ITSEC Newsletter 2024-04-11

Red team is best team

Author

Henrik Falk
April 11, 2024

GMER - the art of exposing Windows rootkits in kernel mode

GMER is a well-known powerful anti-rootkit tool, which has been used for years by Windows IT pros to detect the presence of rootkits in the system. A rootkit is a kind of malicious software intended to hide the components and artifacts of malware. Historically, rootkits can be divided into two types: user mode (Ring 3) and kernel mode (Ring 0). Nowadays, there are also malicious implants designed to work at the hypervisor (Ring -1) and SMM (Ring -2) privilege levels. We're gonna focus on the most common type, the kernel mode rootkit, and will simply refer to it as a rootkit.

artemonsecurity.blogspot.com/2024/04/gmer-art-of-exposing-windows-rootkits.html

EM Eye: Eavesdropping on Security Camera via Unintentional RF Emissions

In their research, the team discovered that security cameras leak enough sensitive RF that an image can be recovered from the leakage over a distance. In their tests, they used a USRP B210 SDR as the receiver and tested twelve cameras including four smartphones, six smart home cameras, and two dash cams. They found that eight of the twelve leaked strongly enough for the reception of images through windows, doors, and walls. Cameras like the Xiaomi Dafang and Wyze Cam Pan 2 performed the worst, allowing for images to be recovered from distances of 500cm and 350cm respectively.

www.rtl-sdr.com/em-eye-eavesdropping-on-security-camera-via-unintentional-rf-emissions

BatBadBut: You can't securely execute commands on Windows

The BatBadBut is a vulnerability that allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied. CreateProcess() implicitly spawns cmd.exe when executing batch files (.bat, .cmd, etc.), even if the application didn’t specify them in the command line. The problem is that the cmd.exe has complicated parsing rules for the command arguments, and programming language runtimes fail to escape the command arguments properly. Because of this, it’s possible to inject commands if someone can control the part of command arguments of the batch file.

flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows