Viewing profile — gus_

1. restrict outbound connections by binary. 2. restrict outbound connections to known malicious IPs or domains. 3. run untrusted code/apps: - under a different user - or inside a s…

Unfortunately this order will probably be revoked in 2027/2028, we'll see.

Also bear in mind, that many rootkits hide processes and connections from command line tools like ps, top, lsof, netstat, ss, etc... In this particular malware campaign, the malwar…

indeed OpenSnitch helps, pihole I'm not so sure (maybe if the c2c servers are in a blocklist...): https://www.reddit.com/r/linux_gaming/comments/1u34pe3/comme...

A year ago a similar attack was reported and I think that there have been similar campaigns reported this year: https://github.com/evilsocket/opensnitch/discussions/1290#di... - Th…

https://ioctl.fail/preliminary-analysis-of-aur-malware/ https://markdownpastebin.com/?id=d2a04939f1d7461ea0d36e438a4...

https://www.reddit.com/r/neovim/comments/1j45stl/someone_wro...

restrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data. Take for example this activity from a malicious extension: Th…

https://www.reddit.com/r/neovim/comments/1j45stl/someone_wro...

https://www.reddit.com/r/neovim/comments/1j45stl/someone_wro...

the pop-ups fatigue is already an issue, and not an easy one to solve. Pretty much like SIEM/SOC alerts. > The trick is to infect a plugin that has a legitimate reason for accessin…

> It's trivial to do this in a way to avoid detection I'd love to see a real example/PoC. Anyway, we discussed this issue in the other thread. For me, unrestricted outbound request…

absolutely. These attacks will evolve for sure, like the malware evolved on Microslop for years. But for the time being, the common entry vector is clear: https://github.com/evilso…

so how did they exfiltrate the information without noticing? what OS was the developer using? what security measures were they using? yesterday discussion https://news.ycombinator.…

btw, this analysis of a node linux malware with OpenSnitch and other tools was published on reddit a year ago (a malicious linkedin interview targeting web3/crypto devs that result…

Personally I don't allow outbound connections from almost any app, except web browsers to port 80/443. So nodejs, pip, ruby, curl, wget, etc, opening unexpected outbound connection…

https://itsfoss.com/munich-linux-failure/ It doesn't matter if this or that doesn't work. Or if Microslop pressures to continue using Winslop. Now the reasons are geopolitical.

OpenSnitch (+ block lists) ;) or DNS stubs with filtering capabilities.

In this case, this has nothing to do with reverse engineering, it's basic system administration. See how the AI points you in the "right" direction: What likely happened: The exec(…

running apps in a sandbox is ok, but remember to disable internet access. A text editor should not require it, and can be used to exfiltrate the text(s) you're editing. When starte…

On macOS systems, this results in the execution of a background shell command that uses nohup bash -c in combination with curl -s to retrieve a JavaScript payload remotely Unrestri…

I'd not trust any app that parses /proc to obtain process information (for reasons [0]), specially if the machine has been compromised (unless by "incident", the author means anoth…

ss obtains the connections information via netlink directly from the kernel (besides parsing /proc): https://manpages.debian.org/bookworm/manpages/sock_diag.7.en... https://github.…

At the very least, these tools should not parse /proc to obtain information of processes or connections. It should be the last option. Many LD_PRELOAD rootkits hide their activity …

restricting outbound connections by binary: OpenSnitch . You can also restrict outbound connections to cryptomining pools and malicious IPs. For example by using IOCs from VirusTot…