SysAdmin 24x7

Elevación de privilegios en VMware Horizon Client http://unaaldia.hispasec.com/2018/06/elevacion-de-privilegios-en-vmware.html

Windows reuse shellcode based on socket's lifetime https://www.shelliscoming.com/2018/06/windows-reuse-shellcode-based-on.html

CHIPSEC is a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities. It can be run on Windows, Linux, Mac OS X and UEFI shell. Instructions for installing and using CHIPSEC can be found in the manual. Manual : https://github.com/chipsec/chipsec/blob/master/chipsec-manual.pdf

ATAQUE DE EXFILTRACIÓN DE DATOS POR DNS Y PRUEBA DE CONCEPTO https://arcosec-canal.blogspot.com/2018/05/exfiltracion-de-datos-por-dns-y-prueba.html

LOS 20 CONTROLES CRÍTICOS DE LA CIBERDEFENSA https://arcosec-canal.blogspot.com/2018/05/los-20-controles-criticos-de-la.html

Forget VPNfilter – here’s BACKLASH, a networking hack from way, way back https://nakedsecurity.sophos.com/2018/05/31/forget-vpnfilter-heres-backlash-a-networking-hack-from-way-way-back/

Múltiples vulnerabilidades en productos de F5 Fecha de publicación: 31/05/2018 Importancia: 4 - Alta Recursos afectados: BIG-IP (LTM, AAM, AFM, Analytics, APM, ASM, DNS, Edge Gateway, FPS, GTM, Link Controller, PEM, WebAccelerator, WebSafe) versiones 13.0.0 a 13.1.0, 12.1.0 a 12.1.3, 11.6.0 a 11.6.3 y 11.2.1 a 11.5.5 https://www.certsi.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-productos-f5-1

Unfortunately, some Telegram features, such as stickers, don’t work correctly under iOS 11.4 that was just released – even though we fixed this issue weeks ago. Apple has been preventing Telegram from updating its iOS apps globally ever since the Russian authorities ordered Apple to remove Telegram from the App Store. Russia banned Telegram on its territory in April because we refused to provide decryption keys for all our users’ communications to Russia’s security agencies. We believe we did the only possible thing, preserving the right of our users to privacy in a troubled country. Unfortunately, Apple didn’t side with us. While Russia makes up only 7% of Telegram’s userbase, Apple is restricting updates for all Telegram users around the world since mid-April. As a result, we’ve also been unable to fully comply with GDPR for our EU-users by the deadline of May 25, 2018. We are continuing our efforts to resolve the situation and will keep you updated. Sorry for the inconvenience and thank you for your patience.

¿Cómo enfrentarse a las amenazas del #ransomware? Descúbrelo en los dos nuevos informes del @CCNCERT, con nuevas variantes de este tipo de código dañino, metodología empleada en campañas como #WannaCry o recomendaciones de seguridad https://www.ccn-cert.cni.es/seguridad-al-dia/comunicados-ccn-cert/6339-como-enfrentarse-a-las-amenazas-del-ransomware.html

Microsoft Edge: Chakra: EntrySimpleObjectSlotGetter can have side effects https://bugs.chromium.org/p/project-zero/issues/detail?id=1542

Expert found a zero-day RCE in Microsoft Windows JScript component Dmitri Kaslov, a security researcher at Telspace Systems, discovered a vulnerability in the JScript component of the Windows operating system that can be exploited by an attacker to execute malicious code on a target computer. https://securityaffairs.co/wordpress/73076/hacking/jscript-component-0day.html

LuLu v0.9.5 released: free open-source macOS firewall https://securityonline.info/lulu-free-open-source-macos-firewall/

Malware Analysis Report (AR18-149A) MAR-10135536-3 - HIDDEN COBRA RAT/Worm https://www.us-cert.gov/ncas/analysis-reports/AR18-149A

Disable Risky Windows Features: Hardentools https://n0where.net/disable-risky-windows-features-hardentools

Powershell Empire GUI: Una interfaz gráfica al más puro estilo Armitage #Empire #Powershell #PowershellEmpire #EthicalHacking http://www.elladodelmal.com/2018/05/powershell-empire-gui-una-interfaz.html

FBI issues alert over two new malware linked to Hidden Cobra hackers https://thehackernews.com/2018/05/north-korean-hacker-hidden-cobra.html