Has someone examined the leaked Hacking Team stuff for linux/bsd 0days?
Has someone examined the leaked Hacking Team stuff for linux/bsd 0days? http://www.theregister.co.uk/2015/09/10/redmond_yells_cut_on_hacking_team_ho... Another of exploits against Microsoft Windows that hit as a zero day after Hacking Team was hacked has been fixed.
Has someone examined the leaked Hacking Team stuff for linux/bsd 0days?
If you haven't read this blog from Intel Advanced Threat Research team (group that produces CHIPSEC tool) summarizing their UEFI malware: http://www.intelsecurity.com/advanced-threat-research/blog.html (This is more of a static web site, not a RSS/Atom-based blog site; their next blog entry might overright this, save a copy of this article before they post another blog.) In the reviews I've seen, their stuff was Windows-centric. You can dump your linux/BSD ROMs with CHIPSEC and search for Hacking Team's malware presense in your ROMs using the same techniques listed in above blog. (I haven't paying attention to the archives of the Hacking Team stuff. If anyone knows where the firmware volume binary used in the above analysis is publicly hosted, please give me an URL. Thanks!)
On Mon, Sep 14, 2015 at 09:17:49AM -0700, Blibbet wrote:
(I haven't paying attention to the archives of the Hacking Team stuff. If anyone knows where the firmware volume binary used in the above analysis is publicly hosted, please give me an URL. Thanks!)
Maybe the links here are related: http://leaksource.info/category/hacking-team/ Some signing? certs in windoze format: https://github.com/hackedteam/GeoTrust
On Fri, Sep 11, 2015 at 10:10:54AM +0300, Georgi Guninski wrote:
Has someone examined the leaked Hacking Team stuff for linux/bsd 0days?
https://wikileaks.org/hackingteam/emails/emailid/45441 Fwd: Assets Portfolio Update: 2014-10-06 Assets_Portfolio.pdf.zip From: Dustin D. Trammell <dtrammell@vulnbroker.com> In today's portfolio update we have the following: 14-006 is a new memory corruption vulnerability in Oracle Solaris SunSSHD yielding remote privileged command execution as the root user. The provided exploit is a modified OpenSSH client making exploitation of this vulnerability very convenient.
participants (2)
-
Blibbet -
Georgi Guninski