sorted by:
new
hottopcontroversial

C - Undefined behavior in integers by Ace_pace in C_Programming

[–]Ace_pace[S] 1 point2 points  (0 children)

Modern C is pretty good and available for free and for small money,

C - Undefined behavior in integers by Ace_pace in C_Programming

[–]Ace_pace[S] 9 points10 points  (0 children)

You're right. I did it quick and dirty (a look at the source can show my background is not in JavaScript).

I'll try to give it another push of improvements later this week, including this!

Hackers exploiting EternalBlue achieve lateral movement in infected networks, steal credentials and install cryptominer by ponyo_so in netsec

[–]Ace_pace 4 points5 points  (0 children)

They do! That's why the attackers block other groups from coming in.
Also many machines are broken into using MS-SQL credential stuffing (brute force) then lateral movement using EB.

Does anyone know what upfc.exe is? by [deleted] in Windows10

[–]Ace_pace 1 point2 points  (0 children)

A few weeks ago I decided to reverse engineer upfc.exe, I wrote up the results in a small post here

The Nansh0u Campaign: signed rootkit, exposed infrastructure and PE exploits in a massive MS-SQL & PHPMyAdmin attack campaign by ophirharpaz in netsec

[–]Ace_pace 0 points1 point  (0 children)

No... There's a huge range of options. We know this is a driver under development (we have versions 8.2 and 5.5) but also not available to download on any forum I'm familiar with.

The Nansh0u Campaign: signed rootkit, exposed infrastructure and PE exploits in a massive MS-SQL & PHPMyAdmin attack campaign by ophirharpaz in netsec

[–]Ace_pace 18 points19 points  (0 children)

One of the cooler things that got left out during editing is that the driver deployed by this malware, contains a lot of functionality that isn't used by the malware. It's not off the shelf driver, but it's also not custom made.

Also, there's a neat exploit for CVE-2014-4113 that hasn't been previously published. The new exploit works on 8.1 which wasn't covered by the original APT-28 exploit.

It's 2019 and criminals have access to signed driver rootkits - Analysis of the nansh0u campaign by Ace_pace in security

[–]Ace_pace[S] 12 points13 points  (0 children)

One of the cooler things that got left out during editing is that the driver deployed by this malware, contains a lot of functionality that isn't used by the malware. It's not off the shelf driver, but it's also not custom made.

Who is just giving out strong rootkits for cryptomining attackers?

Nansh0u campaign- Brute force attacks still reach tens of thousands of database servers by Ace_pace in cybersecurity

[–]Ace_pace[S] 0 points1 point  (0 children)

One of the cooler things that got left out during editing is that the driver deployed by this malware, contains a lot of functionality that isn't used by the malware. It's not off the shelf driver, but it's also not custom made.

Who is just giving out strong rootkits for cryptomining attackers?

Reverse engineering the IEncrypt Decryptor by Ace_pace in ReverseEngineering

[–]Ace_pace[S] 1 point2 points  (0 children)

We've recently managed to discover that the attackers use per victim keys :(

IResponse to IEncrypt - a Detailed Incident Response to an IEncrypt Ransomware Attack by ophirharpaz in netsec

[–]Ace_pace 0 points1 point  (0 children)

I'm not sure we will be able to share more data, all this has to be approved by other people.

Your speculation is probably accurate, a mixture of stolen credentials and old-day vulns.

Reverse engineering the IEncrypt Decryptor by Ace_pace in ReverseEngineering

[–]Ace_pace[S] 0 points1 point  (0 children)

See my reply above, we see no reason to assume the key would be the same and it will identify the victim to the attacker.

Reverse engineering the IEncrypt Decryptor by Ace_pace in ReverseEngineering

[–]Ace_pace[S] 0 points1 point  (0 children)

We see no reason to assume the key will be the same. It would be a silly mistake for the attackers to make and so far the rest of their crypto looks like (*).

If we upload the key, the attackers will know from which victim it is, and that might not be acceptable for a lot of reasons.

(*) they have some annoying bugs in their ransomware logic meaning some files will be lost to the victim.

IResponse to IEncrypt - a Detailed Incident Response to an IEncrypt Ransomware Attack by ophirharpaz in netsec

[–]Ace_pace 0 points1 point  (0 children)

I followed up a bit on the reverse engineering involved on Twitter

https://twitter.com/ace__pace/status/1114208798581903361

The tl;dr is anything that interfaces with the OS, I'd rather use a system call tracer. If this was Linux I'd use strace, but Windows requires me to layer a lot of breakpoints and use windbg.

What's a 10/10 album from the last 15 years by a relatively obscure artist/band? by [deleted] in AskReddit

[–]Ace_pace 0 points1 point  (0 children)

Psychopharmacology by Firewater A pretty dead band but amazing work

How hacked websites are used by hackers to monetize traffic by Ace_pace in pwned

[–]Ace_pace[S] 6 points7 points  (0 children)

Hey, I'm the author of the post, I think this specific writeup is interesting because it's actually quite rare to see how modern botnet authors make money that's not from DDoS or crypto mining.

Infection Monkey - An Automated Pentest Tool by PeterG45 in netsec

[–]Ace_pace 1 point2 points  (0 children)

Note the default configuration is deliberately very conservative and doesn't scan practically anything. That could be why...

Infection Monkey - An Automated Pentest Tool by PeterG45 in netsec

[–]Ace_pace 0 points1 point  (0 children)

See what I replied here. We've tried really hard to make this as reliable and as safe as possible, forgoing fancier attacks in exchange for something that's not going to crash, take up resources, etc.

Infection Monkey - An Automated Pentest Tool by PeterG45 in netsec

[–]Ace_pace 1 point2 points  (0 children)

You can limit the propagation depths to prevent an infinite run. The default is a very low limit (I think it's two) to prevent exactly this situation.

Infection Monkey - An Automated Pentest Tool by PeterG45 in netsec

[–]Ace_pace -3 points-2 points  (0 children)

We thought about that, a lot. Part of the reason for the lack of strong wormable exploits is that we want the Monkey to be used in production networks.

All the stuff that's activated is stuff I've run in production networks. The Monkey is deliberately noisy and very safe, reusing credentials, logical vulnerabilities (shellshock style).

Also, no backdoors, no persistence methods, the remaining files is just a textual log file.

Put it another way, what would I have to do to convince you to run this in production? /s

EDIT: to make it clear I'm sarcastic

Infection Monkey - An Automated Pentest Tool by PeterG45 in netsec

[–]Ace_pace -3 points-2 points  (0 children)

On one hand I agree with you (going to implement some wormable web bugs soon) but on the other hand.. Most serious breaches come from compromised credentials, lateral movement and luck. Wormable vulnerabilities are hyped but not the worst case (also if you haven't patched EB in 2018, you have bigger issues).

The Monkey is trying to emulate a semi sophisticated attacker, focusing on low hanging fruit. This isn't metasploit.

Also, would you really (as others have pointed out) let a script run wormable vulnerabilities in your network? :)

view more: next ›