Infosec enthusiast, husband, father, son. This tweeter account is mainly for saving and sharing infosec stuff I encounter on the internet.
Seoul, Republic of Korea
Joined March 2009
- Tweets7.1K
- Following2.1K
- Followers648
- Likes2.5K
Byungho Min retweeted
New fastest shortest-path algorithm in 41 years!
Tsinghua researchers broke Dijkstra’s 1984 “sorting barrier,” achieving O(m log^(2/3) n) time. This means faster route planning, less traffic, cheaper deliveries, and more efficient networks - and a CS curriculum revamp =)
Byungho Min retweeted
Talking at @defcon was fun as always! The source code for the tools is public
github.com/deepinstinct/Shim…
#DEFCON #DEFCON32
Byungho Min retweeted
Another method that still works on most EDRs is HVCIDisallowedImages reg key that blocks drivers by filename.
Can take multiple filenames, but requires HVCI to be enabled + reboot.
Byungho Min retweeted
Just wrapped up DEF CON Demo Labs and published Maestro, a new tool for lateral movement with Intune from C2. Thanks to everyone who came to check it out! I'll be posting a blog and wiki with more info soon, but here's the code and link to today's slides: github.com/Mayyhem/Maestro
Byungho Min retweeted
[RELEASE] Following the talk at DEF CON, I'm releasing all the POC projects associated with DriverJack. More info in the repos. For any additional info, hit me up ;)
- github.com/klezVirus/DriverJ…
- github.com/klezVirus/RpcProx…
- github.com/klezVirus/koppeli…
Byungho Min retweeted
Dropped a new tool at DEF CON 32! Loot SCCM Distribution points via HTTP with github.com/badsectorlabs/scc…
We've found credentials, certificates, custom apps, keystores, etc. What will you find?
Byungho Min retweeted
The eighth article (62 pages) of Malware Analysis Series (MAS) is available on:
exploitreversing.com/2024/08…
I am actively writing the following articles:
01. ER_03 (Hyper-V)
02. ER_04 (MacOS/iOS)
My focus is on writing articles in the Exploiting Reversing series (ERs), which is a series of security research on Windows, macOS, hypervisors and browsers. I will eventually write one or two more articles in the Malware Analysis Series to round it out in the meantime.
Finally, I'd like thank @ilfak and @HexRaysSA for their constant and complete support, which made it possible for me to write these articles.
I hope I have news about new articles soon.
Have an excellent day.
#malwareanalysis #macOS #iOS #apple #malware #infosec
Byungho Min retweeted
We found a CPU bug that allows an arbitrary physical memory write, thus allow to *read* and *write* the memory for every process!
Check out the website for more details:
ghostwriteattack.com
With the #GhostWrite CPU vulnerability, all isolation boundaries are broken - sandbox/container/VM can't prevent GhostWrite from writing and reading arbitrary physical memory on affected RISC-V CPUs. Deterministic, fast, and reliable - no side channels. ghostwriteattack.com/
Byungho Min retweeted
Rooting Android: Exploiting Your GPU On Smartphone (CVE-2024-23380) by @vxradius
PoC exploit is not available for download.
[slides] i.blackhat.com/BH-US-24/Pres… #BlackHat
Byungho Min retweeted
we got an ~RCE on M365 Copilot by sending an email
by ~RCE I mean full remote control over
its actions - search for sensitive content (sharepoint, email, calendar, teams), execute plugins
and outputs - bypass DLP controls, manipulate references, social engineer its users on our behalf
#BHUSA #DEFCON @tamirishaysh
Byungho Min retweeted
Over a year ago, I left my position at WithSecure to start a new journey, create something new, and do my own thing. Today, I'm excited to publicly announce what I've been working on all this time.
Introducing 0xC2, a cross-platform C2 framework targeting Windows, Linux, and MacOS environments: 0xc2.io
The first release was back in late 2023, initially only offered to a small circle of red teamers and soon, the registration will be open for new clients who provide threat simulation services.
All agents are written as PIC in C to provide better opsec and to allow operators to be more flexible when designing payloads. To make the agents modular and fully customizable, operators can create a user-defined virtual table that can be hooked by the agent. This can be used to change the default behavior of an agent or extend capabilities, from adding internal commands to implementing P2P protocols.
More details will be available soon.
Byungho Min retweeted
Heap overflow in JPEG loading in Samsung's Little Kernel in bootloader allows a privileged attacker to execute persistent arbitrary code (it survives reboots and factory reset) CVE-2024-20832 by @quarkslab
Paper: sstic.org/media/SSTIC2024/SS…
Slides: sstic.org/media/SSTIC2024/SS…
Byungho Min retweeted
This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n
Byungho Min retweeted
"With the updates from Ghidra, OpenAI, and others, we now have better options for reversing using AskJOE!", said Threat Researcher, @moval0x1, uploading a new version of #AskJoe to our Github 🎉
Download here: github.com/securityjoes/AskJ…
Here is the list of updates for this new release:
💠 Ghidrathon added and removed pyhidra
💠 Refactored Code
💠 AI Triage added
💠 Better Name added
💠 Search for crypto constants added
💠 Mandiant CAPA added
Take a look at how the fancy AI Triage works 🐩
Byungho Min retweeted
Yesterday, CrowdStrike released an update that began impacting IT systems globally. We are aware of this issue and are working closely with CrowdStrike and across the industry to provide customers technical guidance and support to safely bring their systems back online.
Byungho Min retweeted
And as expected... @crowdstrike ambulance chasing is starting. https://www.crowdstrikeclaim[.]com #crowdstroke
Byungho Min retweeted
MemProcFS 5.10 released! Support for Windows 11 24H2 added!
MemProcFS - super fast memory forensics of live memory and memory dumps! github.com/ufrisk/MemProcFS
Byungho Min retweeted
Sharing a simple hypervisor for learners in Rust, inspired by @memN0ps 's work
github.com/tandasat/bareviso…
✅ Stable Rust
✅ Covers AMD and Intel
✅ Compiles into UEFI and Windows drivers
✅ Can test on a VM with one shortcut key
✅ Builds on 🪟Windows, 🍎macOS and 🐧Ubuntu
Enjoy!
