Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2025.01.14.md

Azure CLI Token Leak - https://binsec.no/posts/2024/11/az-cli-acr-token-leak

Banshee: The Stealer That “Stole Code” From MacOS XProtect - https://research.checkpoint.com/2025/banshee-macos-stealer-that-stole-code-from-macos-xprotect/

The Ruby on Rails _json Juggling Attack - https://nastystereo.com/security/rails-_json-juggling-attack.html

Write, debug and execute BOFs using bof-launcher (part 1) - https://blog.z-labs.eu/2024/12/02/write-debug-and-execute-bofs-part1.html

Exploiting SSTI in a Modern Spring Boot Application (3.3.4) - https://modzero.com/en/blog/spring_boot_ssti/

#informatyka

Czego mi brakuje w 21 wieku:

Żebym miał jeden wspólny schowek, ekran, głośność i karty w przeglądarce pomiędzy wszystkimi urządzeniami.

Trochę tak jakby pomaga samsung DEX i łącze do windows ale to jeszcze nie to.

#informatyka #problemypierwszegoswiata #gownowpis

Prelekcja na temat historii przypadku z firmy produkcyjnej, w której jeden klik admina doprowadził do poważnego incydentu bezpieczeństwa (ransomware). Dowiecie się, jakie błędy zostały popełnione, co można było zrobić inaczej i jak te doświadczenia kładą fundamenty pod wdrożenie dyrektywy NIS2. Artur opowie o zmianach w organizacji, które miały na celu poprawę bezpieczeństwa oraz wyciągniętych wnioskach.

[#536] Z ransomware do NIS2 - Artur Markiewicz

SysOps / DevOps Polska

https://youtu.be/bwOI37RAWRU

#cyberbezpieczenstwo #cybersecurity #ransomware #informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2025.01.12.md

Tracking Deployment of Russian Surveillance Technologies in Central Asia and Latin America - https://www.recordedfuture.com/research/tracking-deployment-russian-surveillance-technologies-central-asia-latin-america

Vulnerabilities of Realtek SD card reader driver, part 1 - https://zwclose.github.io/2024/10/14/rtsper1.html

Detonating Beacons to Illuminate Detection Gaps - https://www.elastic.co/security-labs/detonating-beacons-to-illuminate-detection-gaps

The unexpected effects of GPS spoofing on aviation safety - https://www.pentestpartners.com/security-blog/the-unexpected-effects-of-gps-spoofing-on-aviation-safety/

Android's CVE-2020-0401 (PackageManagerService) - https://pwner.gg/blog/Android's-CVE-2020-0401

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2025.01.10.md

Pi in the Pentium: reverse-engineering the constants in its floating-point unit - https://www.righto.com/2025/01/pentium-floating-point-ROM.html

CSPT the Eval Villain Way! - https://blog.doyensec.com/2024/12/03/cspt-with-eval-villain.html

DroidBot: Insights from a new Turkish MaaS fraud operation - https://www.cleafy.com/cleafy-labs/droidbot-insights-from-a-new-turkish-maas-fraud-operation

Reverse Engineering and Dismantling Kekz Headphonesm - https://nv1t.github.io/blog/kekz-headphones/

SELinux bypasses - https://klecko.github.io/posts/selinux-bypasses/

#informatyka

Pomocy! Są tu jacyś eksperci od maili? poczty? Thunderbirda? Hostingu? Magii?

Dlaczego w przypadku b mail nie dochodzi? (Serwer nadawczy we wszystkich przypadkach jest ten sam na Seohost)

#informatyka #hosting #email #thunderbird #hejtopomaga #hejtopomoc #pomoc #pytanie #kiciochpytahejto

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2025.01.08.md

An unexpected journey into Microsoft Defender's signature World - https://retooling.io/blog/an-unexpected-journey-into-microsoft-defenders-signature-world

MSI Shenanigans. Part 1 – Offensive Capabilities Overview - https://mgeeky.tech/msi-shenanigans-part-1/

the LLM vulnerability scanner - https://github.com/NVIDIA/garak

OAuth Labs: OAuth 2.0 Vulnerabilites - https://cyllective.com/blog/posts/oauth-labs

Finding Bugs in Kernel. Part 1: Crashing a Vulnerable Driver with Syzkaller - https://slavamoskvin.com/finding-bugs-in-kernel.-part-1-crashing-a-vulnerable-driver-with-syzkaller/

#informatyka

if [ $(date +%m) == ‘01’ -a $(date +%d) == ‘07’ ]

then

let “wiek++”

fi

#informatyka #urodziny #linux #bash #heheszki

P.S. pijcie ze mną kompot i częstujcie się po kawałku.

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2025.01.06.md

LDAPNightmare: SafeBreach Labs Publishes First Proof-of-Concept Exploit for CVE-2024-49113 - https://www.safebreach.com/blog/ldapnightmare-safebreach-labs-publishes-first-proof-of-concept-exploit-for-cve-2024-49113/

The Day We Unveiled the Secret Rotation Illusion - https://www.clutch.security/blog/the-day-we-unveiled-the-secret-rotation-illusion

MSSQL Identified as Vulnerable to Emoji String Exploitation - https://decrypt.lol/posts/2024/11/29/mssql-identified-as-vulnerable-to-emoji-string-exploitation/

hGPU-accelerated hash cracker with Rust and CUDA - https://vaktibabat.github.io/posts/cudacracker/

Reasons to Not Be Hard on Yourself (CTFs) - https://blog.c0nrad.io/posts/be-kind-to-self/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2025.01.04.md

Recent Cases of Watering Hole Attacks, Part 1 - https://blogs.jpcert.or.jp/en/2024/12/watering_hole_attack_part1.html

Attacking UNIX Systems via CUPS, Part I - https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/

PrivEsc: Abusing the Service Control Manager for Stealthy & Persistent LPE - https://0xv1n.github.io/posts/scmanager/

AWS Organizations Defaults & Pivoting - https://hackingthe.cloud/aws/general-knowledge/aws_organizations_defaults/

Publishing Trail of Bits’ CodeQL queries - https://blog.trailofbits.com/2023/12/06/publishing-trail-of-bits-codeql-queries/

#informatyka

https://youtu.be/b4xBNpWk89g

#newag #informatyka #polska

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2025.01.02.md

Widespread compromise possible Ruijie Networks cloud platform vulnerabilities - https://www.scworld.com/brief/widespread-compromise-possible-ruijie-networks-cloud-platform-vulnerabilities

Forget PSEXEC: DCOM Upload & Execute Backdoor - https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor

Performing AD LDAP Queries Like a Ninja - https://cravaterouge.com/articles/ldapad-logging/

Write your Own Virtual Machine - https://www.jmeiners.com/lc3-vm/

How webcams with focus control work (Razer Kiyo Pro repair) - https://www.downtowndougbrown.com/2024/12/how-webcams-with-focus-control-work-razer-kiyo-pro-repair/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.12.31.md

Malicious Go Binary Delivered via Steganography in PyPI - https://blog.phylum.io/malicious-go-binary-delivered-via-steganography-in-pypi/

Hiding Linux Processes with Bind Mounts - https://righteousit.com/2024/07/24/hiding-linux-processes-with-bind-mounts/

Reverse Engineering The Stream Deck Plus - https://den.dev/blog/reverse-engineer-stream-deck-plus/

Performing AD LDAP Queries Like a Ninja - https://cravaterouge.com/articles/ldapad-logging/

Powershell Digital Forensics & Incident Response (DFIR) - https://github.com/Bert-JanP/Incident-Response-Powershell

#informatyka

Jest tu jakaś kreatywna głowa potrafiąca zaprojektować logo i logotyp?

Może być AI, bez znaczenia.

Szczegóły i płatność ustalimy na priv

#informatyka #komputery #grafika #grafika3d

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.12.29.md

Stealth in the Cloud: How APT36's ElizaRAT is Redefining Cyber Espionage - https://www.reco.ai/blog/how-apt36-elizarat-redefines-cyber-espionage

How to Hack a Drone - https://thecybershow.blogspot.com/

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection - https://flatt.tech/research/posts/compromising-openwrt-supply-chain-sha256-collision/

On the Applicability of the Timeroasting Attack - https://snovvcrash.rocks/2024/12/08/applicability-of-the-timeroasting-attack.html

x64 Assembly & Shellcoding 101 - https://g3tsyst3m.github.io/shellcoding/assembly/debugging/x64-Assembly-&-Shellcoding-101/

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.12.27.md

Reproducing CVE-2024-10979: A Step-by-Step Guide - https://redrays.io/blog/reproducing-cve-2024-10979-a-step-by-step-guide/

Inside a New OT/IoT Cyberweapon: IOCONTROL - https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol

UEPOTB, LNK edition - https://windowsir.blogspot.com/2024/12/uepotb-lnk-edition.html

Making TOCTOU Great again - X(R)IP - https://www.onekey.com/resource/making-toctou-great-again-xrip

The Ultimate Handheld Hacking Device - My Experience with NetHunter - https://andy.codes/blog/security_articles/2024-11-27-the-ultimate-handheld-hacking-device.html

#informatyka

Link on Github --> https://github.com/Nieuport/news-and-links/blob/gh-pages/docs/2024.12.25.md

I’m Lovin’ It: Exploiting McDonald’s APIs to hijack deliveries and order food for a penny - https://eaton-works.com/2024/12/19/mcdelivery-india-hack/

Clipping the Canary’s wings: Bypassing AiTM Phishing Detections - https://insights.spotit.be/2024/06/03/clipping-the-canarys-wings-bypassing-aitm-phishing-detections/

Redis CVE-2024-31449: How to Reproduce and Mitigate the Vulnerability - https://redrays.io/blog/redis-cve-2024-31449-how-to-reproduce-and-mitigate-the-vulnerability/

Windows Sockets: From Registered I/O to SYSTEM Privileges - https://blog.exodusintel.com/2024/12/02/

Hacking a Smart Home Device - https://jmswrnr.com/blog/hacking-a-smart-home-device

#informatyka