Micah LeeCheck out my #DEFCON33 talk about the Signalgate, full of unbelievable incompetence from the highest levels of the Trump administration https://www.youtube.com/watch?v=KFYyfrTIPQY
I help keep the internet safe - very indirectly
Mandiant person
Barry V
- 43 Followers
- 44 Following
- 70 Posts
YouTube
Andrew NesbittSlopsquatting – when an LLM hallucinates a non-existent package name, and a bad actor registers it maliciously. The AI brother of typosquatting.
Credit to @sethmlarson for the name
Jason KoeblerNEW: Yesterday, a T-Mobile tracking app for children began showing parents the exact real-time locations and images of random kids, and showed the locations of their own kids to other random adults:
Volexity 
In the course of its investigations, @volexity frequently encounters malware samples written in Golang. This reflects the increase in popularity of the Golang generally, and presents challenges to reverse engineering tools.
Today, @volexity is releasing GoResolver, open-source tooling to help reverse engineers understand obfuscated samples. @r00tbsd & Killian Raimbaud presented details at INCYBER Forum earlier today.
GoResolver uses control-flow graph similarity to identify library code in obfuscated code, leaving analysts with only malware functions to analyze. This saves time & speeds up investigations!
Check out the blog post on how GoResolver works and where to download it: https://www.volexity.com/blog/2025/04/01/goresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically/
#dfir #reversing #malwareanalysis
Today, @volexity is releasing GoResolver, open-source tooling to help reverse engineers understand obfuscated samples. @r00tbsd & Killian Raimbaud presented details at INCYBER Forum earlier today.
GoResolver uses control-flow graph similarity to identify library code in obfuscated code, leaving analysts with only malware functions to analyze. This saves time & speeds up investigations!
Check out the blog post on how GoResolver works and where to download it: https://www.volexity.com/blog/2025/04/01/goresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically/
#dfir #reversing #malwareanalysis
GoResolver: Using Control-flow Graph Similarity to Deobfuscate Golang Binaries, Automatically
In the course of its investigations, Volexity frequently encounters malware samples written in Golang. Binaries written in Golang are often challenging to analyze because of the embedded libraries and the sheer size of the resulting binaries. This issue is amplified when samples are obfuscated using tools such as Garble, an open-source Golang obfuscation tool.The popularity of Golang amongst malware developers, and the use of obfuscators to make reverse-engineering harder, raised the need for better tooling to assist in reverse-engineering efforts. Volexity developed GoResolver, an open-source tool...
Picard TipsPicard management tip: Some of your decisions are going to be mistakes. You have to make them anyway.
Dan GoodinA prominent computer scientist who has spent 20 years publishing academic papers on cryptography, privacy, and cybersecurity has gone incommunicado, had his professor profile, email account, and phone number removed by his employer Indiana University, and had his homes raided by the FBI. No one knows why.
#XiaofengWang Xiaofeng Wang
Matthew GreenI just heard that a cryptography professor at Indiana University had his house raided and was fired. Don’t know much more. https://www.heraldtimesonline.com/story/news/local/2025/03/28/fbi-department-of-homeland-security-agents-search-house-in-bloomington-indiana/82710451007/
Great thread on HVCI and the very poorly understood and communicated Windows driver blocklist(s) and mitigations against BYOVD attacks.
Microsoft added a lot of complexity to the existing Authenticode revocation mechanisms by choosing to sign drivers with the same Microsoft issued certificate in bulk.
From: @wdormann
https://infosec.exchange/@wdormann/114105225709232478
Will Dormann (@[email protected])
Attached: 2 images I recently deleted a thread here as my tests were not valid. What was wrong? The driver I was using as an example of "blocked via signer" was indeed in the [Microsoft recommended driver block rules](https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules) list for **TWO YEARS** (It's present in a March 2023 version of the list). Given that the blocklist is updated on Windows endpoints "1-2 times per year", this should be present in the blocklist on a Win11 machine in 2025, right? Get real. It's bugs all the way down. No, I haven't (yet?) investigated which drivers are in the official list online, but are missing on Windows endpoints. But the fact that the first viable-for-testing driver that I chose was **NOT** in the list on endpoints... let's just say that this isn't a good sniff test. Anyway, the problem that came to my attention on the Bad Place was that a user complained that that a driver that was expected to be blocked was being allowed to run if HVCI ("Memory integrity") wasn't enabled. This can't be right, can it? Yes, it's true. The drivers listed in the Microsoft recommended driver block rules list by way of their signing certificate do **NOT** result in the driver being blocked (via WDAC). So just as a test, I created my own WDAC block list (with [App Control Wizard]( https://webapp-wdac-wizard.azurewebsites.net/) and applying it with [ApplyWDAC](https://github.com/vu-ls/applywdac)) for an arbitrary driver. Let's compare 3 drivers that should be blocked, on a system with HVCI off, and on a system with HVCI on. - Blocked via Authentihash in the MS vulnerable driver blocklist - Blocked via Signer Cert in the MS vulnerable driver blocklist - Blocked via Signer Cert via WDAC manually If you do not have HVCI enabled, you are likely missing driver blocks that you are supposed to be getting.
Jerry 🦙💝🦙@threatresearch Thanks - donation links are here: https://infosec.exchange/@jerry/109581969726975197 - ko-fi is the best deal (they don't take any fees) for recurring donations.