All posts in Uncategorized

■■■■□ Exploitation of a kernel pool overflow from a restrictive chunk size (CVE-2021-31969). https://starlabs.sg/blog/2023/11-exploitation-of-a-kernel-pool-overflow-from-a-restrictive-chunk-size-cve-2021-31969/ https://t.me/cKure/14860

■■■□□ Inside the Massive Crime Industry That’s Hacking Billion-Dollar Companies. https://www.wired.com/story/inside-the-massive-crime-industry-thats-hacking-billion-dollar-companies/ https://t.me/cKure/14859

■■■□□ OSINT: Telegram channel documenting Genocide through phone posted content by the perpetrators. https://t.me/TrackingIsraeliGenocide https://t.me/cKure/14858

Zero-Day by AI: Google Claims World First As AI Finds 0-Day Security Vulnerability. https://www.forbes.com/sites/daveywinder/2024/11/04/google-claims-world-first-as-ai-finds-0-day-security-vulnerability/ https://t.me/cKure/14856

■■■□□ Microsoft SharePoint RCE bug exploited to breach corporate network. https://www.bleepingcomputer.com/news/security/microsoft-sharepoint-rce-bug-exploited-to-breach-corporate-network/ https://t.me/cKure/14855

■□□□□ ChatGPT-4o can be used for autonomous voice-based scams. https://www.bleepingcomputer.com/news/security/chatgpt-4o-can-be-used-for-autonomous-voice-based-scams/ https://t.me/cKure/14854

■■■■□ serviceui.exe – a useful lolbin I came across on a pentest a while back that I thought I’d share. https://secureyourit.co.uk/wp/2024/11/02/living-off-the-land/ https://t.me/cKure/14853

■■■■□ FaceDancer: An exploitation tool aimed at creating hijackable, proxy-based DLLs. https://meterpreter.org/facedancer-an-exploitation-tool-aimed-at-creating-hijackable-proxy-based-dlls/ https://t.me/cKure/14852

■■■■□ Zero-Day: Zero-Click Flaw Exposes Potentially Millions of Popular Storage Devices to Attack. The issue lies in DSM’s handling of certain protocols, such as SMB (Server Message Block), which are often enabled by default on these devices. https://www.wired.com/story/synology-zero-click-vulnerability/ https://t.me/cKure/14850

■■□□□ Hikvision Network Camera Flaw Let Attackers Intercept Dynamic DNS Credentials. https://cybersecuritynews.com/hikvision-network-camera-flaw/ https://t.me/cKure/14849