Proprietary Software and Security
-
Infamous Chisel Malware Analysis Report
The UK National Cyber Security Centre (NCSC), the U.S. National Security Agency (NSA), U.S. Cybersecurity and Infrastructure Security Agency (CISA), U.S. Federal Bureau of Investigation (FBI), New Zealand’s National Cyber Security Centre (NCSC-NZ), the Canadian Centre for Cyber Security – part of the Canada’s Communications Security Establishment (CSE), and Australian Signals Directorate (ASD) are aware that the actor known as Sandworm has used a new mobile malware in a campaign targeting Android devices used by the Ukrainian military. The malware is referred to here as Infamous Chisel.
-
Saying Goodbye to WordPad: Windows' Staple for 28 Years Gets the Chop
WordPad has been a Windows staple since the days of Windows 95. Now Microsoft says you should use Word or Notepad instead.
-
Mashing Enter to bypass full disk encryption with TPM, Clevis, dracut and systemd
Using the vulnerability described in this advisory an attacker may take control of an encrypted Linux computer during the early boot process, manually unlock TPM-based disk encryption and either modify or read sensitive information stored on the computer’s disk. This blog post runs through how this vulnerability was identified and exploited - no tiny soldering required.
-
Spoofing certificates with MD5 collisions
I attended a presentation at Crypto and Privacy village where Tomer Peled and Yoni Rozenshein from Akamai. They reverse engineer a Windows update to crypt32.dll to find out what's behind CVE-2022-34689. A truncated MD5 was used as an index to a hash table which caches whether a certificate has been validated successfully. Only the MD5 was compared when the entry was found in that cache. By using MD5 collisions, they found that crypt32.dll would validate a malicious certificate after an honest certificate was validated.
This talk summary is part of my DEF CON 31 series. The talks this year have sufficient depth to be shared independently and are separated for easier consumption.