CIA Evidence of hacking kept secret

nice little pragmatic article, IMO

Why the CIA won’t want to go public with evidence of Russia’s hacking

https://www.washingtonpost.com/posteverything/wp/2016/12/27/why-its-so-hard-to-prove-russia-was-behind-the-election-hacks/

Navy hacked through HP

http://mobile.reuters.com/article/idUSKBN13J001

Third party supplier strikes again. My guess is the was no FDE on the laptop.

Free Malware Samples

http://www.freetrojanbotnet.com/

Targeted password attacks

http://www.theregister.co.uk/2016/11/15/stop_using_birthday_in_password/

New hacker bounty

Army Bug Bounty Building New Relationships with Hackers https://threatpost.com/army-bug-bounty-building-new-relationships-with-hackers/121924/

Nation State Attribution

http://carnal0wnage.attackresearch.com/2016/11/on-nation-states-and-sophistication.html?m=1

New online site

A new site I found via some cohorts on twitter. Not sure on the validity of data just yet, but could become a useful addition to the toolbox.

https://suspect-networks.io/

not so new way to keylog

https://www.cyberpointllc.com/srt/posts/srt-logging-keystrokes-with-event-tracing-for-windows-etw.html

Along with other bugs.......

USN-3087-2: OpenSSL regression | Ubuntu http://www.ubuntu.com/usn/usn-3087-2/

Introduction to Malware Analysis

introduction to Malware Analysis by  Lenny Zeltser

https://vimeo.com/9474345

New mega-breach

http://thehackernews.com/2016/09/plaintext-passwords-leaked.html

Practice on ntds.dit file

https://blog.didierstevens.com/2016/07/25/practice-ntds-dit-file-overview/

Huge thanks to Didier Stevens for this

Using IDAPython

Part 1
Part 2
Part 3
Part 4
Part 5
Part 6

Radare2 walk through for beginners

http://blog.devit.co/diving-into-radare2/

More Practice Sites

https://hackerlists.com/hacking-sites/


to safely practice hacking.

Funny

"I need an any/any bidirectional exception in the IPS and Firewall for this netblock." Netblock is a Class C "Let me check the Infosec Guidebook..."

https://securityreactions.tumblr.com/post/146559515028

Another gruq post

Surveillance Evasion https://protectioncircle.org/2016/06/14/surveillance-evasion/

New data exfiltration method

Clever Attack Uses the Sound of a Computer’s Fan to Steal Data

https://www.wired.com/2016/06/clever-attack-uses-sound-computers-fan-steal-data/

SpyEye creators arrested

http://thehackernews.com/2016/04/spyeye-banking-trojan.html

a lot of money for nothing......

http://thehackernews.com/2016/04/fbi-unlock-iphone.html

Something tells me that the leak that nothing significant was gained form breaking into the famous iPhone is a ruse, or miss-direction. If you will. I am guessing they found some things, that can add a few pieces to the big puzzle, but nothing earth shattering.

Some XSS Links

Port Swigger

Royal Jay

Windows DLL Injection

the basics

metasploit




Tools:
DueDLLigence

Tactical Exploitation

was a nice quick read.
Good to refer to every once and a while.

https://www.defcon.org/images/defcon-15/dc15-presentations/Moore_and_Valsmith/Whitepaper/dc-15-moore_and_valsmith-WP.pdf

Volatility as a library

http://dsocon.blogspot.co.uk/2012/08/using-volatility-framework-as-library.html

Operation Blockbuster

https://www.operationblockbuster.com/resources/index.html

CTF Field Guide

https://trailofbits.github.io/ctf/index.html