sigma - Generic Signature Format for SIEM Systems

Generic Signature Format for SIEM Systems. What is Sigma? Sigma is a generic and open signature format that allows you to describe relevant log events in a straight forward manner. The rule format is very flexible, easy to write and applicable to any type of log file. The main purpose of this...

yara/dex_fuzzer: Heap-buffer-overflow in yr_object_set_string

Detailed report: https://oss-fuzz.com/testcase?key=5648916683948032 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 12 Crash Address: 0x61b000000d8e Crash State: yrobjectsetstring...

yara/dex_fuzzer: Heap-buffer-overflow in read_uleb128

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5150212461953024 Project: yara Fuzzer: aflyaradexfuzzer Fuzz target binary: dexfuzzer Job Type: aflasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x612000000900...

yara/dex_fuzzer: Crash in __msan_memcpy.part.49

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5919363380019200 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x72e000020000 Cras...

yara/dex_fuzzer: Heap-buffer-overflow in dex_parse

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5104899873308672 Project: yara Fuzzer: aflyaradexfuzzer Fuzz target binary: dexfuzzer Job Type: aflasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x62e0000178f8...

yara/dex_fuzzer: Crash in yr_object_set_string

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=4773665418772480 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerubsanyara Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x0000ef8d0fc2 Cra...

yara/dex_fuzzer: Heap-buffer-overflow in yr_object_set_string

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5055193814138880 Project: yara Fuzzer: libFuzzeryaradexfuzzer Fuzz target binary: dexfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ Crash Address:...

BSides NYC, a volunteer organized event put on by and for the community

Another edition of BSides NYC has passed, and as first time attendee and presenter, I was genuinely impressed with the impeccable organization, the content shared, and the interesting conversations that took place among enthusiasts and professionals from all over the world. I've been a long time...

Microsoft Office - Composite Moniker Remote Code Execution

Microsoft Office - Composite Moniker Remote Code Execution What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using th...

Microsoft Office - 'Composite Moniker Remote Code Execution

What? This repo contains a Proof of Concept exploit for CVE-2017-8570, a.k.a the "Composite Moniker" vulnerability. This demonstrates using the Packager.dll trick to drop an sct file into the %TEMP% directory, and then execute it using the primitive that the vulnerability provides. Download:...

How public-private partnerships can combat cyber adversaries

For several years now, policymakers and practitioners from governments, CERTs, and the security industry have been speaking about the importance of public-private partnerships as an essential part of combating cyber threats. It is impossible to attend a security conference without a keynote...

yara/macho_fuzzer: Heap-buffer-overflow in macho_handle_segment_64_be

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5917108346028032 Project: yara Fuzzer: libFuzzeryaramachofuzzer Fuzz target binary: machofuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address:...

yara/macho_fuzzer: Use-of-uninitialized-value in macho_parse_file_32_be

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5168348309487616 Project: yara Fuzzer: libFuzzeryaramachofuzzer Fuzz target binary: machofuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

IT threat evolution Q3 2017

Targeted attacks and malware campaigns Re-enter the dragon In July, we reported on the recent activities of a targeted attack group called 'Spring Dragon' also known as LotusBlossom, whose activities data back to 2012. Spring Dragon makes extensive use of spear-phishing and watering-hole attacks...

yara/rules_fuzzer: Use-of-uninitialized-value in _yr_atoms_choose

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5753694386651136 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

yara/rules_fuzzer: Use-of-uninitialized-value in yr_hash_table_lookup_raw_key

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5732726943514624 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

yara/rules_fuzzer: Use-of-uninitialized-value in hex_yylex

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=5637751744495616 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

yara/rules_fuzzer: Use-of-uninitialized-value in yr_arena_destroy

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=6753625905823744 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

yara/rules_fuzzer: Use-of-uninitialized-value in re_yy_scan_string

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=4791136381042688 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

yara/rules_fuzzer: Heap-double-free in yara_yyparse

Project: https://github.com/VirusTotal/yara.git Detailed report: https://oss-fuzz.com/testcase?key=6474914958671872 Project: yara Fuzzer: libFuzzeryararulesfuzzer Fuzz target binary: rulesfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-double-free Crash Address:...