bluetooth

/Tag:bluetooth

Week 10 In Review – 2017

Techniques Hacking Unicorns with Web Bluetooth - www.contextis.com Researchers discovered an unsecured MongoDB server that exposed sensitive CloudPets customer data. My research focused on the toy itself, in particular some issues we found with its Bluetooth LE connectivity and features. Still Passing the Hash 15 Years Later - passing-the-hash.blogspot.com So I first thought about it [...]

Week 7 In Review – 2017

Events Related BSides Tampa 2017 Videos - www.irongeek.com These are the videos from the BSides Tampa conference. Resources New hccapx format explained - hashcat.net A few days ago a user came into the #hashcat IRC channel and reported to have problems cracking one of his WPA handshake captures. No worries, the user knew the password to the [...]

2017-03-12T17:39:08-07:00 February 12th, 2017|Security Conferences, Week in Review|0 Comments

Week 51 In Review – 2016

Events Related DefCamp- def.campResources McAfee Virus Scan for Linux - state.actor A system running Intel's McAfee VirusScan Enterprise for Linux can be compromised by remote attackers due to a number of security vulnerabilities. Some of these vulnerabilities can be chained together to allow remote code execution as root. Techniques Practical Reverse Engineering Part 5 - Digging Through the Firmware - jcjc-dev.com In part 4 we extracted the entire firmware from the router and decompressed it. As I explained then, you can often get most of the firmware directly from the manufacturer’s website: Firmware upgrade binaries often contain partial or entire filesystems, or even entire firmwares. XNU kernel UaF due to lack of locking in set_dp_control_port - bugs.chromium.org set_dp_control_port is a MIG method on the host_priv_port so this bug is a root->kernel escalation. macOS FileVault2 Password Retrieval - blog.frizk.net macOS FileVault2 let attackers with physical access retrieve the password in clear text by plugging in a $300 Thunderbolt device into a locked or sleeping mac. The password may be used to unlock the mac to access everything on it. Vulnerabilities Bluetooth-enabled safe lock popped after attackers win PINs - theregister.co.uk Attackers can locate and pop safes protected with high security commercial locks thanks to poor Bluetooth implementations, say researchers at Somerset Recon say. 0day drive-by exploit against Fedora If you run a mainstream distribution of Linux on a desktop computer, there's a good chance security researcher Chris Evans can hijack it when you do nothing more than open or even browse a specially crafted music file. And in the event you're running Chrome on the just-released Fedora 25, his code-execution attack works as a classic drive-by. 0-days hitting Fedora and Ubuntu open desktops to a world of hurt - arstechnica.com Redux: compromising Linux using... SNES Ricoh 5A22 processor opcodes?!- scarybeastsecurity.blogspot.com Other News  FBI Arrests Customer of Xtreme Stresser DDoS-for-Hire Service - bleepingcomputer.com The FBI arrested this past week Sean Krishanmakoto Sharma, 26, from La Canada, California, for launching DDoS attacks against Chatango, an online chat service.  

Week 50 In Review – 2016

Events Related PhreakNIC20-2016 - www.youtube.com Tools GRASSMARLIN - github.com GRASSMARLIN provides IP network situational awareness of industrial control systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks to support network security. Techniques Secure Rom extraction on iPhone 6s - ramtin-amin.fr Secure ROM, also knows as bootrom, is the very first piece of software that [...]

Week 48 In Review – 2016

Events Related Kiwicon X - www.youtube.com Resources Curl Security Audit - daniel.haxx.se I asked for, and we were granted a security audit of curl from the Mozilla Secure Open Source program a while ago. This was done by Mozilla getting a 3rd party company involved to do the job and footing the bill for it. CVE-2016-7098 - legalhackers.com "GNU [...]

Week 38 In Review – 2016

Events Related BSides Augusta 2016 Videos - www.irongeek.com These are the videos from the BSides Augusta conference. Resources Long Secret Stingray Manuals Detail How Police Can Spy On Phones - theintercept.com The Intercept has obtained several Harris instruction manuals spanning roughly 200 pages and meticulously detailing how to create a cellular surveillance dragnet. Techniques Reprogramming the Defcon 24 badge [...]

Week 34 In Review – 2016

Events Related Impressions From DEF CON 24: The Machines Are Rising - securityintelligence.com DEF CON 24, the world’s largest hacker conference, ended Aug. 7, and I must say I enjoyed every moment of it. There was so much to see in so little time; I definitely regret missing some great stuff that happened. Even so, [...]

Week 33 In Review – 2016

Events Related DefCon Event Council of 9 ventured forth to DEFCON 24 to compete in this year’s badge challenge, brought to us each year by 1o57. There was determination among the team to win at DC24 to ensure that last year’s win was not a fluke. After many sleepless nights in Vegas, we emerged victorious for [...]

Week 32 In Review – 2016

Events Related DARPA's Cyber Grand Challenge: Early Highlights from the Competition - www.youtube.com Early highlights from the world's first all-machine hacking tournament, DARPA's Cyber Grand Challenge (CGC). This computer security competition featured seven High Performance Computers as competitors. CGC took place on Thursday, August 4, 2016. Building the Workforce through Cybersecurity Competitions - www.whitehouse.gov The [...]