Posts

hackers awarded $267k at pwn2own 2k18

white hat hackers earn money from big companies that sponsor attacks to find exploits in edge , apple safari , virtual box and firefox. first day a hacker called rich zhu earned 70k from an attack on edge , another hacker received $65k for hacking safari. the second day of these events Zhu hacked firefox and earned 120k for his efforts. that right thier was some easy money. if you asked me. MWR also earned 55k for a safari sandbox escape exploit. the highest prizes at this event was from microsoft which offered  $150k for hyper v exploits, 100k for outlook exploits and windows smd 100k. you can read more on this link below. thanks https://www.securityweek.com/hackers-awarded-267000-pwn2own-2018

hackers abusing text editors for privilege escalation

some text editors allow 3rd party code to run as a extensions to the application, this provides some benefits but also can be a security risk. a researcher named dor azouri looked at some programs called sublime , vim , emacs , gedit and pico and found that half allow this privilege escalation. for example if i am an system admin and i restrict privileges to certain applications or permissions. these editors allow me to bypass by adding a few lines of code which starts the programs. you can read more on this article. https://www.securityweek.com/hackers-can-abuse-text-editors-privilege-escalation

AMD Chip flaws confirmed

CTS a cybersecurity firm discovered 133 critical vulnerabilites and back doors in EPYC and ryzen cpu chips from amd. The company says anyone that can exploit using code to bypass any security features like secure boot and windows defender. they were nicknamed , MASTERKEY , RYZENFALL, FALLOUT CHIMERA. you not need physical access to the machine just admin privileges. Check point another cybersecurity firm also confirmed the vulnerabilities but it doesn't agree on how CTS disclosed the findings only giving AMD 24 hours before going public. https://www.securityweek.com/amd-chip-flaws-confirmed-more-researchers

cisco is offering money for bugs

the founder of Cisco . CISCO meraki  of the cloud manage it solution, launched  a public bound program that offers $10,000 to any individual that brings bugs or finds them. In 2012 a private company found 39 flaws and cisco payed about 1k per bug. The firm has agreed to pay from $100-$10,000 depending the impact of the bug. which is not bad money if your a white hacker. Cisco says it runs on 230k customers and has over 3 million devices. https://www.securityweek.com/cisco-meraki-offers-10000-bug-bounty-program

facebook rocked by new data breach scandal

Facebook suspended an account called the Cambridge analytica , because it apparently misused the data it was collecting. Facebook couldn't police the data in time and it was said that 50 million users data was leaked cause of this indent. the European union and the usa senate what a investigation on this to see if any more data was leaked and to see who to press charges on. more information can be found at this link. https://www.securityweek.com/facebook-rocked-new-data-breach-scandal

applebees data breach that happened on february 2018

On February 13, 2018 a data breach had been discovered on Applebees restaurant’s point-of sale systems.   An investigation was launched and it was determined the breach occurred between December 6, 2017 to January 2, 2018. applebees had 160 plus locations across 14 states have been affected. These fourteen states include: Alabama, Ohio, Pennsylvania, Texas Arizona, Florida, Illinois, Indiana, Kansas, Mississippi, Nebraska, Wyoming. Kentucky, Missouri, Malware was found in the POS systems. which designed to collect customer names, their credit/ debit card information, verification codes, and card expiration dates. Customers paying online or using Apple bees' tabletop devices that allow them to pay without wait staff present were not impacted.       Apple bees assures its customers that the incident has been isolated and that customers may use their cards at their favorite locations without worries. https://www.securityweek.com/payment-card-breach-hits-some-appleb...

making a bootable usb drive

Image
Creating a Bootable USB Drive with Windows PowerShell My USB drive is  and my DVD drive is F. Your drives may be different! 1. Right-click Windows PowerShell and select Run as Administrator. 2. Mount the disk image (ISO) by using the cmdlet Mount-DiskImage. (See Figure 1) Mount-DiskImage -ImagePath <string[]> Figure 1. Mounting the disk image. 3. Use the cmdlet Get-Disk to view the disk objects. The USB drive's disk number is 2. (See Figure 2) Get-Disk Figure 2. Viewing disk objects. 4. Remove all partition information and data on the USB drive using the cmdlet Clear-Disk. (See Figure 3) Clear-Disk -Number 2 -RemoveData Figure 3. Clearing the USB drive. 5. Create a new partition using the cmdlet New-Partition. Use -IsActive:$true to set the MBR partition to active. (See Figure 4)   New-Partition -DiskNumber  2  -UseMaximumSize -IsActive:$true Figure 4. Creating a new partition. 6. Format the USB dr...