Cybersecurity and everything else!
On an iPhone X running iOS 16.7.10, Analytics was off and the upload queues were empty. The unified log, location caches, per-app network database, and Duet were still recording.
Continue reading →Facebook 584 on iOS 16. Permissions gate the sensors. FFLogger, ENIGMA, the on-device ad model, MQTT, and the family device id do not ask.
Continue reading →Muse (com.facebook.aura, Hatch) is built to act: SMS, every notification, calls, contacts, calendar, health, and a cloud browser logged in as you.
Continue reading →Katana 583. A 90 second foreground loop uploads GPS, every nearby Wi-Fi AP, and an unfiltered BLE census. Most of the heartbeat does not need a permission at all.
Continue reading →Kerberoasting and AS-REP roasting are still bread-and-butter AD abuse. Rubeus makes both loud in a lab and educational on the wire: the LDAP search that finds targets is …
Continue reading →BloodHound / SharpHound / bloodhound-python are not subtle on LDAP if you know what “enumerate the world” looks like. Host telemetry helps. On a span or IDS sitting …
Continue reading →PetitPotam is the “please coerce that machine into authenticating over there” energy that made AD CS and NTLM relay feel fresh again for a while. Different story than …
Continue reading →Impacket is still the Swiss army knife people reach for when they want AD pain without opening Visual Studio. In the lab I care less about the binary …
Continue reading →Yeah so AD CS abuse is one of those things that looks clean in a conference talk and messy the second you try to detect it on a …
Continue reading →Citrix Bleed — CVE-2023-4966 — is one of those bugs where the CVSS number under-sold how people were actually getting ransomed. Memory disclosure on NetScaler ADC / Gateway-style …
Continue reading →