Antonio Cocomazzi

Antonio Cocomazzi

@splintercode.bsky.social

offensive security - windows internals - reverse engineering | X: https://x.com/splinter_code | Mastodon: https://infosec.exchange/@splinter_code | GitHub: https://github.com/antonioCoco | Blog: https://splintercod3.blogspot.com/

378 followers275 following12 posts

Antonio Cocomazzi reposted

SentinelOne
@sentinelone.com

🚨 Alert: New macOS Malware Variants, FlexibleFerret, Undetected by Apple’s XProtect 🚨 @sentinellabs.bsky.social researchers @philofishal.bsky.social and @hegel.bsky.social have uncovered new variants, which slip past Apple's XProtect, of the DPRK-linked macOS malware, Ferret.

s1.aimacOS FlexibleFerret | Further Variants of DPRK Malware Family UnearthedDPRK 'Contagious Interview' campaign continues to target Mac users with new variants of FERRET malware and Github devs with repo spam.

Antonio Cocomazzi reposted

James Forshaw
@tiraniddo.dev

New blog post on the abuse of the IDispatch COM interface to get unexpected objects loaded into a process. Demoed by using this to get arbitrary code execution in a PPL process. googleprojectzero.blogspot.com/2025/01/wind...

googleprojectzero.blogspot.comWindows Bug Class: Accessing Trapped COM Objects with IDispatchPosted by James Forshaw, Google Project Zero Object orientated remoting technologies such as DCOM and .NET Remoting make it very easy ...
Antonio Cocomazzi
@splintercode.bsky.social

Very interesting post by Microsoft about the internals of the new Admin Protection feature It seems they have patched my SSPI UAC bypass based on NTLM as well as the Kerberos UAC bypass in which both were able to bypass AP as well More details here 👇 techcommunity.microsoft.com/blog/microso...

techcommunity.microsoft.comEvolving the Windows User Model – Introducing Administrator Protection | Microsoft Community HubPreviously, in part one, we outlined the history of the multi-user model in Windows, how Microsoft introduced features to secure it, and in what ways we got...

Antonio Cocomazzi reposted

Nathan McNulty
@nathanmcnulty.com

Thanks to a recent post from @ericlawrence.com on Defender and Dev Drive, I was reminded of this amazing research series by @n4r1B n4r1b.com/posts/2020/0... I only comprehend ~30% if I'm lucky, but that's a good 10% more than last time I read it 🤣 Still, it's definitely worth reading ;)

n4r1b.comDissecting the Windows Defender Driver - WdFilter (Part 1)In this series of posts I'll be explaining how the Windows Defender main Driver works, in this first post we will look into the initialization and the Process creation notifications among other things
View full thread
Antonio Cocomazzi
@splintercode.bsky.social

In older ntoskrnl (e.g. Win2016 1607) the function IopQueryRegistryKeySystemPath doesn't exist and the "ImagePath" value is retrieved without checks through IopGetRegistryValue(..., "ImagePath",...) in IopBuildFullDriverPath

Antonio Cocomazzi
@splintercode.bsky.social

In newer ntoskrnl.exe there is a check in IopLoadDriver->IopBuildFullDriverPath->IopQueryRegistryKeySystemPath that ensure the "ImagePath" value is under a regkey prefixed with \REGISTRY\MACHINE and if not it returns 0xC00000E5

Antonio Cocomazzi reposted

SentinelLABS
@sentinellabs.bsky.social

🔮 What does the future hold? Surprises 🎲, certainly, but some of the forces that will shape #2025 can already be discerned in the shadows of 2024. The @sentinellabs.bsky.social team takes a look at what might be coming over the horizon for #cybersecurity this coming year.

SentinelOne@sentinelone.com

🔮 Cybersecurity 2025 Forecast: The landscape is set to become even more volatile, with threat actors exploiting blind spots in cloud-hosted services, AI, and under-monitored technologies. Despite these changes, collective defense stagnantly incentivizes reactive rather than proactive measures.

s1.aiCybersecurity 2025 | Preparing for Tomorrow's Threats, Challenges and Strategic ShiftsExplore SentinelLabs' take on what 2025 may bring for cybersecurity, including emerging trends and actionable insights.

Antonio Cocomazzi reposted

Andrea P
@decoder-it.bsky.social

Relaying DCOM has always intrigued me, so I decided to dive in. Started with a MiTM attack using a fake DNS entry, targeting certificate requests to an ADCS server and relaying to SMB.

Antonio Cocomazzi reposted

BleepingComputer
@bleepingcomputer.com

A new malicious campaign is using a legitimate but old and vulnerable Avast Anti-Rootkit driver to evade detection and take control of the target system by disabling security components. www.bleepingcomputer.com/news/securit...

bleepingcomputer.comHackers abuse Avast anti-rootkit driver to disable defensesA new malicious campaign is using a legitimate but old and vulnerable Avast Anti-Rootkit driver to evade detection and take control of the target system by disabling security components.

Antonio Cocomazzi reposted

Tom Hegel
@hegel.bsky.social

🚨 New Research Drop: 🇰🇵 DPRK IT Workers | A Network of Active Front Companies and Their Links to China Summary: ⚪ Newly Disrupted Front Companies by USG ⚪ Impersonating US based software and tech orgs ⚪ Links to still-active front orgs, CN association Report: www.sentinelone.com/labs/dprk-it...

sentinelone.comDPRK IT Workers | A Network of Active Front Companies and Their Links to ChinaSentinelLabs has identified multiple deceptive websites linked to businesses in China fronting for North Korea's fake IT workers scheme.

Antonio Cocomazzi reposted

Andrea P
@decoder-it.bsky.social

Following my prev tweet, my Kerberos MITM relay/forwarder is almost finished! It targets for example insecure DNS updates in AD, allowing DNS name forgery. It intercepts, relays, and forwards traffic, with the client unaware. Currently supporting smb->smb and smb->http (adcs)

Antonio Cocomazzi reposted

Nathan McNulty
@nathanmcnulty.com

Almost embarrassed to post this, but I've always used Fiddler or Burp for capturing things like this... I didn't have admin rights and was trying to capture network traffic from a pop-up, so Dev Tools wasn't working Apparently this is built into Chrome/Edge! So cool :) edge://net-export/

Antonio Cocomazzi reposted

Costin G. Raiu
@craiu.bsky.social

The Three Buddies Problem podcast episode 21 is now live! Together with @ryanaraine.bsky.social and @jags.bsky.social we talk geography, cyber magic walls, Aria Sepehr Ayandehsazan aka Emennet Pasargad, Predatory Sparrow and of course, magic money #bitcoin: securityconversations.com/episode/what...

securityconversations.comWhat happens to CISA now? Is deterrence in cyber possible? - Security ConversationsThree Buddy Problem – Episode 21: We dig into an incredible government report on Iranian hacking group Emennet Pasargad and tradecraft during the Israel/Hamas war, […]

Antonio Cocomazzi reposted

Jamie Levy 🦉
@gleeda.bsky.social

Great work by the @volexity.bsky.social crew!

Volexity@volexity.com

@volexity.bsky.social has published a blog post detailing variants of LIGHTSPY & DEEPDATA malware discovered in the summer of 2024, including exploitation of a vulnerability in FortiClient to extract credentials from memory. Read more here: www.volexity.com/blog/2024/11...

volexity.comBrazenBamboo Weaponizes FortiClient Vulnerability to Steal VPN Credentials via DEEPDATAIn July 2024, Volexity identified exploitation of a zero-day credential disclosure vulnerability in Fortinet’s Windows VPN client that allowed credentials to be stolen from the memory of the client’s ...

Antonio Cocomazzi reposted

Jamie Levy 🦉
@gleeda.bsky.social

🧵Today’s blogpost focuses on a newer ransomware variant named SafePay. Needless to say, ransomware sucks. When this new variant appeared, it gained our attention. 👀 Let’s dig into what happened and what makes it tick ⬇️:

Antonio Cocomazzi reposted

Kim Zetter
@kimzetter.bsky.social

France's former domestic spy chief on trial for allegedly collecting classified info for Luis Vuitton owner Bernard Arnault. Bernard Squarcini allegedly spied on a former journalist and current MP who made a documentary critical of Arnault and on Hermès, a competitor of Arnault. (archive.ph/VAocp)

telegraph.co.ukFrance’s former intelligence chief accused of spying for Louis Vuitton billionaireBernard ‘The Shark’ Squarcini denies charges including compromising national security and misuse of public funds

Antonio Cocomazzi reposted

Alex Delamotte
@alex.leetnoob.com

I wrote a post on the realities of cloud & webserver ransomware. Check it out to see some of the toolsets & frameworks that can be used for these attacks.

This post is unavailable.
Antonio Cocomazzi
@splintercode.bsky.social

This MemProcFS has a lot of potentials. I have seen it also abused by some ransomware operator to dump lsass. If you see the loading of such drivers and aren’t commonly used in your environment then you should set some alerts based on that.

dragosr@dragostech.bsky.social

MemProcFS views physical memory as files in a virtual file system. Analyzes memory dump files, live memory via DumpIt or WinPMEM, live memory in read-write mode from virtual machines or from PCILeech FPGA hardware devices. github.com/ufrisk/MemPr...

github.comGitHub - ufrisk/MemProcFS: MemProcFSMemProcFS. Contribute to ufrisk/MemProcFS development by creating an account on GitHub.

Antonio Cocomazzi reposted

Lorenzo Franceschi-Bicchierai
@lorenzofb.bsky.social

NEW: Security researchers confirm that iPhones running iOS 18 now automatically reboot if they are not unlocked for 72 hours. The "inactivity reboot" feature will make life harder for thieves, law enforcement, and forensic experts trying to extract data from iPhones. techcrunch.com/2024/11/14/n...

techcrunch.comNew Apple security feature reboots iPhones after 3 days, researchers confirm | TechCrunch“Inactivity reboot" effectively puts iPhones in a more secure state by locking the user's encryption keys in the iPhone's secure enclave chip.

You are up to date.