Tool Release – ScoutSuite 5.10

We’re proud to announce the release of a new version of our open-source, multi-cloud auditing tool ScoutSuite (on Github)! Notable improvements and features include: CoreBreaking change: support for Python 3.5 has been deprecatedMoved unit tests from nose to pytest & improved coverageBug fixes and improved error handlingAWSCreated a ruleset for the AWS CIS Benchmark version 1.2Can … Continue reading Tool Release – ScoutSuite 5.10

Tool Release – ICPin, an integrity-check and anti-debug detection pintool

by Nicolas Guigo ICPin is an Intel pintool leveraging the framework's JIT mode designed to track a binary's integrity checks. It records all reads and all writes performed by the target executable or dynamically loaded library on its text section and outputs a human readable text file describing each memory access with its type (R|W) … Continue reading Tool Release – ICPin, an integrity-check and anti-debug detection pintool

Conference Talks – August 2020

This month, NCC Group researchers will be presenting their work at the following conferences: Dirk-Jan Mollema, "ROADtools and ROADrecon," to be presented at Black Hat USA 2020 (Virtual - August 1-6 2020)Chris Nevin, "Carnivore: Microsoft External Attack Tool" to be presented at Black Hat USA 2020 (Virtual - August 1-6 2020)Rory McCune, "Mastering Container Security … Continue reading Conference Talks – August 2020

Tool Release – Winstrument: An Instrumentation Framework for Windows Application Assessments

by George Osterweil Winstrument is a modular framework built on top of Frida designed to help testers reverse engineer Windows applications and assess their attack surface. Motivation Winstrument is built on top of Frida, a powerful dynamic instrumentation framework which aids reverse engineering and debugging by injecting into a process a Javascript runtime with an … Continue reading Tool Release – Winstrument: An Instrumentation Framework for Windows Application Assessments

Tool Release: Sinking U-Boots with Depthcharge

Depthcharge is an extensible Python 3 toolkit designed to aid security researchers when analyzing a customized, product-specific build of the U-Boot bootloader. This blog post details the motivations for Depthcharge’s creation, highlights some key features, and exemplifies its use in a “tethered jailbreak” of a smart speaker that leverages secure boot functionality. The first three … Continue reading Tool Release: Sinking U-Boots with Depthcharge

Experiments in Extending Thinkst Canary – Part 1

The Thinkst Canary is best described as a digital tripwire for physical and virtual environments. It sits there waiting for a threat actor to tip you off they are mooching around your environment. What is less appreciated however is it is extensible with custom user modules. This post is the first in a series detailing our experiments in extending the product.