A Guide to Improving Security Through Infrastructure-as-Code

Modern organizations evolved and took the next step when they became digital. Organizations are using cloud and automation to build a dynamic infrastructure to support more frequent product release and faster innovation. This puts pressure on the IT department to do more and deliver faster. Automated cloud infrastructure also requires a new mindset, a change … Continue reading A Guide to Improving Security Through Infrastructure-as-Code

Tool Release – ScoutSuite 5.12.0

We are excited to announce the release of a new version of our open-source, multi-cloud auditing tool ScoutSuite (on Github)! This version includes multiple bug fixes, dependency updates and feature enhancements for AWS, Azure and GCP. It also adds and updates several rules for these three cloud providers, alongside improved finding templates and descriptions. The … Continue reading Tool Release – ScoutSuite 5.12.0

Sharkbot is back in Google Play 

Authored by Alberto Segura (main author) and Mike Stokkel (co-author) Editor's note: This post was originally published on the Fox-IT blog. Introduction  After we discovered in February 2022 the SharkBotDropper in Google Play posing as a fake Android antivirus and cleaner, now we have detected a new version of this dropper active in the Google … Continue reading Sharkbot is back in Google Play 

Conference Talks – September/October 2022

Throughout September and October, members of NCC Group will be presenting their work at SANS CyberThreat, 44CON, ResponderCon, BSides St John's, ICMC, DevOps World, RootCon, Hexacon, and Hardwear.io NL. Ollie Whitehouse & Eric Shamper, "Enterprise IR:Live Free, live large" to be presented at Sans CyberThreat (September 12-13 2022) NCC Group, "Mastering Container Security," training to … Continue reading Conference Talks – September/October 2022

SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)

Introduction netlink and nf_tables Overview Sets Expressions Set Expressions Stateful Expressions Expressions of Interest nft_lookup nft_dynset nft_connlimit Vulnerability Discovery CVE-2022-32250 Analysis Set Creation Set Deactivation Initial Limited UAF Write Exploitation Building an Initial Plan Offsets We Can Write at Into the UAF Chunk Hunting for Replacement Objects What Pointer Do We Want to Arbitrary Free? … Continue reading SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)

Writing FreeBSD Kernel Modules in Rust

At present all major operating system kernels are written in C/C++, languages which provide no or minimal assistance in avoiding common security problems. Modern languages such as Rust provide better security guarantees by default and prevent many of the common classes of memory safety security bugs. In this post we will take a brief look … Continue reading Writing FreeBSD Kernel Modules in Rust

Tool Release – JWT-Reauth

[Editor’s note: This post is a part of our blog series from our NCC Group summer interns! You can see more posts from consultants in our internship program here.] When testing APIs with short-lived authentication tokens, it can be frustrating to login every few minutes, taking up a consultant's time with an unnecessary cut+paste task … Continue reading Tool Release – JWT-Reauth

Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling

Authored by: Jesús Miguel Calderón Marín Introduction Two years ago I carried out research into online casino games specifically focusing on roulette. As a result, I composed a detailed guide with information on classification of online roulette, potential vulnerabilities and the ways to detect them[1]. Although this guideline was particularly well-received by the security community, … Continue reading Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling

Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study 

Max Groot & Ruud van Luijk TL;DR A recently uncovered malware sample dubbed ‘Saitama’ was uncovered by security firm Malwarebytes in a weaponized document, possibly targeted towards the Jordan government. This Saitama implant uses DNS as its sole Command and Control channel and utilizes long sleep times and (sub)domain randomization to evade detection. As no … Continue reading Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study 

Implementing the Castryck-Decru SIDH Key Recovery Attack in SageMath

Editor’s note: since the publication of this blog post, an expanded and more technical discussion of the implementation process has been written, and is available on eprint: https://eprint.iacr.org/2022/1283. Introduction Last weekend (July 30th) a truly incredible piece of mathematical/cryptanalysis research was put onto eprint. Wouter Castryck and Thomas Decru of KU Leuven published a paper "An … Continue reading Implementing the Castryck-Decru SIDH Key Recovery Attack in SageMath