Pinned Tweet
spent some time upgrading the Android triage workflow to make use of the new VT plugin, add dynamic analysis support, and some other goodies: github.com/midnightcomms/cod…
David retweeted
My new guide explains how to build a malware analysis lab with REMnux. A Windows VM and REMnux share an isolated network. The AI agent runs on REMnux, with the model as its one allowlisted destination.
zeltser.com/malware-analysis…
David retweeted
Dug into the freezer hacks for SentinelLABS: the timeline, how they work, and who might be behind them.
Russian-aligned groups have relevant history here. That’s not enough to say they did these attacks. Read more here:
sentinelone.com/labs/defrost…
David retweeted
Today, we have set out our key judgements on how AI is expected to affect cyber security.
Read the latest:
ncsc.gov.uk/collection/annua…
ALT The impact of AI on cyber threat. Artificial intelligence is already beginning to reshape the cyber threat landscape. While AI is unlikely to fundamentally change the goals of hostile actors, it is highly likely to increase the speed, scale and efficiency with which they operate.
new post related to the progress of the codex skill for android analysis: intell.substack.com/p/taking…
David retweeted
Runtime Credential Guard deactivation via \\LSA_ISO_DISABLE_CREDENTIAL_GUARD + LSASS NT hash extraction (Win11 24H2) github.com/S12cybersecurity/…
wait till all these AI kids figure out that most modern applications won't run on vanilla Android images and all their "sandboxes" fail to load APKs
David retweeted
North Korean-linked actors have begun a new phase of laundering the funds stolen from Binance.
After draining $500M from TRON staging wallets, the launderers have started moving onto Solana.
The Reactor graph below shows the scale across blockchains.
David retweeted
The scale of the danger North Korea poses to crypto has become impossible to ignore.
This is the story of the investigators exposing North Korean operatives working inside the industry.
You think you know who your developer is.
But do you?
🎬 Introducing THE DEVELOPER.
David retweeted
Frida 17.25.0 is out, and it's a big one. Our out-of-process mapper, born on Darwin, is now cross-platform: agents are mapped straight into the target on Windows and Linux too, without a file on disk or a dlopen() in the target. Plus Efni, Idun, MTE on Darwin, and lots of fixes.
David retweeted
Someone is putting the law of every country into one git history.
Git for Global Law turns each country's laws into a repository where every commit is a real law taking effect. So you can see exactly what the law said on any date, and which law changed every word.
It started with the US Code, which hit #1 on Hacker News. The global version is growing country by country: Germany's constitution since 1949, Estonia and more so far.
Free to use for anything, and perfect for feeding to an AI.
github.com/lexifina/global-l…
David retweeted
As promised, and thanks to @yates82 and @jeppojeps for the help, here you can find Dragon-tales: github.com/Fare9/dragon-tale…
I hope the tool can be useful for someone else, and we will continue improving it with support for different architectures.
David retweeted
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
David retweeted
i decompiled the contract that drained binance wallet 14
gist.wavey.info/Ta3FgAxastgj…
David retweeted
Update: etherscan.io/tx/0x28262fbbcb…
They just approved AAVE.
Contagion in full effect
1/4 EIP-7702 can turn the wallet itself into the sweeper.
A Binance-labeled wallet moved 167,464 ETH + 63 tokens, including 1.615B USDT, just 3m24s after a signed delegation was installed.
This is bad.
etherscan.io/tx/0x53bd38b816…
