ocdsec

China Presses Nvidia Over Alleged Backdoors in H20 Chips Amid Tech Tensions China questioned Nvidia over suspected backdoors in its H20 chips, adding to rising tensions in the tech fight between the U.S. and Beijing.

China Presses Nvidia Over Alleged Backdoors in H20 Chips Amid Tech Tensions

New Batavia spyware targets Russian industrial enterprises Since March 2025, fake contract emails have been spreading Batavia spyware in targeted attacks on Russian organizations.

New Batavia spyware targets Russian industrial enterprises

Hundreds of GitHub Malware Repos Targeting Novice Cybercriminals Linked to Single User

Hundreds of GitHub Malware Repos Targeting Novice Cybercriminals Linked to Single User

Powershell: after 5 "type .\5\test.txt" calls, the test.txt file is a symlink to win.ini CMD: A single "type .\6\test.txt" call results in every single file being printed, including the final win.ini symlink

From over at the Bad Place:
There's an interesting NTFS symlink attack outlined here:
https://dfir.ru/2025/02/23/symlink-attacks-without-code-execution/

Basically, if an NTFS filesystem is corrupted in a way to provide duplicate file names, Windows will […]

[Original post on infosec.exchange]

This is what I personally did back when I was involved in cybercrime. We'd host all our servers in Russia, transfer payments via Russian banks, and route all our traffic through Russian residential ISPs, which typically resulted in most authorities not even bothering to investigate further. 7/?

cybercrime zeroday faded tee

cybercrime
but its bigger
and on both sides.

Well there are lots of people who have been treating Google and many others like that for ages, and this is why the solutions are already out.

You lose convenience the deeper you go, but the solutions are there.

well they exist ^^

VulnCheck has extracted and made a list of all the CVEs mentioned in a recent leak from the internal Matrix chat server of the BlackBasta ransomware group.

The list includes 62 vulnerabilities.

VulnCheck says the group focuses on CVEs with already public exploits

vulncheck.com/blog/black-b...

I cannot overstate the value of being in community with other activists right now. It is what gives me the strength to get up in the morning and fight fascism.

Fake GitHub projects distribute stealers in GitVenom campaign Kaspersky researchers discovered GitVenom campaign distributing stealers and open-source backdoors via fake GitHub projects.

"Over the course of the GitVenom campaign, the threat actors behind it have created hundreds of repositories on GitHub that contain fake projects with malicious code"

Campaign delivers an infostealer, obviously. The threat-du-jour these days

securelist.com/gitvenom-cam...

GitHub - antitree/seccomp-diff Contribute to antitree/seccomp-diff development by creating an account on GitHub.

I just finished our #shmoocon talk on container security. Here's my seccomp bpf disassembler and diffing tool.

github.com/antitree/sec...

Diving into ADB protocol internals:

part 01: www.synacktiv.com/publications...

part 02: www.synacktiv.com/en/publicati...

#adb #mobile #protocol #informationsecurity #cybersecurity #reverseengineering

PentesterLab Blog: Another JWT Algorithm Confusion Vulnerability: CVE-2024-54150 Discover how a code review uncovered a JWT algorithm confusion vulnerability (CVE-2024-54150). Learn key insights to enhance your security skills and spot vulnerabilities effectively.

These are some really nice blog posts regarding algo confusion bugs in JWT by @pentesterlab.com pentesterlab.com/blog/jwt-alg... & pentesterlab.com/blog/another... nice one @snyff.pentesterlab.com!

Курс рубля рухнет до 200 за доллар: экономист в РФ предупредил о приближении катастрофы – СМИ В России скопилась огромная рублёвая масса, которая уже вскоре хлынет на рынок и вызовет массовый спрос на валюту, это обвалит курс рубля как минимум до 200 за доллар.

Ruble to fall to 200 per dollar: Russian economist warns of approaching catastrophe – media

читайте подробнее на сайте "Диалог.UA": www.dialog.ua/business/306...

CVE-2024-51479: Next.js Authorization Bypass Vulnerability Affects Millions of Developers Find out about the Next.js vulnerability CVE-2024-51479 that could have exposed sensitive data. Take necessary measures to secure your Next.js application.

Wow, a fairly serious auth bypass in Next.js, a super popular frontend framework:

"If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed."

securityonline.info/...

The #OpenBSD Foundation is currently at ~$230,280 (65%) raised of the $350,000 goal for their 2024 Fundraising Campaign, and it's nearly the end of December. 🐡

www.openbsdfoundation.org/campaign2024...

www.openbsdfoundation.org/donations.html

Donations fund events for developers, infra. costs.

I did a blog instead of working on my projects again. This time a maldev blog talkin' about PE runtime decryption and other ways to be an asshole to the analyst. amethyst.systems/blog/posts/v... #infosec #malware

YouTube video by Objective-See Foundation Objective by the Sea v7.0 - Day 2

The #OBTS day 2 livestream is on!

www.youtube.com/watch?v=Nm0z...

Decrypting CryptProtectMemory without code injection

Decrypting CryptProtectMemory without code injection:

blog.slowerzs.net/posts/cryptd...

#crypto #decryption #cybersecurity #informationsecurity #rdp #windows #programming

"We can now share that our latest investigation also found links between some of Doppelganger’s activities and individuals associated with MGIMO (Moscow State Institute of International Relations)."

via Meta/PDF: scontent.fotp7-2.fna.fbcdn.net/v/t39.8562-6...

NTLM Relaying - Making the Old New Again | JUMPSEC LABS I am old enough to remember that it was not always possible to get domain admin within the first hour of a test via Active Directory Certificate Services (ADCS) misconfigurations or over permissioned ...

NTLM Relaying – Making the Old New Again
labs.jumpsec.com/ntlm-relayin...

ADCS Exploitation Series — Part 2: Certificate Mapping + ESC15 Certificate mapping is the process at the heart of multiple ADCS vulnerabilities, so I thought it would be appropriate to dedicate it its…

Great article on ESC15 especially after you realise PKInit won't work to auth but there is a workaround supplied too.

medium.com/@offsecdeer/...