Collaborate Disseminate
Documents such as driving license, financial statements etc. with a lot of PII, how big is the risk of storing such type of documents on the shared external storage on android?
Assumptions:
Android device is encrypted but the individual f… Continue reading What are the security risks of storing sensitive documents on your android devices’s external storage?
I want to hook certain API calls, e.g. CreateFile (or NtCreateFile if I hook ntdll.dll), but there are some issues.
I can use several methods to achieve this goal, e.g. DLL injection, Inline hooking etc. But I think the most pragmatic way … Continue reading API hooking with Microsoft Detours
Trying to boot Ubuntu as read-only.
Installed overlayroot and set overlayroot to tmpfs.
$ sudo apt install -y overlayroot
$ sudo sed -i ‘s/overlayroot=""/overlayroot="tmpfs"/g’ /etc/overlayroot.conf
$ sudo systemctl r… Continue reading How to boot Ubuntu as read-only… using overlayroot is apparently not enough? [migrated]
I have a trusted html file containing a script that handles sensitive information. When I open it in Chrome 108 on Android, it says:
What is this about?
The above warning seems to appear independently of the method that file.html uses for… Continue reading How does an attacker modify local files when I access them in Chrome?
Does anyone understand what the author means which this (please see the screenshot below).
This is a link to the paper, it’s on page 19 (page 28 if you count all pages):
https://pure.tue.nl/ws/portalfiles/portal/72275825/738228_Mulders_D.A… Continue reading Rename file by Ransomware- Does anyone know what is ment by this? [closed]
We blocked USB ports on most of the devices using Intune. However, a subset of users requires USB access due to their job scope which requires them to copy images from their cameras to their PCs. Is there a way we can restrict users from c… Continue reading How can we restrict users from copying "non-allowed" file types from USB?
I have a Node.js app which has a lot of npm-dependencies, running on Linux (Centos) machine.
When Node starts, the script has access to the files outside its directory (as least by default), so malicious npm-package could traverse a direct… Continue reading Restrict node.js filesystem access
In fscrypt, master key is received from userspace and actual encryption keys are derived from this master key using KDF. If any other process is able to get hold of the master key, they can unlock the encrypted directory and access the con… Continue reading fscrypt master key handling at kernel space adding additional secure params
Some time ago I read an article that mentioned that it is possible for some ransomware to change the magic numbers of a file (that makes sense). However, the authors claimed that their method was better, because they calculated the entropy… Continue reading Why does some Ransomware encrypt also the file header and trailer?
If you use Shannon’s entropy as an indicator to distinguish between encrypted and legitimate files, then it will be difficult to make a distinction between encrypted and compressed files, as both have a relatively high entropy value.
How i… Continue reading Why does ransomware also encrypt the file signature? [closed]