@benherzog
security researcher @research.checkpoint.com
(VB25) Inside Akira Ransomware's Rust Experiment
(VB25) Inside Akira Ransomware's Rust Experiment
Executive Summary Introduction Earlier this year, Talos published an update on the ongoing evolution of Akira ransomware-as-a-service (RaaS) that has become one of the more prominent players in the current ransomware landscape. According to this update, for a while in early 2024, Akira affiliates experimented with promoting a new cross-platform variant of the ransomware called […]
In the Wild: Malware Prototype with Embedded Prompt Injection
In the Wild: Malware Prototype with Embedded Prompt Injection
Detected for the first time, malware attempts AI evasion by injecting a prompt to tell the LLM to label the file as benign
(AVAR24) GPT vs Malware Analysis: Pitfalls and Mitigations
(AVAR24) GPT vs Malware Analysis: Pitfalls and Mitigations
Key Takeaways Introduction GPT technology is the current tech cycle’s veritable miracle. The skeptics insist that it just has the appearance of intelligence, and try to cast it as ‘just the latest buzzword’, making snide comparisons to NFTs and blockchains. But from intimate experience, we can say these comparisons are deeply unfair — we’ve had […]
(37c3) Rust Binary Analysis, Feature by Feature
(37c3) Rust Binary Analysis, Feature by Feature
Attacking Very Weak RC4-Like Ciphers the Hard Way
Attacking Very Weak RC4-Like Ciphers the Hard Way
What? RC4 is a popular encryption algorithm. The way it works is that a “Key Scheduling Algorithm” (KSA) takes your key and generates a 256-byte array, and then a “Pseudo-Random Generation Algorithm” (PRGA) uses that byte array to output an endless stream of bytes (the “key stream”), which look like random noise unless you know […]
The Cat and Mouse Game: Exploiting Statistical Weaknesses in Human Interaction Anti-Evasions
The Cat and Mouse Game: Exploiting Statistical Weaknesses in Human Interaction Anti-Evasions
Executive Summary Why We Care about Sandbox Emulation As a discipline, information security involves a vast web of entry vectors, mitigations, and counter-mitigations. Among these, one of the most impactful points of conflict between attackers and defenders is what happens when binaries are subjected to sandbox emulation. Purely static analysis has been understood to be […]
(insomni'hack 24) Rhadamanthys: The “Everything Bagel” Infostealer
(insomni'hack 24) Rhadamanthys: The “Everything Bagel” Infostealer
Tunnel Warfare: Exposing DNS Tunneling Campaigns using Generative AI
Tunnel Warfare: Exposing DNS Tunneling Campaigns using Generative AI
Introduction Generative AI has been around for nearly a decade, strictly speaking, but the recent boom in this technology has inspired renewed interest in its possible applications to challenges facing the information security community. Finding these challenges entails searching through a very large haystack consisting of brand-new binaries, documents, domains and other artifacts that flood […]
(VB23) Darkbit decoded: (crypt)analysis of an Iranian-sponsored attack
(VB23) Darkbit decoded: (crypt)analysis of an Iranian-sponsored attack
VB2023 paper: Darkbit decoded: analysis of an Iranian-sponsored attack
Motivated Math: What's up with 'Normal Subgroups' and 'Open Sets'?
Motivated Math: What's up with 'Normal Subgroups' and 'Open Sets'?
(HCKSYD22) Tropic Troubles: In this Campaign, Your Tool Hacks You
(HCKSYD22) Tropic Troubles: In this Campaign, Your Tool Hacks You
The talk covers a cluster of activity making use of the Trojan YAHOYAH, as described in Trend Micro’s original report about the “Tropic Trooper” group. It ex...
Cryptographic Attacks: A Guide for the Perplexed - Part I
Cryptographic Attacks: A Guide for the Perplexed - Part I
Research by: Ben Herzog Introduction When some people hear “Cryptography”, they think of their Wifi password, of the little green lock icon next to the address of their favorite website, and of the difficulty they’d face trying to snoop in other people’s email. Others may recall the litany of vulnerabilities of recent years that boasted a […]
Cryptographic Attacks: A Guide for the Perplexed - Part II (Modern Attacks)
Cryptographic Attacks: A Guide for the Perplexed - Part II (Modern Attacks)
Introduction Cryptographic attacks, even more advanced ones, are often made more difficult to understand than they need to be. Sometimes it’s because the explanation is “too much too soon” — it skips the simple general idea and goes straight to real world attacks with all their messy details. Other times it’s because of too much […]
(VB21) Pay2Key – the newly discovered ransomware traced all the way to Iran
(VB21) Pay2Key – the newly discovered ransomware traced all the way to Iran
XORcism: break rotating-xor (and similar) ciphertexts
XORcism: break rotating-xor (and similar) ciphertexts
Command-line tool that breaks rotating-xor (and similar) ciphertexts - BenH11235/XORcism
(AVAR20) Gozi: The Malware with a Thousand Faces
(AVAR20) Gozi: The Malware with a Thousand Faces
A First Introduction to System Exploitation with Pwnable.kr
A First Introduction to System Exploitation with Pwnable.kr
Dive into the World of Vulnerability Research
Dive into the World of Vulnerability Research
(PHDays19) Disable "Enable Macros": Using OCR to Shut Down Social Engineering
(PHDays19) Disable "Enable Macros": Using OCR to Shut Down Social Engineering
"DiD it" (CryptoCTF23) Solved The Decidedly Wrong Way
"DiD it" (CryptoCTF23) Solved The Decidedly Wrong Way
(VB16) Great Crypto Failures
(VB16) Great Crypto Failures
Scriptable Remote Debugging with Windbg and IDA Pro
Scriptable Remote Debugging with Windbg and IDA Pro
(32c3) Automatic Detection of Fast Flux Domains using Machine Learning
(32c3) Automatic Detection of Fast Flux Domains using Machine Learning
(31c3) Finding the Weak Crypto Needle in a Byte Haystack
(31c3) Finding the Weak Crypto Needle in a Byte Haystack
Malware Against the C Monoculture
Malware Against the C Monoculture
The Blitz Tutorial Lab on Fuzzing with AFL++
The Blitz Tutorial Lab on Fuzzing with AFL++
GandCrab: Ransomware Goes Agile, Fails at Cryptography
GandCrab: Ransomware Goes Agile, Fails at Cryptography
The Inside Scoop on a Six-Figure Nigerian Fraud Campaign
The Inside Scoop on a Six-Figure Nigerian Fraud Campaign
Godzilla Loader and the Long Tail of Malware
Godzilla Loader and the Long Tail of Malware
The Laconic Log4Shell FAQ
The Laconic Log4Shell FAQ
SUNBURST, TEARDROP and the NetSec New Normal
SUNBURST, TEARDROP and the NetSec New Normal
The Death of "Please Enable Macros" and What it Means
The Death of "Please Enable Macros" and What it Means
Leaks of Conti Ransomware Group Paint Picture of a Surprisingly Normal Tech Start-Up... Sort Of
Leaks of Conti Ransomware Group Paint Picture of a Surprisingly Normal Tech Start-Up... Sort Of
A Targeted Campaign Break-Down - Ryuk Ransomware
A Targeted Campaign Break-Down - Ryuk Ransomware
View on mobile
Explore other Linktrees
Heather Traska
@heathertraska
Substack
@substackinc
jimgaffigan
@jimgaffigan
Deuxmoi
@deuxmoi
Are We Still Friends
@awsfpod
Raedio
@raedio
BNC Map
@bncmap
davestewart
@davestewart
Katie Lynn
@katielynnteaches
Julian Sewell
@juliansewell
previous
next
Discover more
See all
@nwspinnersandfiberarts
@thespokenarabic
@kvespta
@MdLionparcelSoc
@cerebrodeleche
@ssnb.roosendaal
@Mholonz
@history29032006
@ayleexlo
@bartolomeofernandez
@ead.cedaf
@tekniksamarindaulu
@sinarankreasi
@gimenezvitoria
@crescantband
@glowandgrace25
@qcleanco
@antrix.musik
@bambi.thalia
@annaferremodafeminina
@markcoxcoaching
@grabrielamarques
@sancarlostrc
@true_collects
@holidayclub.yvr
@lxgxnd2125
@psn.project
@Dewisekar_offroadsentul
@DhiyaMedika
@fudoseki
@pamelastonemusic
@drabeatrizleitzke
@dindadwirisma
@LifetimeofMe
@singhwindowtint
@meumundoaquarela
@nollysalon1
@lipeduerj.oficial
@pvsjadaun
@Lostrailadventures
@dulcescaprichosve
@FAMFCOMPANY
@honicintiasantos
@wellnesswithinstl
@AjentVee