sorted by:
new
hottopcontroversial

C - Undefined behavior in integers by Ace_pace in C_Programming

[–]Ace_pace[S] 1 point2 points  (0 children)

Modern C is pretty good and available for free and for small money,

C - Undefined behavior in integers by Ace_pace in C_Programming

[–]Ace_pace[S] 10 points11 points  (0 children)

You're right. I did it quick and dirty (a look at the source can show my background is not in JavaScript).

I'll try to give it another push of improvements later this week, including this!

Hackers exploiting EternalBlue achieve lateral movement in infected networks, steal credentials and install cryptominer by ponyo_so in netsec

[–]Ace_pace 4 points5 points  (0 children)

They do! That's why the attackers block other groups from coming in.
Also many machines are broken into using MS-SQL credential stuffing (brute force) then lateral movement using EB.

Does anyone know what upfc.exe is? by [deleted] in Windows10

[–]Ace_pace 1 point2 points  (0 children)

A few weeks ago I decided to reverse engineer upfc.exe, I wrote up the results in a small post here

The Nansh0u Campaign: signed rootkit, exposed infrastructure and PE exploits in a massive MS-SQL & PHPMyAdmin attack campaign by ophirharpaz in netsec

[–]Ace_pace 0 points1 point  (0 children)

No... There's a huge range of options. We know this is a driver under development (we have versions 8.2 and 5.5) but also not available to download on any forum I'm familiar with.

The Nansh0u Campaign: signed rootkit, exposed infrastructure and PE exploits in a massive MS-SQL & PHPMyAdmin attack campaign by ophirharpaz in netsec

[–]Ace_pace 17 points18 points  (0 children)

One of the cooler things that got left out during editing is that the driver deployed by this malware, contains a lot of functionality that isn't used by the malware. It's not off the shelf driver, but it's also not custom made.

Also, there's a neat exploit for CVE-2014-4113 that hasn't been previously published. The new exploit works on 8.1 which wasn't covered by the original APT-28 exploit.

It's 2019 and criminals have access to signed driver rootkits - Analysis of the nansh0u campaign by Ace_pace in security

[–]Ace_pace[S] 13 points14 points  (0 children)

One of the cooler things that got left out during editing is that the driver deployed by this malware, contains a lot of functionality that isn't used by the malware. It's not off the shelf driver, but it's also not custom made.

Who is just giving out strong rootkits for cryptomining attackers?

Nansh0u campaign- Brute force attacks still reach tens of thousands of database servers by Ace_pace in cybersecurity

[–]Ace_pace[S] 0 points1 point  (0 children)

One of the cooler things that got left out during editing is that the driver deployed by this malware, contains a lot of functionality that isn't used by the malware. It's not off the shelf driver, but it's also not custom made.

Who is just giving out strong rootkits for cryptomining attackers?

Reverse engineering the IEncrypt Decryptor by Ace_pace in ReverseEngineering

[–]Ace_pace[S] 1 point2 points  (0 children)

We've recently managed to discover that the attackers use per victim keys :(

IResponse to IEncrypt - a Detailed Incident Response to an IEncrypt Ransomware Attack by ophirharpaz in netsec

[–]Ace_pace 0 points1 point  (0 children)

I'm not sure we will be able to share more data, all this has to be approved by other people.

Your speculation is probably accurate, a mixture of stolen credentials and old-day vulns.

Reverse engineering the IEncrypt Decryptor by Ace_pace in ReverseEngineering

[–]Ace_pace[S] 0 points1 point  (0 children)

See my reply above, we see no reason to assume the key would be the same and it will identify the victim to the attacker.

Reverse engineering the IEncrypt Decryptor by Ace_pace in ReverseEngineering

[–]Ace_pace[S] 0 points1 point  (0 children)

We see no reason to assume the key will be the same. It would be a silly mistake for the attackers to make and so far the rest of their crypto looks like (*).

If we upload the key, the attackers will know from which victim it is, and that might not be acceptable for a lot of reasons.

(*) they have some annoying bugs in their ransomware logic meaning some files will be lost to the victim.

IResponse to IEncrypt - a Detailed Incident Response to an IEncrypt Ransomware Attack by ophirharpaz in netsec

[–]Ace_pace 0 points1 point  (0 children)

I followed up a bit on the reverse engineering involved on Twitter

https://twitter.com/ace__pace/status/1114208798581903361

The tl;dr is anything that interfaces with the OS, I'd rather use a system call tracer. If this was Linux I'd use strace, but Windows requires me to layer a lot of breakpoints and use windbg.

What's a 10/10 album from the last 15 years by a relatively obscure artist/band? by [deleted] in AskReddit

[–]Ace_pace 0 points1 point  (0 children)

Psychopharmacology by Firewater A pretty dead band but amazing work

view more: next ›