Pegasus spyware creator ordered to reveal code used to spy on WhatsApp users

A California federal judge has ordered spyware maker NSO Group to hand over the code for Pegasus and other spyware products that were used to spy on WhatsApp users. Meta-owned WhatsApp has been fighting NSO in court since 2019, after Pegasus was allegedly used against 1,400 WhatsApp users over th...

WhatsApp lawsuit against NSO Group greenlit by Supreme Court

On Monday, the US Supreme Court denied the NSO Group's petition for a writ of certiorari, a request to the high court to review its case, signaling that Meta's WhatsApp can go ahead with its case against the Israeli-based company behind the Pegasus spyware. The court didn't explain why it refused...

Apple Lawsuit Amps Up Pressure on Pegasus Spyware-Maker

In the wake of a zero-click zero-day exploit that was deployed against iPhone users, Apple has filed a lawsuit against NSO Group. The complaint alleges that the maker of the infamous Pegasus mobile spyware is responsible for the illegal surveillance of Apple users. The computing giant is looking...

Black Hat: Let’s All Help Cyber-Immunize Each Other

LAS VEGAS – The in-person Black Hat USA 2021 cybersecurity conference is back, after a pandemic-forced, year-long hiatus, with attendance notably down but spirts up among attendees eager to get back to networking, learning and returning to some normalcy. Event founder Jeff Moss kicked off...

Shellex - C-shellcode To Hex Converter, Handy Tool For Paste And Execute Shellcodes In Gdb, Windbg, Radare2, Ollydbg, X64Dbg, Immunity Debugger And 010 Editor

C-shellcode to hex converter. Handy tool for paste & execute shellcodes in gdb, windbg, radare2, ollydbg, x64dbg, immunity debugger & 010 editor. Are you having problems converting C-shellcodes to HEX maybe c-comments+ASCII mixed? Here is shellex. If the shellcode can be compiled in a C compiler...

Immunity Canvas: SMBGHOST

Name| SMBGHOST ---|--- CVE| CVE-2020-0796-1 Exploit Pack| CANVAS Description| SMBGHOST Notes| CVE Name: CVE-2020-0796 VENDOR: Microsoft NOTES: some notes here VersionsAffected: VERSIONS Repeatability: None References:...

Immunity Canvas: SMBGHOST_LPE

Name| smbghostlpe ---|--- CVE| CVE-2020-0796 Exploit Pack| CANVAS Description| smbghostlpe Notes| CVE Name: CVE-2020-0796 Notes: Tested: - Windows 10 1903 x64 - Windows 10 1909 x64 VENDOR: Microsoft CVE Url: https://nvd.nist.gov/vuln/detail/CVE-2020-0796 CVSS: 10.0...

Immunity Canvas: OWA_RCE

Name| owarce ---|--- CVE| CVE-2020-0688 Exploit Pack| CANVAS Description| owarce Notes| CVE Name: CVE-2020-0688 VENDOR: Microsoft NOTES: This exploit has been tested on Microsoft Exchange Server 2016 CU 15 VersionsAffected: VERSIONS Repeatability: Infinite References:...

Immunity Canvas: SSRS_VIEWSTATE_RCE

Name| ssrsviewstaterce ---|--- CVE| CVE-2020-0618 Exploit Pack| CANVAS Description| ssrsviewstaterce Notes| CVE Name: CVE-2020-0618 VENDOR: Microsoft NOTES: This exploit has been tested on SQL Server 2016 VersionsAffected: VERSIONS Repeatability: Infinite References:...

Immunity Canvas: ZABBIX

Name| zabbix ---|--- CVE| CVE-2013-3628 Exploit Pack| CANVAS Description| Zabbix = 2.0.8 PHP File inclusion exploit Notes| Repeatability: Infinite VENDOR: Zabbix CVE Url: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2013-3628 CVE Name: CVE-2013-3628...

Immunity Canvas: NETSCALER_TRAVERSAL_RCE

Name| netscalertraversalrce ---|--- CVE| CVE-2019-19781 Exploit Pack| CANVAS Description| netscalertraversalrce Notes| CVE Name: CVE-2019-19781 VENDOR: Citrix NOTES: This version of the module will take care of all our artifacts and will report them just to be safe in case something went wrong...

Immunity Canvas: RCONFIG_AJAXSERVER_RCE

Name| rconfigajaxserverrce ---|--- CVE| CVE-2019-16662 Exploit Pack| CANVAS Description| rconfigajaxserverrce Notes| CVE Name: CVE-2019-16662 VENDOR: rConfig NOTES: The current exploit initializes a tcp server to serve the mosdef callback port 8080 IMPORTANT: In the path textfield you need the pa...

Immunity Canvas: ERROR_REPORTING_LPE

Name| errorreportinglpe ---|--- CVE| CVE-2019-1315 Exploit Pack| CANVAS Description| Windows Error Reporting Manager arbitrary file move LPE Notes| CVE Name: CVE-2019-1315 Notes: Repeatability: Once IMPORTANT: This Local Privilege Escalation exploit module only works without internet conection Th...

Immunity Canvas: VBULLETIN_WIDGET_RCE

Name| vbulletinwidgetrce ---|--- CVE| CVE-2019-16759 Exploit Pack| CANVAS Description| RCE via widgetConfigcode paramater in vBulletin Notes| CVE Name: CVE-2019-16759 VENDOR: vBulletin NOTES: An unauthenticated code execution bug can be exploited on the vBulletin core for the following versions:...

Immunity Canvas: ALPC_APPXEDGE_LPE

Name| alpcappxedgelpe ---|--- CVE| CVE-2019-1253 Exploit Pack| CANVAS Description| ALPC Appx Edge LPE Notes| CVE Name: CVE-2019-1253 Notes: Affected versions: Windows 10 1703 x64 Windows 10 1703 x86 Windows 10 1709 x64 Windows 10 1709 x86 Windows 10 1803 x64 Windows 10 1803 x86 Windows 10 1809 x6...

A week in security (July 22 – 28)

Last week on Malwarebytes Labs, we offered an extensive analysis into the Malaysian Airlines Flight 17 investigation, updated users on the newest feature set to AdwCleaner 7.4.0 it now detects pre-installed software, and provided a deep dive into Phobos ransomware. We also broke down the latest...

Fearing WannaCry-Level Danger, Enterprises Wrestle with BlueKeep

The nightmare vision of a “mega-worm” global BlueKeep infection could be closer to becoming reality as working exploits are now becoming available to the public, and there’s evidence that adversaries are actively scanning for the vulnerability. Researchers weighed in with Threatpost about how...

Immunity Canvas: SNAPD_UID_OVERWRITE

Name| snapduidoverwrite ---|--- CVE| CVE-2019-7304 Exploit Pack| CANVAS Description| snapduidoverwrite Notes| CVE Name: CVE-2019-7304 VENDOR: snapd team NOTES: The snapd service runs as an REST API using a Unix Domain Socket, is possible to send request when the uid is 0 root, the vulnerability i...

Immunity Canvas: DDE_CLOSEHANDLE_LPE

Name| ddeclosehandlelpe ---|--- CVE| CVE-2019-0803 Exploit Pack| CANVAS Description| ddeclosehandlelpe Notes| CVE Name: CVE-2019-0803 Notes: Tested: - Windows 7 x64 - Windows 10 x64 1703 VENDOR: Microsoft CVE Url: https://nvd.nist.gov/vuln/detail/CVE-2019-0803 CVSS: 7.8...

Immunity Canvas: ALPC_TAKEOVER_LPE

Name| alpctakeoverlpe ---|--- CVE| CVE-2019-0841 Exploit Pack| CANVAS Description| ALPC Takeover LPE Notes| CVE Name: CVE-2019-0841 NOTES: Works with Medium Integrity Level Tested: - Windows 10 1703 x64 - Windows 10 1709 x64 - Windows 10 1803 x86, x64 - Windows 10 1809 x86, x64 VENDOR: Microsoft...