Design/Logic Flaw

An issue was found in Samsung Mobile Print Android versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of application configuration information...

CVE-2019-6331

The CVE-2019-6331 issue affects Samsung Mobile Print (Android)

CVE-2019-6331: Exposure of Sensitive Information to an Unauthorized Actor

An issue was found in Samsung Mobile Print Android versions prior to 4.08.007. A potential security vulnerability caused by incomplete obfuscation of application configuration information...

PT-2020-11204

Name of the Vulnerable Software and Affected Versions Samsung Mobile Print Android versions prior to 4.08.007 Description A potential security issue was found due to incomplete obfuscation of application configuration information. Recommendations For versions prior to 4.08.007, update to version...

Multiple Apple Products Kernel Component Type Obfuscation Vulnerability

Apple iOS is an operating system developed for mobile devices.Apple tvOS is a smart TV operating system.Apple watchOS is a smart watch operating system.Kernel is one of the kernel components. A type obfuscation vulnerability exists in the Kernel component of several Apple products. An attacker...

Quark-Engine - An Obfuscation-Neglect Android Malware Scoring System

An Obfuscation-Neglect Android Malware Scoring System Concepts Android malware analysis engine is not a new story. Every antivirus company has their own secrets to build it. With curiosity, we develop a malware scoring system from the perspective of Taiwan Criminal Law in an easy but solid way. W...

venom

This is a Metasploit framework module for generating shellcode and compiling it into an executable file. The module, named "venom," is designed to produce shellcode in various formats C, Python, Ruby, DLL, MSI, HTA-PSH and inject it into a template e.g., Python that executes the shellcode in RAM...

New version of IcedID Trojan uses steganographic payloads

This blog post was authored by @hasherezade, with contributions from @siriurz and Jérôme Segura. Security firm Proofpoint recently published a report about a series of malspam campaigns they attribute to a threat actor called TA2101. Originally targeting German and Italian users with Cobalt Strik...

LuaJIT Type Obfuscation Vulnerability

LuaJIT is an on-the-fly compiler for the Lua language. A type-obfuscation vulnerability in debug.getinfo in LuaJIT 2.0.5 and earlier used in Moonjit 2.1.2 and earlier and other products can be exploited by an attacker to read or write to arbitrary memory...

Linux kernel shiftfs type obfuscation vulnerability

Linux kernel is an open source operating system. A type obfuscation vulnerability exists in Linux kernel shiftfs, which allows local attackers to submit a special request that can be exploited to execute arbitrary code or conduct denial-of-service attacks...

Stealthy Malware Flies Under AV Radar with Advanced Obfuscation

Researchers warn hackers are putting a new spin on old injection techniques and successfully end-running endpoint protection. They are tracking a campaign, that kicked off in January, that is still going strong exploiting weaknesses in web browsers. The objective is to hide in the background of...

Emotet Resurgence Continues With New Tactics, Techniques and Procedures

The notorious banking trojan Emotet, that mysteriously disappeared over the summer, returned last month dropping a new collection of malware including information stealers, email harvesters, self-propagation mechanisms and ransomware. But since the malware returned from its hiatus, there was no...

Obfuscation as a Privacy Tool

This essay discusses the futility of opting out of surveillance, and suggests data obfuscation as an alternative. We can apply obfuscation in our own lives by using practices and technologies that make use of it, including: The secure browser Tor, which among other anti-surveillance technologies...

.WAVs Hide Malware in Their Depths in Innovative Campaign

UPDATE Audio .WAV files are the latest hiding place for obfuscated malicious code; a campaign has been spotted in which malicious content was secretly woven throughout the file’s audio data. The embedded code consists of two different payloads: A XMRig/Monero CPU cryptominer and Metasploit code...

LOWKEY: Hunting for the Missing Volume Serial ID

In August 2019, FireEye released the “Double Dragon” report on our newest graduated threat group: APT41. A China-nexus dual espionage and financially-focused group, APT41 targets industries such as gaming, healthcare, high-tech, higher education, telecommunications, and travel services. This blog...

Staying Hidden on the Endpoint: Evading Detection with Shellcode

True red team assessments require a secondary objective of avoiding detection. Part of the glory of a successful red team assessment is not getting detected by anything or anyone on the system. As modern Endpoint Detection and Response EDR products have matured over the years, the red teams must...

Zebrocy Retools for New Political Attacks

The APT known as the Sednit threat group also known as Sofacy, APT28 and Fancy Bear has kicked off a fresh spearphishing campaign, that was spotted targeting government entities with the Zebrocy backdoor. The malware features a rewritten and newly-improved backdoor and downloader, indicating an...

CB TAU Threat Intelligence Notification: Formbook Harvests Data By Intercepting Clients

Formbook is an information stealer which has been around for the past few years. Formbook acts as a form grabber which harvests credentials, passwords, banking details, key strokes and network requests, by intercepting web browser and other clients such as email and IM. The particular sample...

Mozilla Firefox Type Obfuscation Vulnerability

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A type obfuscation vulnerability exists in Spidermonkey in Mozilla Firefox versions prior to 69, which can be exploited by attackers to cause a denial of service with the help of a specially crafted...

PyFuscation - Obfuscate Powershell Scripts By Replacing Function Names, Variables And Parameters

PyFuscation Requires python3 usage: PyFuscation.py -h -f -v -p --ps SCRIPT Optional arguments: • -h, --help show this help message and exit • -f Obfuscate functions ○ Do this First ... Its probably the most likely to work well • -v Obfuscate variables ○ If your going to obfuscate variables do the...