Hindsight - Internet History Forensics For Google Chrome/Chromium

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications with more to come!. Hindsight can parse a number of different types of web artifacts, including URLs, download...

Apple OS Update Lifts Curtain on iPhone USB Restricted Mode

Apple has officially added a controversial security feature, USB Restricted Mode, to iPhones as part of its new iOS 11.4.1, released on Monday. The feature removes the infamous iPhone USB access feature, blocking out hackers – but also potentially law enforcement – from accessing a locked phone’s...

Guasap - WhatsApp Forensic Tool

The Guasap Forensic implemented in Python under the GNU General Public License, for the extraction and analysis of files, data bases and logs for forensic WhatsApp. What it does? 1. Check root in device 2. Extract DB and multimedia files no root 3. Extract and analyze deleted messages and others ...

Typeform, Popular Online Survey Software, Suffers Data Breach

Typeform, the popular Spanish-based online data collection company specializes in form building and online surveys for businesses worldwide, has today disclosed that the company has suffered a data breach that exposed partial data of its some users. The company identified the breach on June 27th,...

Ticketmaster Suffers Security Breach – Personal and Payment Data Stolen

Global entertainment ticketing service Ticketmaster has admitted that the company has suffered a security breach, warning customers that their personal and payment information may have been accessed by an unknown third-party. The company has blamed a third-party support customer service chat...

DEBIAN-CVE-2018-11723

The libpffnametoidmapentryread function in libpffnametoidmap.c in libyal libpff through 2018-04-28 allows remote attackers to cause an information disclosure heap-based buffer over-read via a crafted pff file. NOTE: the vendor has disputed this as described in libyal/libpff issue 66 on GitHub...

Collecting & Hunting For IOCs With Gusto and Style: rastrea2r

Ever wanted to turn your AV console into an Incident Response & Threat Hunting machine? Rastrea2r pronounced “rastreador” – hunter- in Spanish is a multi-platform open source tool that allows incident responders and SOC analysts to triage suspect systems and hunt for Indicators of Compromise IOCs...

Banco de Chile Wiper Attack Just a Cover for $10M SWIFT Heist

A cyberattack against Chile’s largest financial institution last month, which reportedly destroyed 9,000 workstations and 500 servers, was actually cover for a larger plot to compromise endpoints handling transactions on the SWIFT network. When the dust settled on the attacks, investigators said...

Unix / Linux Running Processes Information

Generated report details the running processes on the target machine at scan time. This plugin is informative only and could be used for forensic investigation, malware detection, and to confirm that your system processes conform to your system policies. TRUSTED...

The Sleuth Kit Buffer Overflow Vulnerability (CNVD-2018-14708)

The Sleuth Kit TSK is a collection of data forensic tools developed by software developer Brian Carrier. The tools are able to analyze file systems such as FAT, NTFS, UFS, etc. and provide detailed information about the file system, including deleted data. A buffer overflow vulnerability exists i...

MyHeritage Says Over 92 Million User Accounts Have Been Compromised

MyHeritage, the Israel-based DNA testing service designed to investigate family history, has disclosed that the company website was breached last year by unknown attackers, who stole login credentials of its more than 92 million customers. The company learned about the breach on June 4, 2018, aft...

IBM QRadar SIEM Code Execution / Authentication Bypass

Hi all, 3 vulns in IBM QRadar SIEM that when chained allow an attacker to achieve unauthenticated RCE as root on the QRadar host. IBM have only attributed on CVE for all 3 vulns, and they have a combined CVSS score of 5.6. So totally own a SIEM = 5.6 CVSS. Sounds right to me. A special thanks to...

eVestigator Forensic PenTester Remote Code Execution Vulnerability

eVestigator Forensic PenTester is an Android App. A remote code execution vulnerability exists in eVestigator Forensic PenTester. An attacker can exploit this vulnerability to execute arbitrary code in the context of the application by performing a man-in-the-middle attack...

[SECURITY] Fedora 28 Update: afflib-3.7.16-4.fc28

AFF=EF=BF=BD=EF=BF=BD is an open and extensible file format designed to sto re disk images and associated metadata. afflib is library for support of the Advanced Forensic Format AFF...

AFFLIB Denial of Service Vulnerability

AFFLIB aka AFFLIBv3 is an open source library of functions for manipulating Advanced Forensic Format AFF files. A security vulnerability exists in the 'afgetpage' function in the lib/afflibpages.cpp file in AFFLIB 3.7.16 and earlier versions. A remote attacker can exploit this vulnerability to...

Huawei Mate 9 Pro Forensic Bypass Vulnerability

Huawei Mate 9 Pro is a smartphone from Huawei Huawei. A forensic bypass vulnerability in the voice wake-up module in the Huawei Mate 9 Pro phone could allow an attacker to trick a user into installing a malicious application, bypass authentication, and take control of the phone to send a short...

Contain Attacks in Real Time with Live Response in Cb Defense

Endpoint security is broken. Yes, you’ve heard it before - traditional, signature-based antivirus AV can’t keep up with the volume of new malware and advanced attack methods being developed by cyber criminals every day. And that’s absolutely true. But a report published last year highlights an ev...

Apple Tackles Cellebrite Unlock Claims, Sort Of

In the wake of claims that Israeli company Cellebrite has developed an unlocking tool for any iPhone, Apple is urging customers to upgrade to the latest version of iOS 11. Apple’s response falls well short of a full-throated debunk of the iPhone hack, but suggest some merit to the claim – hence a...

Huawei Honor V9 Play Forensic Bypass Vulnerability

Huawei Honor V9 Play is a smartphone from Chinese company Huawei Huawei. A component in the Huawei Honor V9 Play phone suffers from a forensic bypass vulnerability, where an attacker can bypass the necessary forensic process and delete the phone's fingerprints through specific actions...

Huawei Duke-L09 Forensic Bypass Vulnerability

The Huawei Duke-L09 is a smartphone from the Chinese company Huawei Huawei. A forensic bypass vulnerability exists in the Huawei Duke-L09 "phone recovery" feature. The vulnerability is due to the device failing to reasonably implement the authentication feature. An attacker can exploit this...