fn_fuzzy: Fast Multiple Binary Diffing Triage with IDA

Summary This week at HITBSecConf, Takahiro Haruyama, a Senior Threat Researcher for the CB Threat Analysis Unit TAU, presented his work on fnfuzzy, a tool which aims to help researchers and reverse engineers triage samples quicker. This blog post details the motivation for and current standing of...

Encrypted Messaging Project "Matrix" Suffers Extensive Cyber Attack

Matrix—the organization behind an open source project that offers a protocol for secure and decentralized real-time communication—has suffered a massive cyber attack after unknown attackers gained access to the servers hosting its official website and data. Hackers defaced Matrix's website, and...

Mimikatz v2.2.0 - A Post-Exploitation Tool to Extract Plaintexts Passwords, Hash, PIN Code from Memory

mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. But that's not all!...

Cybercriminals Have a Heyday with WinRAR Bug in Fresh Campaigns

A recently discovered vulnerability in the WinRAR file archival utility has been exploited in a slew of new campaigns, including one with a never-before-seen payload. The flurry of activity shows no sign of waning as cybercriminals continue to find success exploiting the bug. The campaigns take...

High-Power Hash Cracking with NPK

Password hashes are an everyday part of life in Coalfire Labs. Barring any other low-hanging fruit, its not uncommon for a penetration test to hinge on recovering a plaintext password from one of these hashes. Whether its NTLM hashes from Active Directory, NetNTLMv2 from Responder, WPA2 PMK from ...

Open redirect

Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perform SMB relay attacks upon a direct launch of the product, or upon an indirect launch via an integration such as Chrome, Firefox, Word, Outlook, etc. This occu...

CVE-2019-9565

Druide Antidote RX, HD, 8 before 8.05.2287, 9 before 9.5.3937 and 10 before 10.1.2147 allows remote attackers to steal NTLM hashes or perform SMB relay attacks upon a direct launch of the product, or upon an indirect launch via an integration such as Chrome, Firefox, Word, Outlook, etc. This occu...

CVE-2019-9565

CVE-2019-9565 affects Druide Antidote RX, HD, and older builds (8 before 8.05.2287, 9 before 9.5.3937, 10 before 10.1.2147). The issue enables remote attackers to steal NTLM hashes or perform SMB relay attacks when the product is launched directly or via integrated apps (Chrome, Firefox, Word, Ou...

Ophcrack - A Windows Password Cracker Based On Rainbow Tables

Ophcrack is a free Windows password cracker based on rainbow tables. It is a very efficient implementation of rainbow tables done by the inventors of the method. It comes with a Graphical User Interface and runs on multiple platforms. Features: Runs on Windows, Linux/Unix, Mac OS X, ... Cracks LM...

Threat Roundup for Feb. 15 to Feb. 22

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Feb. 15 and Feb. 22. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavioral characteristics...

Adobe Re-Patches Critical Acrobat Reader Flaw

A week after Adobe fixed a critical zero-day vulnerability in its Acrobat Reader, the company issued another patch after a researcher dug up a way to bypass the original fix. This previous vulnerability CVE-2019-7089 was fixed in Adobe’s regularly scheduled security update last week. But Adobe sa...

Trickbot Malware Goes After Remote Desktop Credentials

The banking trojan known as Trickbot has resurfaced, with an updated info-stealing module that allows it to harvest remote desktop application credentials. According to Trend Micro’s Noel Anthony Llimos and Carl Maverick Pascual, a new variant has recently come on the scene, and is being spread v...

IBM Tivoli Application Dependency Discovery Manager Information Disclosure Security Vulnerability

IBM Tivoli Application Dependency Discovery Manager TADDM is a product in a suite of IT service management solutions. IBM Tivoli Application Dependency Discovery Manager versions 7.2.2 and 7.3 have a security vulnerability in the way password hashes stored in system memory are exposed, which can ...

Adobe Fixes 43 Critical Acrobat and Reader Flaws

Adobe issued patches for 43 critical vulnerabilities in Acrobat and Reader – including a fix for a zero-day flaw that researchers at 0patch temporarily fixed on Monday. That bug could enable bad actors to steal victims’ hashed password values. Overall, Adobe patched 75 important and critical...

Temporary Patch Released For Adobe Reader Zero-Day

A temporary patch has been released to address a zero-day vulnerability in Adobe Reader that could enable bad actors to steal victims’ hashed password values, known as “NTLM hashes.” 0patch on Monday released a micropatch for the flaw, found in Adobe Reader DC. The vulnerability, which has no...

Code injection

IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured to use TADDM. IBM X-Force ID: 145110...

CVE-2018-1675

IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured to use TADDM. IBM X-Force ID: 145110...

CVE-2018-1675

IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured to use TADDM. IBM X-Force ID: 145110...

CVE-2018-1675

CVE-2018-1675 concerns IBM Tivoli Application Dependency Discovery Manager (TADDM) versions 7.2.2 and 7.3. The issue arises because password hashes can be exposed in memory on target Windows systems discovered by TADDM, due to WMI credential caching and shared service account behavior. Attack pat...

CVE-2018-1675

IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured to use TADDM. IBM X-Force ID: 145110...