn how to quickly detect and block malicious SQL injection attempts in this brief video.

5

🔒 #ICS Under Attack: How to Stay Secure 🔒 Recently, we've witnessed a significant rise in attacks targeting Industrial Control Systems, including incidents at the Municipal Water Authority of Aliquippa [1] and irrigation systems in Israel [2]. ICS manufacturers are responding by releasing numerous patches in a "patch Tuesday" fashion [3], however, in the OT space, having a patch is just the beginning; deploying it can be a complex and time-consuming task. So, how can you reduce your risk of getting hacked? As Rockwell Automation and CISA advises, "Disconnect Devices from the Internet" [4][5]. While this is sound advice, it's challenging to implement since organizations need to monitor and control these systems, often located in remote, hard-to-reach areas. What should defenders do? Place these systems behind a Remote Privileged Access Management (#RPAM) solution like Cyolo PRO (Privileged Remote Operations). Cyolo's solution provides Just In Time (#JIT) 1st and 3rd party #SRA, offering agentless access to many OT systems. 🎥 See it in action: Connecting to Rockwell PLC without an agent: https://lnkd.in/gHZTF_Kg Just In Time access via ServiceNow ticketing: https://lnkd.in/gy9tAHqH #CyberSecurity #IndustrialSecurity #OTSecurity #RemoteAccess [1] https://lnkd.in/gZjFTPrQ [2] https://lnkd.in/g6Td_6DB [3] https://lnkd.in/g_W5uRRX [4] https://lnkd.in/gt8tFja7 [5] https://lnkd.in/gmZZBtiz

16

⚠ CYBERSECURITY HIGHLIGHTS FOR THE WEEK ⚠ Threat Actor in Focus - Emerging Threat: Void Manticore’s Destructive Cyber Campaigns Targeting Israeli Organizations Threat Actors: Void Manticore Attack Type: Public-facing web server Objective: Espionage Target Technology: Windows Target Geographies: Israel Target Industries: Government & Critical Infrastructure Business Impact: Data Loss, Data exfiltration Summary: Void Manticore (aka Storm-842) is an Iranian state-sponsored threat actor known for conducting destructive attacks on Israeli organizations and leaking information through the online persona ‘Karma’ (sometimes written as KarMa). These operations often target sectors such as government, finance, and critical infrastructure, aligning with Iran’s broader offensive strategy. The group employs straightforward and efficient techniques aimed at causing rapid and significant damage. Their operations extend beyond Israel, with attacks also reported in Albania, where they use the persona ‘Homeland Justice’ to leak stolen data. In Israel, Void Manticore is notable for utilizing a custom wiper named BiBi, after Israeli Prime Minister Benjamin Netanyahu. One common method Void Manticore uses to gain access to target systems is through internet-facing web servers like CVE-2019-0604, where they deploy web shells like the custom “Karma Shell.” This tool, disguised as an error page, can list directories, create processes, upload files, and manage services, using simple encryption methods like base64 and one-byte XOR for obfuscation. They have also been observed uploading a custom executable, do.exe, which checks for Domain Admin credentials. Upon successful authentication, it installs another web shell, reGeorge, indicating valid credentials. This suggests the initial access might be facilitated by another entity, possibly Scarred Manticore, a more sophisticated threat actor. Continue reading here ➡ https://lnkd.in/gvR_-7wt #CyberSecurity #Cyfirma #ETLM #externalthreatlandscape #ThreatIntelligence #CyberIntelligence #CYFIRMAResearch #malware #ransomware #threatactor #cybersecurityawareness Kumar Ritesh Dr. Saurabh Lal, P.D. Michael Henry Anna Koh Amit Thakur Harry Lee Glaiza Pardilla Harsha Vardhan Sam Parmar Rahul Raghav Yusuke Tateno Chiaki Izena（伊是名千晶）Greg Baylis David Plummer Rakesh R V Nicko Navarrete Ruri A. Hyungchan Mike Cho Montai Saiaroon Huy. Nguyen Tuong Vinh Dudley Swanepoel Mouli Saha Greg Baylis Vincent Cheng Julius S.

13

🚀 CTI Workshop at BSides Athens 2024! 🚀 🧱 "Block By Block: Building Your CTI Program" 🧱 Join me on June 29, 2024, for a 2-hour workshop designed to simplify the complexities of Cyber Threat Intelligence (CTI) and provide a clear roadmap to develop your own CTI program. 🔍 What will you gain? - Understand the foundational principles of CTI and its critical role in cyber threat management. - Learn the steps to initiate a CTI program and integrate it seamlessly into your business processes. - Discover practical strategies for quick wins and establishing core CTI capabilities. - Explore how to leverage technology to empower your CTI efforts, enhance the skills of CTI analysts, and use maturity models to measure and boost your program's effectiveness. 🎯 Who should attend? - Cybersecurity professionals at any stage of CTI implementation, from those considering starting a program to those refining an existing one. - Business leaders looking to understand how CTI can safeguard and add value to their operations. 📅 Mark Your Calendar! Date: June 29, 2024 Event: BSides Athens 2024 Session: Block By Block: Building Your CTI Program Don’t miss this chance to transform your approach to cyber threat intelligence. Whether you're starting from scratch or scaling up, this workshop will arm you with the insights and tools you need to succeed. 🔗Link to BSides Athens 2024 Agenda -https://lnkd.in/dFdV3J_H See you on Saturday! #BSidesAthens #CyberSecurity #CTI #ThreatIntelligence #InfoSec #threatintel #BSides #threatmanagement #cyberthreat #training #athens #greece

236

3 Comments

Debug Bar Exposes Sensitive Information Vuln-Info][common-01-02][Tentative-High] - https://example.com [Sign-Info][Tentative-High] - /home/kali/jaeles-signatures/common/phpdebug.yaml - PHP Debug bar  subfinder -d your-target-domain | httpx -silent | anew | xargs -I@ jaeles scan -L 4 -c 20 -s ~/jaeles-signatures/* -u @ -o your-target-domain_jaeles.txt Vulnerability Details: Title: PHP Debug Bar Exposing Sensitive Information Severity: Medium Vulnerability Summary: This vulnerability exposes a potential security hole that could result in the exposure of sensitive data through the PHP Debug Bar, a development tool frequently used to inspect and profile PHP applications. https://lnkd.in/eTJrH5vt .

2

How to Use Proxychains https://lnkd.in/e3-H2Rdm

6

I am thrilled to share that I have been recognized as one of the top contributors in the CVE category of Israel National Cyber Directorate - מערך הסייבר הלאומי for June. This is also a good time to remind everyone: If you find a vulnerability (whether it's a 0-day or a 1-day) in an Israeli digital asset exposed to the internet, there's one address to report it to help us protect the country in the cyber realm: 119@cyber.gov.il

26

5 Comments

The Not-Petya Incident of 2017 During the CISO course at See-Security: Cyber & Information Security College, we were divided into groups to create a graded presentation. Eyal Cohen and I were tasked with researching and delivering the presentation to our peers and Kobi Pinto (faculty member) as the testing professor. The lecture ended with a Q/A session. We researched and analyzed the NotPetya incident of 2017. 👾What is NotPetya? NotPetya was the first politically targeted wiper malware of its scale, the malware aimed to damage Ukraine’s critical infrastructure disguised as ransomware that cost the world over 10B$. Its infection spread to over 300 companies in less than 9 minutes. ❖ NotPetya relied on the same propagation techniques as the WannaCry incident that occurred in the previous month. The SMBv1 exploits were leaked and patched over two months before the incident. ❖ Many companies still fail to grasp the direct link between technological failure, security incidents and the physical effect imposed on our day to day lives.  E.G: • Malfunctioning ATM systems == People are unable to purchase medication, food or gas. • Malfunctioning metro systems == Can’t get to work via public transportation • Malfunctioning to hospital database == Can’t get patient's medical record ❖ About The presentation: We explored different angles of the incident: 1. Political background 2. Parties involved 3. Damage to infrastructure 4. Attack process - technical breakdown 5. IR walkthrough of A.P. Moller - Maersk (Shipping company) 6. IOCs 7. Lessons learned To summarize… TEST AND DEPLOY SECURITY PATCHES! 🔐 ❖ Link to the full presentation:  https://lnkd.in/dTEGvTnj #CISO #Cybersecurity #NotPetya #WannaCry #IR #Education #SecurityUpdates

10

Next week Elad Pticha and I will speak at BSidesLV about Argo CD and GitOps security. We'll present a critical vulnerability in Argo CD that allows an attacker to take over the cloud environment. ☸️ On a personal note, this will be my first time presenting at a conference of this scale, and I couldn't be more excited! 😊 If you are in Las Vegas, join our session to learn how to securely use GitOps in your organization: 🛡️ https://lnkd.in/dyMsFpf2 Cycode | Complete ASPM #aspm #argocd #developersecurity #applicationsecurity #appsec #gitops #vulnerabilities #cybersecurity

61

4 Comments

Dear Linkedin network, if you need a guy who is passionate on innovative in-the-wild zero-day exploit detection and advanced vulnerability research (Windows platforms only), please let me know. :) Meanwhile, I will be on a mixed style of vacations and personal projects. I will continue to work on my stuff such as EXPMON (https://pub.expmon.com), so maybe you will see more activities from @EXPMON_, maybe.. :) (follow @EXPMON_ at Twitter/X for fresh discoveries and activities) During the last 1.5 years, I've published several of my original research addressing previously-unknown zero-days and attack vectors in Outlook/Office/Windows on CPR blog site, as well as driven exploit detection innovations internally across products. I'm proud of the work (I did save my publications as PDFs, as I treat them as "arts" :)), and hopefully it helped and will help the industry/community for better detection and defense in long term. I tried to go the way "performing research to understand how it works" and "using knowledge gained from research to drive itw exploit detection". The mission continues, regardless. :) * Following are the Publications and Links. Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112) https://lnkd.in/d_vm7_Pt The Risks of the #MonikerLink Bug in Microsoft Outlook and the Big Picture https://lnkd.in/gzTWUVs5 The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors https://lnkd.in/gv5HAac6 Abusing Microsoft Access "Linked Table" Feature to Perform NTLM Forced Authentication Attacks https://lnkd.in/dJbYj4DX QueueJumper: Critical Unauthenticated RCE Vulnerability in MSMQ Service https://lnkd.in/gGFsmCUw

58

A tactical security testing program can runaway with this years budget. - Constant bounty payments - Endless scoping calls - Noisy duplicate reports A strategic security testing program shapes next years budget. - The program is predicable - Gives teams control - Adressss the root-cause #ptaas #securitytesting #pentesting #bugbounty

5

2 Comments