A few months ago, my colleagues over at Secarma released a review of ExplodingCan, one of the many exploits released as part of the ShadowBrokers dump. At the time I was asked to complete a review of the vulnerability, specifically how this affected a vulnerable server and if anything could be done to protect users.
Read More »
In the first part of this malware review, we looked at the VBA code used by APT28 to drop a DLL onto the victims' machine as part of their recently highlighted hospitality campaign. In this post, we will look at the dropped file, and understand just what it does, and how we can analyse it using IDA Pro. So we know from the first post that we have a DLL, which is
Read More »
This week, FireEye published a writeup of yet another APT28 campaign, this time targeting the hospitality sector. I'm always interested to see the latest APT group techniques, so I decided to review the malware to see how the dropper worked
Read More »
Sometimes I come across things non-security related that intrigue me, albeit mostly I'm thinking how I can use it to exploit a service, but still... One such piece of functionality caught my interest, a banner displayed at the top of GitHub. I was thinking of the different ways that this type of functionality could be achieved. We have seen similar methods of detection exploited in the past to leak out information, although much more targeted at cross-origin detection (such as Social Media F
Read More »
As part of my day job, I work for Secarma (previously known as Pentest Limited) as a Senior Penetration Tester. During engagements, the question of malware threats is increasingly raised, in part due to media focus on APT groups such as APT28, and malware campaigns such as WannaCry. While looking into another malware variant recently uncovered by ESET, Industroyer, I started reviewing the protocol used to communicate with the backdoor component of the malware. Details of the research have bee
Read More »
This week, Objective-See published a walkthrough of the recently released "Malware as a Service" family, MacRansom, originally identified by FortiNet. Patrick from Objective-See does a brilliant fly-by of the malware using LLDB, and presents some nice "anti anti-analysis" tricks. If you are interested in the internals of the malware, I'd recommend that you take a
Read More »
This week, FireEye released an awesome review into APT32 (aka OceanLotus). The full writeup of their analysis can be found on FireEye's site here, and is certainly worth a read if you are interested in the evolving world of APT and attribution. One of the things I found interesting about this group was their use of "off the shelf" open source tools and techniques, often associated with commercial red-team engagem
Read More »This bank holiday weekend I spent a bit of time updating my docker containers (I know, rock-n-roll!). One of the tools I've been hearing good things about is pwndbg, an open source plugin for GDB which aims to help with exploit development. I've always been a fan of peda, which provides similar functionality, but seeing the integration that pwndbg had with radare2, I couldn't help but give it a shot. To install the tool, I used the provided installation instructions
Read More »During the PlaidCTF challenge, there were a couple of binaries which, whilst I had a general idea of how the vulnerability worked, I couldn't complete in time to grab a flag. This has been bugging me since the end of the CTF, so I wanted to revisit one such challenge and see what I was missing. That challenge was "bigpicture". To begin with, you are given a simple description
Read More »This weekend I joined team NeverTry on PlaidCTF. One of the interesting challenges that I attempted was the "no_mo_flo" reverse engineering exercise. The description provided was simple... Can you go with the flow? To begin with, we load the challenge in IDA Pro. After some parsing, we see the first step is to read 0x20 bytes from STDIN
Read More »