ForgeCert - "Golden" Certificates

ForgeCert uses the BouncyCastle C API and a stolen Certificate Authority CA certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper. This code base was released ...

[Whitepaper] XDR vs. NDR/NTA – What do Organizations Truly Need to Stay Safe?

Security teams whose organizations are outside the Fortune 500 are faced with a dilemma. Most teams will have to choose between deploying either a network traffic analysis NTA or network detection and response NDR tool or an endpoint detection and response EDR tool to supplement their existing...

Uniswap Oracle uses wrong prices

Handle cmichel Vulnerability details The Uniswap oracle uses a mock contract with hard-coded prices to retrieve the price which is not feasible in production. Not sure if this is part of the contest, this will probably still be changed? But note that even when using the "real deal"...

Remote code execution

Depending on configuration of various package managers it is possible for an attacker to insert a malicious package into a package manager's repository which can be retrieved and used during development, build, and release processes. This insertion could lead to remote code execution. We believe...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impack...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impack...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impack...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impack...

Exploit for CVE-2020-1472

ZeroLogon testing script A Python script that uses the Impack...

NCR SelfServ ATM dispenser software contains multiple vulnerabilities

Overview NCR SelfServ automated teller machines ATMs running APTRA XFS 05.01.00 or older are vulnerable to physical attacks on the communications bus between the currency dispenser component and the host computer. Description NCR SelfServ ATMs running APTRA XFS 05.01.00 or older contain...

State & Local Governments: The Cyberinsurgency Spreads

Today’s world is dramatically different than even five years ago. Ransomware attacks, which used to make global headlines, are now commonplace. Cybercriminals—who have historically targeted large enterprises—are now also setting their sights on state and local governments. New, sophisticated...

SharpHide - Tool To Create Hidden Registry Keys

Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden null terminated registry key. This works by adding a null byte in front of the UNICODESTRING key valuename. More info about this technique can be found in the following whitepaper:...

Going in-depth on the Windows 10 random number generation infrastructure

Throughout the years, we've had ongoing conversations with researchers, developers, and customers around our implementation of certain security features within the Windows operating system. Most recently, we have open-sourced our cryptography libraries as a way to contribute and show our continue...

Beers with Talos Ep. #65: Please welcome to the show… Talos Incident Response

By Mitch Neff. Beers with Talos BWT Podcast episode No. 65 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Recorded Oct. 25, 2019 Today is a bit different. We normally keep things pretty neutral on this show not...

Mitigate then Investigate: Watch a Live DDoS Attack

Recently Andy Shoemaker, founder of NimbusDDOS, and our own David Elmaleh shared their knowledge about DDoS attacks and what it means to have industry-best protection capabilities including fast time to mitigation. They also offered insights into the critical investigation activities that must...

3S-Smart Software Solutions GmbH CODESYS Control V3 Products

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : 3S-Smart Software Solutions GmbH Equipment : CODESYS Control V3 products Vulnerability : Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...

A Way Forward

Carbon Black recently published a report on the challenges of securing Linux-based operating systems and how Carbon Black is redesigning the approach. For more information about how the CB Predictive Security Cloud, Carbon Black's consolidated endpoint security platform, helps enterprises cut cos...

Beers with Talos Ep. #38 — More fun with VPNFilter; Getting pwnd via spreadsheet

Beers with Talos BWT Podcast Ep. 38 is now available. Download this episode and subscribe to Beers with Talos: If iTunes and Google Play aren't your thing, click here. Ep. 38 show notes: Recorded Sept. 21, 2018 — The whole crew is back together! On the agenda today is VPNFilter part III, now...

Cyber Threat Alliance Releases Cryptomining Whitepaper

This post is authored by Ashlee Benge. Despite the recent devaluation of some cryptocurrencies, illicit cryptocurrency miners remain a lucrative and widespread attack vector in the threat landscape. These miners are easy to deploy, and attackers see it as a quick way to steal other users'...

Blocking Cryptocurrency Mining Using Cisco Security Products

Cisco Talos is releasing a whitepaper addressing Cryptocurrency mining and all the ways to block it using Cisco Security products. The value of cryptocurrencies has fluctuated wildly, but the value is still high enough to garner a lot of attention, both legitimate and malicious. Most of the...