Aggregator

A vulnerability, which was classified as very critical, was found in Samba up to 3.2.12. Affected is an unknown function. The manipulation leads to format string. This vulnerability is traded as CVE-2009-1886. It is possible to launch the attack remotely. Furthermore, there is an exploit available.

About 75% of healthcare sector entities that suffered a ransomware attack over the past year were targeted on a weekend or holiday, highlighting the need for organizations to bolster staffing and related strategies during these vulnerable times, said Jeff Wichman of security firm Semperis.

Researchers Trace 61% of Known Losses This Year to Pyongyang-Backed Hackers
Hackers tied to North Korea's cash-strapped totalitarian dictatorship this year stole a record amount of cryptocurrency, totaling $1.34 billion across 47 incidents, or about double their known haul for 2023, reported blockchain analytics firm Chainalysis.

Infrastructure Problems Blamed; Users Appear to Move to Similar FlowerStorm Service
As the end of the year approaches, it's out with the old and in with the new as researchers report that Rockstar 2FA, which once facilitated prolific phishing-as-a-service hits, has crashed and burned, apparently leading many one-time users to move to rival FlowerStorm.

AI Can Fake Alignment to New Instructions to Avoid Retraining
Advanced artificial intelligence models can feign alignment with new training goals while secretly adhering to their original principles, a study shows. Alignment faking isn't likely to cause immediate danger but may pose a challenge as AI systems grow more capable.

Major Chinese Router Manufacturer Facing Increased Scrutiny After Chinese Espionage
U.S. authorities have launched multiple investigations while reportedly considering banning the widely popular Chinese-manufactured TP-Link routers amid ongoing security risks linked to Chinese cyberespionage and hacking campaigns targeting American critical infrastructure sectors.

error code: 521

网络安全研究人员发现，可以使用大型语言模型 (LLM) 大规模生成恶意 JavaScript 代码的新变种，以更好地逃避检测。 Palo Alto Networks Unit 42 研究人员在一项新报告中表示： “尽管 LLM 很难从头开始创建恶意软件，但犯罪分子可以很容易地使用它们来重写或混淆现有的恶意软件，使其更难检测。” “犯罪分子可以促使 LLM 执行看起来更自然的转换，这使得检测这种恶意软件更具挑战性。” 随着时间的推移，经过足够多的转换，该方法可以降低恶意软件分类系统的性能，诱使它们相信一段恶意代码实际上是良性的。 尽管 LLM 提供商已不断加强安全防护，以防止其出轨并产生意外输出，但恶意开发人员却宣传使用WormGPT等工具来自动编写令人信服的网络钓鱼电子邮件，这些电子邮件针对潜在目标，甚至会创建新的恶意软件。 早在 2024 年 10 月，OpenAI就披露它阻止了 20 多项试图使用其平台进行侦察、漏洞研究、脚本支持和调试的操作和欺骗网络。 Unit 42 表示，它利用 LLM 的强大功能迭代重写现有的恶意软件样本，目的是绕过“无罪推定”（IUPG）或PhishingJS等机器学习（ML）模型的检测，从而有效地为创建 10,000 种新型 JavaScript 变体铺平了道路，同时又不改变其功能。 对抗性机器学习技术旨在每次将恶意软件作为输入输入系统时，使用各种方法对其进行转换——即变量重命名、字符串拆分、垃圾代码插入、删除不必要的空格以及完全重新实现代码。 该公司表示：“最终的输出是恶意 JavaScript 的新变种，它保持了与原始脚本相同的行为，但恶意分数几乎总是低得多。”并补充说，算法在 88% 的时间内将其恶意软件分类器模型的判定从恶意转变为良性。 更糟糕的是，这些重写的 JavaScript 工件在上传到 VirusTotal 平台时也会逃避其他恶意软件分析器的检测。 基于 LLM 的混淆提供的另一个关键优势是，它的大量重写看起来比 obfuscator.io 等库实现的重写自然得多，后者由于它们对源代码引入更改的方式，更容易可靠地检测和指纹识别。 Unit 42 表示：“在生成式人工智能的帮助下，新的恶意代码变种的规模可能会增加。不过，我们可以使用相同的策略来重写恶意代码，以帮助生成可以提高机器学习模型稳健性的训练数据。”       转自军哥网络安全读报，原文链接：https://mp.weixin.qq.com/s/iSCmefHzaCwcHO0tuNkk2w 封面来源于网络，如有侵权请联系删除

Ldapper A GoLang tool to enumerate and abuse LDAP. Made simple. Ldapper was created with for use in offensive security engagements for user enumeration, group enumeration, and more. Ldapper uses familiar “net” commands such as...

The post ldapper: A GoLang tool to enumerate and abuse LDAP appeared first on Penetration Testing Tools.

A vulnerability was found in Mozilla Firefox 27.0. It has been rated as problematic. Affected by this issue is the function nsHTMLDocument::Open of the component Popup Blocker. The manipulation leads to improper access controls. This vulnerability is handled as CVE-2014-1511. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in WebkitGTK+ up to 2.22.6/2.23.90. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file UIProcess/API/gtk/WebKitScriptDialogGtk.cpp of the component UIProcess Subsystem. The manipulation leads to memory corruption. This vulnerability is known as CVE-2019-8375. The attack can be launched remotely. Furthermore, there is an exploit available.

我认为这是2024最好用的漏洞，你觉得呢？

我认为这是2024最好用的漏洞，你觉得呢？

0x01前言在前一篇文章中介绍了一个仍然可以用于最新版PbootCMS的老漏洞DVB-2021-2510,并对漏洞流程进行分析，给出了在有限条件下利用漏洞的方式。本文将在前一篇文章的基础上继续给出新的

我认为这是2024最好用的漏洞，你觉得呢？

apk.sh apk.sh is a Bash script that makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding, and patching an APK. Features apk.sh basically uses apktool to disassemble, decode and rebuild resources...

The post apk.sh: makes reverse engineering Android apps easier appeared first on Penetration Testing Tools.

A vulnerability was found in Microsoft Windows and classified as critical. Affected by this issue is some unknown functionality of the component GDI. The manipulation leads to improper access controls. This vulnerability is handled as CVE-2017-0005. The attack needs to be approached locally. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Microsoft Word and Excel 2007 SP3 and classified as critical. Affected by this issue is some unknown functionality. The manipulation leads to memory corruption. This vulnerability is handled as CVE-2017-0006. The attack may be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.