Lmst

Easter has been hacked. #directorytraversal

A hard boiled egg with "../" on it. Sanitize your inputs!

I've been wondering for a long time if #DirectoryTraversal vulnerabilities could be mitigated by a safe path handling library (similarly to e.g. ORM's). As a side-quest, I stared to implement a prototype for Python, and I'm super interested in your unfiltered opinions:

https://github.com/v-p-b/SafePath/

"🔍 Deep Dive into XorDDoS Behavior 🧠"

Before compromising a device, the XorDDoS Trojan initiates a scanning process using HTTP requests to identify potential vulnerabilities. The attackers probe for an HTTP service susceptible to directory traversal, aiming to access the /etc/passwd file. Once vulnerabilities are identified, the attackers use SSH brute-force attacks to gain initial access, followed by malware deployment. The Trojan employs XOR encryption for data related to its execution and communicates with C2 servers, awaiting commands.

The XorDDoS Trojan continues to pose a threat by evolving its tactics, and comprehensive security measures are necessary to mitigate its impact.

Please see the source for more details and an extensive list of IoC's!

Source: Palo Alto Networks - Unit 42

Tags: #XorDDoS #TrojanBehavior #HTTPScanning #DirectoryTraversal #SSHBruteForce #Encryption #C2Communication 🕵️‍♂️🔒🌍