Sys-Admin InfoSec

09 Mar 2023 08:34

/ Samba 4.18.0 Available for Download

https://lists.samba.org/archive/samba-announce/2023/000630.html

Sys-Admin InfoSec

08 Mar 2023 16:33

/ How SYS01 Stealer Will Get Your Sensitive Facebook Info

— https://blog.morphisec.com/sys01stealer-facebook-info-stealer

Sys-Admin InfoSec

07 Mar 2023 08:02

🙌 Note: Today I’ll update certs on Open Sys-Admin BLD DNS services, this actions could’t affect anything. Have a good day to all!

Sys-Admin InfoSec

06 Mar 2023 13:35

/ Microsoft Word Remote Code Execution Vulnerability

Workaround for CVE-2023-21716:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716

Sys-Admin InfoSec

06 Mar 2023 08:28

/ PyPI Packages Used to Deliver Python Remote Access Tools

— https://www.kroll.com/en/insights/publications/cyber/pypi-packages-deliver-python-remote-access-tools

Sys-Admin InfoSec

03 Mar 2023 11:07

/ strongSwan Vulnerability (CVE-2023-26463)

A vulnerability related to certificate verification in TLS-based EAP methods was discovered in strongSwan that results in a denial of service but possibly even remote code execution. Versions 5.9.8 and 5.9.9 may be affected:

https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html

Sys-Admin InfoSec

03 Mar 2023 03:07

/ MQsTTang: Mustang Panda’s latest backdoor treads new ground with Qt and MQTT

MQsTTang, a new backdoor used by Mustang Panda, which communicates via the MQTT protocol. Technical analysis:

https://www.welivesecurity.com/2023/03/02/mqsttang-mustang-panda-latest-backdoor-treads-new-ground-qt-mqtt/

Sys-Admin InfoSec

02 Mar 2023 15:25

/ CI/CD Secrets Extraction, Tips And Tricks

on Azure DevOpes, GitHub examples

https://www.synacktiv.com/en/publications/cicd-secrets-extraction-tips-and-tricks.html

Sys-Admin InfoSec

02 Mar 2023 07:47

/ Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting

Detail the update that advanced persistent threat (APT) group Iron Tiger made on the custom malware family SysUpdate. In this version, we also found components that enable the malware to compromise Linux systems:

https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html

Sys-Admin InfoSec

01 Mar 2023 13:20

/ Introducing a big update to Windows 11 making the everyday easier including bringing the new AI-powered Bing to the taskbar

— MS Blog Article

Sys-Admin InfoSec

01 Mar 2023 09:26

Linux System Checker Script Tool

Linux System Checker Tool Script it is a bash script which can show system info, system load info, test disk speed I/O, show free space and more... System Checker can checks and shows Linux system info like as:

▫️ System Information
▫️ CPU and Memory Information
▫️ Boot Information
▫️ Mount and HDD IO Info
▫️ Top 5 memory and CPU usage processes
▫️ Speedtest
▫️ Defined Systemd Units Services State
▫️ Logged/Process users info
▫️ Listen ports
▫️ Running systemd units as list/tree
▫️ Unowned files

- [en]: Linux System Checker
- [ru]: Скрипт проверки Linux

Sys-Admin InfoSec

28 Feb 2023 07:02

/ Malicious (and fake) ChatGPT client for Windows

Cybercriminals are distributing a Trojan stealer under the guise of a ChatGPT desktop client for Windows. We delve into the details and ways to protect yourself.

— https://www.kaspersky.com/blog/chatgpt-stealer-win-client/47274/

Sys-Admin InfoSec

27 Feb 2023 15:49

/ Researchers find hidden vulnerabilities in hundreds of Docker containers

..a note about not trusting containers from docker hub..:

— https://www.helpnetsecurity.com/2023/02/23/hidden-vulnerabilities-docker-containers/

Sys-Admin InfoSec

26 Feb 2023 15:53

/ How NPM Packages Were Used to Spread Phishing Links

https://checkmarx.com/blog/how-npm-packages-were-used-to-spread-phishing-links/

Sys-Admin InfoSec

24 Feb 2023 03:43

/ Evasive cryptojacking malware targeting macOS found lurking in pirated applications

https://www.jamf.com/blog/cryptojacking-macos-malware-discovered-by-jamf-threat-labs/

Sys-Admin InfoSec

09 Mar 2023 07:54

/ Prevent phishing based on domain registrations

Based on Microsoft Defender SmartScreen and Enhanced Phishing Protection:

— https://cloudbrothers.info/en/prevent-phishing-based-domain-registrations/

Sys-Admin InfoSec

07 Mar 2023 09:45

Открытый урок лог-менеджмента Loki (10 марта)
 
Открытый урок от OTUS, где вместе с практикующим преподавателем Евгением Павловым будет рассмотрена установка, настройка Loki, а также как с помощью Loki проводить анализ.

Урок пройдет в рамках онлайн-курса "Observability: мониторинг, логирование, трейсинг". Курс можно приобрести в рассрочку.

Чтобы записаться на занятие, необходимо пройти вступительное тестирование:
https://otus.pw/wPwC/
 

Sys-Admin InfoSec

07 Mar 2023 06:06

/ New HiatusRAT Router Malware Covertly Spies On Victims

— https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/

Sys-Admin InfoSec

06 Mar 2023 09:31

/ Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers

In this post, IBM Security X-Force Red offensive hackers analyze how attackers, with elevated privileges, can use their access to stage Windows Kernel post-exploitation capabilities:

— https://securityintelligence.com/posts/direct-kernel-object-manipulation-attacks-etw-providers/

Sys-Admin InfoSec

03 Mar 2023 11:09

/ Gitpod remote code execution 0-day vulnerability via WebSockets

https://snyk.io/blog/gitpod-remote-code-execution-vulnerability-websockets/

Sys-Admin InfoSec

03 Mar 2023 03:17

Creating a Dynamic Malware Analysis Virtual Machine

https://thelastcitadel.eu/2023/02/18/creating-a-dynamic-malware-analysis-virtual-machine/

Sys-Admin InfoSec

02 Mar 2023 16:43

/ Operation leveraging Terraform, Kubernetes, and AWS for data theft

The Sysdig Threat Research Team recently discovered a sophisticated cloud operation in a customer environment, dubbed SCARLETEEL, that resulted in stolen proprietary data. The attacker exploited a containerized workload and then leveraged it to perform privilege escalation into an AWS account in order to steal proprietary software and credentials. They also attempted to pivot using a Terraform state file to other connected AWS accounts to spread their reach throughout the organization..:

https://sysdig.com/blog/cloud-breach-terraform-data-theft/

Sys-Admin InfoSec

02 Mar 2023 09:45

Открытые практикумы DevOps, Linux, Networks, Golang (расписание на март)
 
Бесплатные практикумы на различные IT темы — Kubernetes, Docker, Ansible, Gitlab CI, Linux, Kafka , MySQL, Golang и др. Работа в консоли, разбор реальных кейсов на практике:

• 2 марта Networks: Введение в MPLS
• 7 марта DevOps: Микросервисы и микросервисная архитектура
• 9 марта Networks: MPLS сервисы (Дмитрий Радчук - Team Lead Вконтакте)
• 14 марта DevOps: Оптимизация производительности MySQL
• 15 марта Linux: RAID массивы
• 16 марта Golang by Rebrain
• 21 марта DevOps (Василий Озеров - Co-Founder REBRAIN/Fevlake)
• 22 марта Linux: Жизнь без LVM
• 23 марта Networks: Знакомство с Wireguard
• 28 марта DevOps: Матрица зрелости систем
• 29 марта Linux: Введение в bash скрипты
• 30 марта Networks: Инструменты для анализа сетевого трафика

Подключиться можно Здесь 🙂

Sys-Admin InfoSec

01 Mar 2023 16:01

/ BlackLotus UEFI bootkit

The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality:

— https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/

Sys-Admin InfoSec

01 Mar 2023 11:46

Тест на Observability: Мониторинг, Логирование, Трейсинг
 
Оценить свои навыки в отношении построения систем оповещений, мониторинга и логирования, таких как Prometheus, Grafana, ELK, Apache kafka, etc. можно попробовать при помощи теста к онлайн-курсу "Observability: мониторинг, логирование, трейсинг"

Админ Linux, DevOps или разработчик должен грамотно управлять бесчисленным множеством серверов, при помощи теста можно проверить себя и посмотреть какие observability тематики предлагает курс.

Как результат можно будет:
— оценить свои навыки
— занять место по спец. цене
— получить доступ к демо-занятиям курса

Детали здесь: https://otus.pw/I3On/
 

Sys-Admin InfoSec

01 Mar 2023 07:52

/ EXFILTRATOR-22 – An Emerging Post-Exploitation Framework

Preliminary analysis of a new post- exploitation framework called EXFILTRATOR-22 a.k.a. EX-22.
Research with MITRE mapping:

— https://www.cyfirma.com/outofband/exfiltrator-22-an-emerging-post-exploitation-framework/

Sys-Admin InfoSec

27 Feb 2023 15:52

/ New WhiteSnake Stealer Offered for Sale Via MaaS Model

A Stealer Capable of Targeting Both Windows and Linux Users..

— https://blog.cyble.com/2023/02/24/new-whitesnake-stealer-offered-for-sale-via-maas-model/

Sys-Admin InfoSec

27 Feb 2023 09:25

Extract clear text passwords from Okta

— https://github.com/authomize/okta_scim_attack_tool

Sys-Admin InfoSec

24 Feb 2023 05:28

/ Bypassing Akamai’s Web Application Firewall Using an Injected Content-Encoding Header

https://www.praetorian.com/blog/using-crlf-injection-to-bypass-akamai-web-app-firewall/

Sys-Admin InfoSec

23 Feb 2023 17:02

/ Analysis of the WinorDLL64 payload

WinorDLL64 payload serves as a backdoor that most notably acquires extensive system information, provides means for file manipulation, such as exfiltrating, overwriting, and removing files, and executes additional commands..:

https://www.welivesecurity.com/2023/02/23/winordll64-backdoor-vast-lazarus-arsenal/