Scripting languages like JavaScript are being integrated into commercial software to support easy file modification. For example, Adobe Acrobat accepts JavaScript to dynamically manipulate PDF files. To bridge the gap between the high-level scripts and the low-level languages (like C/C++) used to implement the software, a binding layer is necessary to transfer data and transform representations. However, due to the complexity of two sides, the binding code is prone to inconsistent semantics and security holes, which lead to severe vulnerabilities. Existing efforts for testing binding code merely focus on the script side, and thus miss bugs that require special program native inputs. In this paper, the researchers propose cooperative mutation, which modifies both the script code and the program native input to trigger bugs in binding code.
5f9d0ad09e9e62d12e246894db4172788cd3662fb32d618c99f88dda19d6b911This is the Spamhaus Botnet Threat Update for Q1 2022. It shows a modest increase of 8% in the new number of botnet command and controllers.
27881d2519cb2cb26262ed765a46dee0f7d9f74eee33851a0592cb21197cffd3This is a research paper titled Goodbye Tracking? Impact Of iOS App Tracking Transparency And Privacy Labels. It analyzes 1,759 iOS apps before and after the changes in iOS 14.
f2c94b3fe30d62f6090a9abdcdc56152591090977c196e48ef151cadea9e410aWhitepaper called Are You Really Muted?: A Privacy Analysis of Mute Buttons in Video Conferencing Apps.
050dc6588d019c0fec02dfa4d049708c93c8ad0e15fb67374316108e1ab679a3In-depth whitepaper that casts light on the actual telemetry data sent by Google Play Services, which to date has largely been opaque.
1961b146927a5d663ba288e9e0655edeb281a7f9333b4a2e556204df1aadc496Whitepaper called PE Infection that discusses portable execution injection and exploitation. Written in Arabic.
e0534cb924c64a357ac0fc2ed8a017fc1a7e5701279ab670c791cde630d32ab9Whitepaper called OPENSSLDIR - The adventures of hidden folder to privilege escalation.
169de44bba1064b1fdf63754db8a9eba9c5bd777fa8e4e5dd12cb47dfe4af528Whitepaper that gives exploitation and overview details on the Log4j vulnerability as noted in CVE-2021-44228.
1718bbf0d45e1ebf16dbdf6e329a8b2f32b620f142e69ae4db5a2403502ff6acWhitepaper that explains a misconfiguration based flaw about Local Administrator Password Solution.
afd186867562453b4d7f00ad96270e7a4c5c6b2facd655ef9e4e3c6d602fb576Whitepaper that gives an overview of the LightSpeed cache vulnerability as noted in CVE-2020-29172.
6b116687f316d0d1b0c270c949274568a68280101b8f2b8703b1d129c2fd14feBrief whitepaper that discusses well-known standards like OWASP Top 10, OWASP ASVS, WASC and CWE SANS 25.
bb8c3ba79e4589a5aa83121ea754034f9c5a42dd7b26ad8c48c817a89a9ea285This is a brief write up discussing insecure functions susceptible to classic buffer overflows.
6c56ef6f21fb5c517c4f05fbff6461b2f130d800355ad39593d8b2f06bee3943Whitepaper titled CurveBall Windows CryptoAPI Spoofing that discusses the CVE-2021-0601 vulnerability.
728bd43bdaed0560d5327ad21645854d75e4367110b510fd004bcf6753926332Whitepaper discussing untrusted data deserialization in jsoniter. Written in Spanish.
bfcbc92c461eee304f389597423031549d816389de0416f3fa662b1cb15e3995Whitepaper that gives an overview of the Polkit vulnerability as discussed in CVE-2021-3560. Written in Spanish.
a41b8393ce5c22e793b28b10b8d6c72d64b22b0b06202998991ab9e195b4ef1cThis is a whitepaper that discusses DNS spoofing. Written in Spanish.
f2ea4bf58281fa68bc973561373c15277c62566c003a2f7a9096cddecd79929eWhitepaper called Mail Information Gathering AppScript. This paper contains the exploitation of vulnerabilities for collecting email information using Google utilities via App Script using the Gmail App class. This paper exposes the design of a web application that collects mail information from users with associated Google mail accounts.
bb58e73be8e657614e1304dca838b2c7c09c9f5bf8e0bb733adf4f93ad1f3671This whitepaper is an overview on the Microsoft MSHTML remote code execution vulnerability recently highlighted in CVE-2021-40444.
087e3d97e374ce1d4b7286735f7a428ab28ea89b53f87246c6b35e526a161c30The Nullcon Berlin 2022 Call For Papers is open. It will take place April 8th through the 9th, 2022 in Berlin, Germany.
198c70e918acee017241f39e3a28687dd2d5c957ff48b61de4f62dee5c5b1c00Whitepaper called Wireshark for Newbies. Written in Spanish.
4eba6ef7844800c28ebd51692b48a6153ba4549162d4af3786f0e308332432dbWhitepaper that gives an analysis of the remote code execution vulnerability noted in CVE-2019-11932 for WhatsApp that affects versions prior to 2.19.244. Written in Spanish.
7866772d314829babcae8d60f3a6173f7e55759aac6e5184ca91290e471e6320Whitepaper called PrintNightmare Vulnerability. This document illustrates the exploitation of the vulnerability found in the Windows spooler service. Originally thought to be a local privilege escalation vulnerability in the Windows Print Spooler, identified as CVE-2021-1675 and patched during Microsoft's June Patch. Microsoft increased the severity of this issue on June 21 as well as reclassifying it as a 'remote code execution' (RCE) threat. This RCE vulnerability has been assigned a new identifier, CVE-2021-34527.
a5647c132e4877c92a507d0bcd1ac0ea57ab7bb3dca97b06b3806f2dcf13942fIn this paper, the authors conduct an analysis of the previously over-looked attack surface related to DNS, and are able to uncover even stronger side channels that have existed for over a decade in Linux kernels. The side channels affect not only Linux but also a wide range of DNS software running on top of it, including BIND, Unbound and dns-masq. They also discovered that about 38% of open resolvers (by frontend IPs) and 14% (by backend IPs) are vulnerable including the popular DNS services such as OpenDNS and Quad9.
285348238e1453af785253da8bbd1e4ba41081c23566393003c3960304917844Whitepaper called Pass-The-Hash Attack on Named Pipes against ESET Server Security. Written in Spanish.
f9316a93cdca8ab23c7d80dd39ad820bd1df91d1d115107172ebf3e6abcf7799Whitepaper discussing the OWASP top ten and security of APIs. Written in Spanish.
5d6c059cffab55d95f06d12ecf6b042c525b6ac3c50432367d0c388815310a67
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed