Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
When Your Sandbox Fails
Oldest First  |  Newest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
4/11/2019 | 12:36:34 PM
On Time
State sponsored actors and hackers have one huge advantage - time.  And the ability to think.  All they do is think about ways to hack and break into systems being as innovative as this article indicates.  New will always happen and they time on their hands to do more wrong, hence their attacks increase in sophistication.  We shall always be 5 minutes behind them at the least.  WE have daily chores, work and fighting infections among them while hunting down particulars of the infection real fast .... and they just have to think it up and release it.  No need to fight it for them.  They have the advantage, always have and always will. 

And again email delivery to user.  If you don't need it, don't read it, delete it.
ChadL196
50%
50%
ChadL196,
User Rank: Author
4/12/2019 | 12:55:18 PM
Sandbox evasion
Hi Kowsik,

Thanks for the read. Sandbox evasion is what we live and breathe. We've published our own work on that, and have dealt with the use cases you describe. Of course, some of it is dependant on the customer ensuring their analysis environment matches their own target environment. Hence we support gold images as analysis targets for ex. And tailoring of the localisation settings and VPN settings for outbound communication: https://www.vmray.com/cyber-security-blog/sandbox-evasion-techniques-part-1/


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-37742
PUBLISHED: 2021-07-30
app/View/Elements/GalaxyClusters/view_relation_tree.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster relationships.
CVE-2021-37743
PUBLISHED: 2021-07-30
app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.
CVE-2021-37746
PUBLISHED: 2021-07-30
textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks before accepting a click.
CVE-2020-26563
PUBLISHED: 2021-07-30
ObjectPlanet Opinio before 7.13 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted users.)
CVE-2021-37606
PUBLISHED: 2021-07-30
Meow hash 0.5/calico does not sufficiently thwart key recovery by an attacker who can query whether there's a collision in the bottom bits of the hashes of two messages, as demonstrated by an attack against a long-running web service that allows the attacker to infer collisions by measuring timing d...