ITSEC Newsletter 2025-02-20

Author

Henrik Falk
February 20, 2025

A Decade of Security Assessments: Security Issues That Refuse to Die

I recently took some time to reflect on my nearly decade-long career in information security, which led to a moment of introspection. After reviewing the assessments I've conducted across various consultancies and a diverse range of clients worldwide, I realized a recurring pattern: we often encounter the same vulnerabilities time and again.

www.sans.org/blog/a-decade-of-security-assessments-security-issues-that-refuse-to-die

(Anti-)Anti-Rootkit Techniques - Part III: Hijacking Pointers

In this final part of the trilogy, we will get rid of the main thread in our rootkit and will be implementing a "threadless" (of course you can not execute code without a thread, but threadless in the sense of not having a looping thread) user-to-kernel communication that is essentially immune against most detections of this kind.

eversinc33.com/posts/anti-anti-rootkit-part-iii.html

Reviewing the Cryptography Used by Signal

Last year, I urged furries to stop using Telegram because it doesn’t actually provide them with any of the privacy guarantees they think it gives them. Instead of improving Telegram’s c…

soatok.blog/2025/02/18/reviewing-the-cryptography-used-by-signal

Everyday Ghidra: How Platform Choice Influences Ghidra’s Binary Analysis

In the dynamic world of reverse engineering, where you run your tools can be just as critical as how you run them. Ghidra, the NSA’s powerful open-source software reverse engineering (SRE) suite, is no exception. This blog post introduces often-overlooked nuances of running Ghidra on different platforms. From extracting ordinal names of imported ordinals on Windows to parsing out imported dylibs from DYLD shared cache on macOS, we explore how platform-specific features can significantly enhance your binary analysis. Prepare to uncover the hidden potentials of Ghidra, and learn why the platform you choose to “fly your dragon” truly matters.

medium.com/@clearbluejar/everyday-ghidra-how-platform-choice-influences-ghidras-binary-analysis-76c40db0e407

Reinventing PowerShell in C/C++

I like PowerShell, I like it a lot! I like its versatility, its ease of use, its integration with the Windows operating system, but it also has a few features, such as AMSI, CLM, and other logging capabilities, that slow it down. You know, I’m thinking about the performance gain here. I believe my scripts could run a lot faster without them. Jokes aside, I know that a lot has already been done around this subject, but I wanted to approach the problem in a slightly different way than the existing projects. So, I worked on a way to instantiate a full-blown PowerShell console using only native code, which allowed me to do some “cleaning” at the same time.

blog.scrt.ch/2025/02/18/reinventing-powershell-in-c-c