Resorts World Las Vegas announced they're performing periodic room checks for the duration of the blackhat / defcon hacking conference. When asked what they are looking for, one of the employees responded with "people hacking our stuff" ☠️

Reminds me of that old blog post by some dude who got pulled aside by the TSA so they could search his bag for "bitcoins".

https://www.404media.co/hotel-to-search-rooms-during-def-con-hacking-conference/

The original Pentium chip was introduced in 1993. It was the first "superscalar" x86 chip, able to run two instructions per clock cycle. I took this die photo of the chip yesterday. The chip has three metal layers; the thick lines you see are the top metal layer, mostly power and ground. The silicon itself is almost entirely obscured. Around the edges of the chip, tiny bond wires connect to the bond pads, providing the connections to the chip's external pins. 1/N

Currently trending on the bad place (Twitter): Leaked Wallpaper
Proof of concept for CVE-2024-38100 (7.8 high, disclosed 09 July 2024 by Microsoft Windows File Explorer Elevation of Privilege Vulnerability.

This is a privilege escalation tool (fixed with CVE-2024-38100 in KB5040434) that allows us to leak a user's NetNTLM hash from any session on the computer, even if we are working from a low-privileged user.

#CVE_2024_38100 #microsoft #msrc #vulnerability #CVE #proofofconcept #PoC

[RSS] Introducing the Vanguard Awards

https://www.thezdi.com/blog/2024/8/1/introducing-the-vanguard-awards

[RSS] Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail

https://www.sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail

New from 404 Media: we got a massive leak from inside Nvidia (emails, Slack chats, documents) which show how it created a yet-to-be-released AI model. The leak shows that Nvidia scraped YouTube en masse, had clearance from highest levels of the company https://www.404media.co/nvidia-ai-scraping-foundational-model-cosmos-project/

#ShamelesslyStolenFromTheOtherSite

CVE-2024-38856, an incorrect authorization vulnerability affecting all but the latest version of Apache OFBiz, may be exploited by remote, unauthenticated attackers to execute arbitrary code on vulnerable systems.

https://www.helpnetsecurity.com/2024/08/05/cve-2024-38856/

#Cybersecurity #OFBiz #CVE

We break down the cryptography services offered within Google Cloud Platform —Cloud KMS, Secret Manager, and Confidential Computing—helping you decide which tools are right for your project. https://buff.ly/3WQB69S

We have this Deposit Return System freshly implemented and of course the IT backend broke after few weeks.

The important thing to notice is that the operator just won't take *any* responsibility/SLA for the IT system, because IT just breaks y'know.

This rhymes pretty much with CrowdStrike's narrative about some random vendor taking out 8M computers is _just inevitable_. (see also: https://risky.biz/WWC4/ )

I'd also bet the reason they can't even tell when they will be able restore transaction processing is that their backend is some unnecessarily complex k8s and/or cloud-native monstrosity... (see also: https://blog.thinkst.com/2024/07/unfashionably-secure-why-we-use-isolated-vms.html )

(Report in Hungarian: https://hvg.hu/gazdasag/20240805_A-Mohu-Repont-app-kotelezo-visszavaltas-ebx )

Elastic: Dismantling Smart App Control
Elastic claims that Windows Smart App Control and SmartScreen have several design weaknesses that allow attackers to gain initial access with no security warnings or popups. A bug in the handling of LNK files can also bypass these security controls. They research bypasses for reputation-based systems and develop detections to identify indicators of attack. No CVE IDs associated.
See related The Hacker News reporting: Researchers Uncover Flaws in Windows Smart App Control and SmartScreen

#smartapp #smartscreen

University student phished others so he could steal their grants. Article in Hungarian:

https://hvg.hu/itthon/20240805_Feltorte-a-Neptun-rendszert-es-maganak-utalta-el-a-diakok-osztondijat-a-csalo-ebx

I'd like to note that In my time we wouldn't think of stealing from broke-ass students like ourselves...also had proper RCE's :P

#Hungary #Neptun

[RSS] Pnut: A Self-Compiling C Transpiler Targeting Human-Readable POSIX Shell

https://hackaday.com/2024/07/25/pnut-a-self-compiling-c-transpiler-targeting-human-readable-posix-shell/

[RSS] Proof that find + mkdir are Turing-Complete

https://hackaday.com/2024/08/05/proof-that-find-mkdir-are-turing-complete/

[RSS] [Blog] Teaching the Old .NET Remoting New Exploitation Tricks

https://code-white.com/blog/teaching-the-old-net-remoting-new-exploitation-tricks/

[RSS] Breaking Barriers and Assumptions: Techniques for Privilege Escalation on Windows: Part 3

https://www.thezdi.com/blog/2024/7/31/breaking-barriers-and-assumptions-techniques-for-privilege-escalation-on-windows-part-3

[RSS] Extending Burp Suite for fun and profit – The Montoya way – Part 6

https://security.humanativaspa.it/extending-burp-suite-for-fun-and-profit-the-montoya-way-part-6/

[RSS] Heap exploitation, glibc internals and nifty tricks.

http://blog.quarkslab.com/heap-exploitation-glibc-internals-and-nifty-tricks.html

[RSS] Decrypting VPN traffic via crashdumps

https://dustri.org/b/decrypting-vpn-traffic-via-crashdumps.html

[RSS] Introducing the MSRC Researcher Resource Center

https://msrc.microsoft.com/blog/2024/07/introducing-the-msrc-researcher-resource-center/