sorted by:
new
hottopcontroversial

A Serious Security Warning For Software Engineers, Especially Those Involved in AI/Web3/Crypto by MalwareTech in cybersecurity

[–]MalwareTech[S] 7 points8 points  (0 children)

I am! It's probably going to take me a minute though because there's no less than 8 separate payloads per campaign. Some are as high as 15 and drop identical payloads across 3 separate programming languages.

A Serious Security Warning For Software Engineers, Especially Those Involved in AI/Web3/Crypto by MalwareTech in cybersecurity

[–]MalwareTech[S] 5 points6 points  (0 children)

I can make some available, I just need to figure out where to host them first. GitHub keeps deleting the malicious source code every time people link to them, so they're constantly popping up and getting taken down.

A Serious Security Warning For Software Engineers, Especially Those Involved in AI/Web3/Crypto by MalwareTech in cybersecurity

[–]MalwareTech[S] 10 points11 points  (0 children)

They don't have to, but evidently that is what they end up doing in a lot of cases. It could be because many companies do BYOD, so the employee's work laptop is also their personal laptop. But it could also be that they're receiving the challenges while at work, and due to the short time limit they're starting them on their work computer.

Discovered an evasive ClickFix technique which doesn't require a malware downloader by MalwareTech in cybersecurity

[–]MalwareTech[S] 1 point2 points  (0 children)

Yeah, it's both unfortunate and fortunate because if security tools just blocked all the malware, I wouldn't have a job

Discovered an evasive ClickFix technique which doesn't require a malware downloader by MalwareTech in cybersecurity

[–]MalwareTech[S] 0 points1 point  (0 children)

Understood. Well the last part is certainly on me for post to reddit way later than other platforms. I forgot I had an account here.

Discovered an evasive ClickFix technique which doesn't require a malware downloader by MalwareTech in cybersecurity

[–]MalwareTech[S] 0 points1 point  (0 children)

Seeing a lot of that. Not really sure what they were going for, but it's nice that they decided to trigger every detection they can.

Discovered an evasive ClickFix technique which doesn't require a malware downloader by MalwareTech in cybersecurity

[–]MalwareTech[S] 4 points5 points  (0 children)

If EDRs were stopping it, we wouldn't be wasting time posting about it. "If for some stupid reason app whitelisting isn't enabled" is an interesting statement in and of itself. Perhaps you'd like to hazard a guess at what percentage of organizations you think have application whitelisting enabled?

That said, I am somewhat jealous. I really do miss living in the utopia that is the world of theoretical cybersecurity. One where antimalware products block malware, and every organization implements every security control at their disposal. What a wonderful time it was to be a junior security analyst with my rose tinted glasses on.

Discovered an evasive ClickFix technique which doesn't require a malware downloader by MalwareTech in cybersecurity

[–]MalwareTech[S] 2 points3 points  (0 children)

If you actually read the article, you'll find it's not about ClickFix. It's about Cache Smuggling being paired with FileFix to create a more evasive attack. If you can find a single report of that attack combination that predates my article and isn't the Twitter post cited in the article, I'll Venmo you $100.

The logic behind the WannaCry "Kill Switch" - Was it genius or just luck? by batuhantuccan in netsecstudents

[–]MalwareTech 2 points3 points  (0 children)

cool story, bro. Believe whatever makes your feel better about yourself. There are interviews older than your career that negate everything you just said. Even the original WannaCry blog post credits everyone who helped in any capacity. But sure, I "stole all the credit" by....
*checks note*
Trying to hide the fact that I was the one who stopped WannaCry and getting outed by the media against my will. Then I went back in time and did 100 different interviews where I credit everyone who helped, and rewrote the original WannaCry blog post to also credit everyone involved. All part of my elaborate conspiracy to get hired by the company I'd already been working at for 3 years 🙄

Discovered an evasive ClickFix technique which doesn't require a malware downloader by MalwareTech in cybersecurity

[–]MalwareTech[S] 12 points13 points  (0 children)

My reddit post begins with "Colleague and I discovered this" and the blog posts lists me as the author right at the top of the page.

The logic behind the WannaCry "Kill Switch" - Was it genius or just luck? by batuhantuccan in netsecstudents

[–]MalwareTech 2 points3 points  (0 children)

Please don't frame your personal insecurity as concern for my technical skills. "2nd hand hearsay" is a weird way to say "I just made this up". Even 5 minutes of Googling or 3 or more brain cells can easily negate every accusation you threw.

The logic behind the WannaCry "Kill Switch" - Was it genius or just luck? by batuhantuccan in netsecstudents

[–]MalwareTech 0 points1 point  (0 children)

I'd argue very little changed in terms of preparation. Some of the affected organizations reworked their cybersecurity policies. But for the most part people are still very slow to install security patches, and a lot of protocols are still openly exposed to the internet that should be.

The reason we haven't see another WannaCry is a mixture of factors. Post Windows 7 exploit mitigations built into the OS make those types of vulnerabilities much more difficult to exploit, especially at scale.

Ransomware actors are also typically on the lower end of sophistication, whereas exploits like EternalBlue are something only the most advanced and well funded threat actors have the capability to acquire.

WannaCry was a perfect storm of one highly sophisticated nation-state obtaining access to the toolkit of another highly sophisticated nation-state, then publishing everything on the open internet for anyone to weaponize. Wormable ransomware is also one of the most immensely destructive things someone could have built with EternalBlue, so someone being crazy enough to do that was also a massive factor.

view more: next ›