January 24, 2019

AA19-024A: DNS Infrastructure Hijacking Campaign

Original release date: January 24, 2019 | Last revised: February 13, 2019 Summary The National Cybersecurity and Communications Integration Center (NCCIC), part of the Cybersecurity and […]
January 31, 2019

DDG Botnet: A Frenzy of Updates before Chinese New Year

1. Overview DDG is a mining botnet we discovered in Oct 2017 has been covered by us multiple times with some of its’ major updates. With […]
January 31, 2019

DDG 升级: P2P机制加持,样本对抗增强

1. 概述 DDG.Mining.Botnet(以下简称DDG)是我们首先感知并披露的挖矿僵尸网络。我们上一篇相关报告发布于 2018.11 月份,针对当时最新的版本 v3014 。最近,DDG 开始了频繁的更新:从 2019.1.3~2019.1.18 的半个月时间内,发布了 v3015~v3019 共 5 个版本,并在 2019.1.27 发布了最新的 v3020 版本。考虑到该 Botnet 的挖矿收益并不很多( Total Paid: 233.9472098595 XMR),春节前这么短时间如此频繁更新而且没有新增任何漏洞利用,是否有什么大动作,我们拭目以待。 经过我们的梳理分析,这几个版本的更新主要做了以下两件事: 僵尸网络内启用了P2P通信机制:集成了分布式节点控制框架 […]
February 1, 2019

Abusing Docker API | Socket

Notes on abusing open Docker socketsThis wont cover breaking out of docker containersPorts: usually 2375 & 2376 but can be anythingRefs:https://blog.sourcerer.io/a-crash-course-on-docker-learn-to-swim-with-the-big-fish-6ff25e8958b0https://www.slideshare.net/BorgHan/hacking-docker-the-easy-wayhttps://blog.secureideas.com/2018/05/escaping-the-whale-things-you-probably-shouldnt-do-with-docker-part-1.htmlhttps://blog.secureideas.com/2018/08/escaping-the-whale-things-you-probably-shouldnt-do-with-docker-part-2.htmlhttps://infoslack.com/devops/exploring-docker-remote-apihttps://www.blackhat.com/docs/us-17/thursday/us-17-Cherny-Well-That-Escalated-Quickly-How-Abusing-The-Docker-API-Led-To-Remote-Code-Execution-Same-Origin-Bypass-And-Persistence_wp.pdfhttps://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Docker.sock/https://cert.litnet.lt/2016/11/owning-system-through-an-exposed-docker-engine/https://medium.com/@riccardo.ancarani94/attacking-docker-exposed-api-3e01ffc3c124https://www.exploit-db.com/exploits/42356https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/docker_daemon_tcp.rbhttp://blog.nibblesec.org/2014/09/abusing-dockers-remote-apis.htmlhttps://www.prodefence.org/knock-knock-docker-will-you-let-me-in-open-api-abuse-in-docker-containers/https://blog.ropnop.com/plundering-docker-images/Enable docker socket (Create practice locations)https://success.docker.com/article/how-do-i-enable-the-remote-api-for-dockerdHaving […]