http://www.secuobs.com L'observatoire de la securite Internet fr webmaster@secuobs.com Microsoft to fix 23 flaws in October Patch Tuesday security update http://www.secuobs.com/revue/news/333207.shtml http://www.secuobs.com/news/comments4823032009-exploitable_windbg_dump_audit_msec.shtml#11126 http://www.secuobs.com/news/comments4823032009-exploitable_windbg_dump_audit_msec.shtml#11126 ESRT @Ivanlef0u @Rogunix - Interesting Unpack me if you can: Profiting from Desktop heap information http://www.secuobs.com/twitter/news/253572.shtml http://www.secuobs.com/news/comments4823032009-exploitable_windbg_dump_audit_msec.shtml#11082 http://www.secuobs.com/news/comments4823032009-exploitable_windbg_dump_audit_msec.shtml#11082 ESRT @dguido - Targeted Attacks and the Need to Keep Document Parsers Updated http://www.secuobs.com/twitter/news/253581.shtml http://www.secuobs.com/news/comments4823032009-exploitable_windbg_dump_audit_msec.shtml#11081 http://www.secuobs.com/news/comments4823032009-exploitable_windbg_dump_audit_msec.shtml#11081 ESRT @Ivanlef0u @mattifestation - Great post by Raymond Chen about VirtualAlloc's handling of large heap allocations http://www.secuobs.com/twitter/news/253571.shtml http://www.secuobs.com/news/comments4823032009-exploitable_windbg_dump_audit_msec.shtml#11073 http://www.secuobs.com/news/comments4823032009-exploitable_windbg_dump_audit_msec.shtml#11073 ESRT @EdiStrosar @snowfl0w - Sept 23 CVE-2011-1991 type 1 deskpan.dll Windows components DLL loading vulnerability http://www.secuobs.com/twitter/news/252873.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#11057 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#11057 ESRT @FlUxIuS @devilok - Kernel Attacks through User-Mode Callbacks in win32k http://www.secuobs.com/twitter/news/251456.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#11014 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#11014 ESRT @Ivanlef0u @cnbrkbolat - Breaking the shield: Bypassing ASLR DEP - Secfence Blog http://www.secuobs.com/twitter/news/251217.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10996 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10996 ESRT @opexxx - Privilege escalation on Windows using Binary Planting http://www.secuobs.com/twitter/news/251161.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10988 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10988 ESRT @jduck1337 @johnregehr - New version of SafeInt on Codeplex is overflow-free -- fast work http://www.secuobs.com/twitter/news/250793.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10983 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10983 FoD 3.0 - Fortify On Demand http://www.secuobs.com/revue/news/329984.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10936 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10936 processhacker 2.22 http://www.secuobs.com/revue/news/329635.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10919 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10919 Windows 8 new security features http://www.secuobs.com/revue/news/329130.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10880 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10880 ESRT @aionescu @kernelpool - All Nt*VirtualMemory functions now check for stack buffer overruns http://www.secuobs.com/twitter/news/247997.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10878 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10878 ESRT @MarcoFigueroa - Whoops Microsoft leaks patch info four days early How many 0days will be written this weekend http://www.secuobs.com/twitter/news/246752.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10832 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10832 cuckooHide - Hiding CuckooBox from trivial detection mechanism http://www.secuobs.com/revue/news/328116.shtml http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10830 http://www.secuobs.com/news/comments4723032009-exploitable_windbg_dump_audit_msec.shtml#10830 Post-Exploitation in Windows From Local Admin To Domain Admin efficiently http://www.secuobs.com/revue/news/328249.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10823 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10823 Userland Hooking on Windows http://www.secuobs.com/revue/news/328253.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10819 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10819 Microsoft has released their advanced notification for patch Tuesday 15 Vulnerabilities to be addressed http://www.secuobs.com/revue/news/327872.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10809 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10809 ESRT @MarioVilas @lennyzeltser - MS NTttcp tool similar to NetCat and a few enhancements by @Dr_Craig_Wright http://www.secuobs.com/twitter/news/244693.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10727 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10727 Viewing GPO on the Commandline http://www.secuobs.com/revue/news/326757.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10715 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10715 processhacker-2.21 http://www.secuobs.com/revue/news/326715.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10714 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10714 ESRT @revskills @Rogunix - Understanding SEH Exploiting a Buffer Overflow on EasyChat Server http://www.secuobs.com/twitter/news/243894.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10711 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10711 ESRT @CinnabarSweets - Windows Kernel Exploitation Basics - Part 1 http://www.secuobs.com/twitter/news/243410.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10696 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10696 ESRT @xanda - Microsoft Security Advisory 260771: Fraudulent Digital Certificates Could Allow Spoofing http://www.secuobs.com/twitter/news/243018.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10686 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10686 New Windows Worm Squirming Through RDP http://www.secuobs.com/revue/news/325670.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10668 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10668 MeMMon - A Light Weight Process Memory Scanner http://www.secuobs.com/revue/news/325500.shtml http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10667 http://www.secuobs.com/news/comments4623032009-exploitable_windbg_dump_audit_msec.shtml#10667 Microsoft quietly finding, reporting security holes in Apple, Google products http://www.secuobs.com/revue/news/325483.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10665 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10665 processhacker 2.20 http://www.secuobs.com/revue/news/325368.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10643 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10643 Critically-rated Microsoft patch can be reverse-engineered to create DoS attack http://www.secuobs.com/revue/news/325284.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10627 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10627 Microsoft Releases New Versions of Software Security Tools http://www.secuobs.com/revue/news/325249.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10624 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10624 ESRT @gcouprie @goldshtn - Walking the stack without symbols and with FPO. It's a PITA, but windbg rules http://www.secuobs.com/twitter/news/240441.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10599 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10599 ESRT @Ivanlef0u @securityshell - Privilege Escalation – Windows 7 – XP Style http://www.secuobs.com/twitter/news/240476.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10596 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10596 papers - Microsoft Patch Analysis http://www.secuobs.com/revue/news/324040.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10574 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10574 ESRT @carne @ToolsWatch - @carne Black Hat USA 2011: ToolsTube with Chris Schmidt on OWASP ESAPI API http://www.secuobs.com/twitter/news/239533.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10570 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10570 Sysinternal updates for ProcDump v4.0, Process Monitor v2.96, Process Explorer v15.02 http://www.secuobs.com/revue/news/323639.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10548 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10548 ESRT @emiliengirault @__fastcall - Excellent Windows Kernel exploitation tutorial series by @Xst3nZ http://www.secuobs.com/twitter/news/238833.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10540 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10540 exploitdb - remote - MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow - CVE: 2010-0480 http://www.secuobs.com/twitter/news/238150.shtml http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10491 http://www.secuobs.com/news/comments4523032009-exploitable_windbg_dump_audit_msec.shtml#10491 ESRT @dinodaizovi @kernelpool - Windows Hooks of Death: Kernel Attacks through User-Mode Callbacks - slides and paper http://www.secuobs.com/twitter/news/237464.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10481 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10481 New Microsoft Security Program Vulnerability Data Now Available http://www.secuobs.com/revue/news/322465.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10478 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10478 ESRT @mosesrenegade @Fyyre - Disable PatchGuard Driver Signing fix compatible with ntoskrnl released today http://www.secuobs.com/twitter/news/237062.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10467 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10467 ESRT @stalkr_ @Heurs - Nice blog about Windows kernel vulnerabilities exploitations http://www.secuobs.com/twitter/news/237117.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10465 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10465 ESRT @mosesrenegade @jnabryant - Good article on MS11-058, the DNS bulletin we released today http://www.secuobs.com/twitter/news/237061.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10463 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10463 Microsoft August 2011 Black Tuesday Overview, Tue, Aug 9th http://www.secuobs.com/revue/news/322086.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10435 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10435 ESRT @s7ephen @djrbliss - Remote kernel exploitation talk from Defcon, code and slides http://www.secuobs.com/twitter/news/236370.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10426 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10426 ESRT @sambowne @n00bznet - MS Security Essentials flagged my Defcon CD They are fast with updates http://www.secuobs.com/twitter/news/236364.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10425 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10425 ESRT @alexandrosilva @MenteBinaria - pev 0.40 is out Changes include PE32+ support, ASLR, DEP NX TLS callback detection http://www.secuobs.com/twitter/news/236008.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10419 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10419 Malware turns off Windows' UAC, warns Microsoft http://www.secuobs.com/revue/news/321485.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10407 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10407 Patch Tuesday heads-up Critical IE update among 13 bulletins http://www.secuobs.com/revue/news/321175.shtml http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10391 http://www.secuobs.com/news/comments4423032009-exploitable_windbg_dump_audit_msec.shtml#10391 Exploring Artifacts in Heap Memory with Heap Inspector http://www.secuobs.com/revue/news/321144.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10390 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10390 Microsoft slates 22 patches for Windows, IE next week http://www.secuobs.com/revue/news/321181.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10389 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10389 ESRT @ryanaraine - microsoft's big blackhat security announcement - BlueHat Prize -- interesting http://www.secuobs.com/twitter/news/234494.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10372 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10372 0-day Windows XP SP3 Denial of Service CSRSS Crash 1 http://www.secuobs.com/revue/news/320911.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10357 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10357 ESRT @EdiStrosar @Ivanlef0u - CVE-2011-1281 Privilege escalation in CSRSS proof of concept - by @Myst3rie http://www.secuobs.com/twitter/news/233613.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10334 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10334 processhacker2 processhacker-2.19-setup.exe http://www.secuobs.com/revue/news/319464.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10284 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10284 MindshaRE Hooking ReadFile and MapViewOfFile for Vulnerability Analysis http://www.secuobs.com/revue/news/319380.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10281 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10281 Windows 8 - The death of malware http://www.secuobs.com/revue/news/318244.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10228 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10228 ESRT @hdmoore @markrussinovich - New Sysinternals updates posted, including Process Explorer v15 with GPU support http://www.secuobs.com/twitter/news/229338.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10215 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10215 ESRT @DinisCruz @robertauger -Pleased to announce new WASC Project Static Analysis Tool Criteria http://www.secuobs.com/twitter/news/229448.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10213 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10213 ESRT @BreakingPoint @InformationWeek - More Windows Kernel Vulnerabilities May Emerge http://www.secuobs.com/twitter/news/229302.shtml http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10211 http://www.secuobs.com/news/comments4323032009-exploitable_windbg_dump_audit_msec.shtml#10211 dos - GDI+ CreateDashedPath Integer overflow in gdiplus.dll http://www.secuobs.com/revue/news/317632.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10186 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10186 ESRT @DumpAnalysis - Updated Raw Stack Analysis Scripts page http://www.secuobs.com/twitter/news/227781.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10165 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10165 PeBrowser stuff - some free Windows RCE tools http://www.secuobs.com/revue/news/317012.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10161 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10161 Mitigating software vulnerabilities http://www.secuobs.com/revue/news/316961.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10155 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10155 ESRT @MarioVilas @michael_howard - New APIs to help developers control DLL loading http://www.secuobs.com/twitter/news/227039.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10133 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10133 ESRT @searchio @reversemode @j00ru - MS11-056 released A story of a Windows CSRSS Privilege Escalation vulnerability http://www.secuobs.com/twitter/news/227049.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10132 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10132 Microsoft July 2011 Black Tuesday Overview, Tue, Jul 12th http://www.secuobs.com/revue/news/316567.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10130 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10130 ESRT @ChrisJohnRiley @msftsecresponse - Curious about DEP, ASLR, exploit mitigations, ... We have a whitepaper for you http://www.secuobs.com/twitter/news/226902.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10129 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10129 ESRT @xanda - Backdooring Win7 and LotusNotes 8.5x using Uniscribe dll path spoofing http://www.secuobs.com/twitter/news/226387.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10110 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10110 ESRT @sambowne @pentestit - Crisis Aversion Tool: Fix Common Windows comman Problems in single click http://www.secuobs.com/twitter/news/226214.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10106 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10106 processhacker2 processhacker-2.18-bin.zip http://www.secuobs.com/revue/news/316234.shtml http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10100 http://www.secuobs.com/news/comments4223032009-exploitable_windbg_dump_audit_msec.shtml#10100 ESRT @MarioVilas - DLL hijacking, reloaded http://www.secuobs.com/twitter/news/225669.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10089 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10089 Microsoft beefs up Outlook-to-Hotmail security http://www.secuobs.com/revue/news/315884.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10079 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10079 ESRT @CiscoSecurity - Beyond the MBR, infecting the NTFS IPL http://www.secuobs.com/twitter/news/225357.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10073 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10073 ESRT @Ivanlef0u - Finding Kernel32 Base Address Shellcode http://www.secuobs.com/twitter/news/225536.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10072 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10072 ESRT @EdiStrosar - Locating some DLL base addresses on Win7 http://www.secuobs.com/twitter/news/225533.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10071 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10071 MS Patch Tuesday head-up 22 vulnerabilities in Windows, Office http://www.secuobs.com/revue/news/315709.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10069 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10069 ESRT @dave_rel1k @PhysicalDrive0 - The Sayonara ASLR DEP bypass code http://www.secuobs.com/twitter/news/225072.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10066 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10066 ESRT @packet_storm - Defeating Data Execution Prevention And ASLR In Windows XP SP3 http://www.secuobs.com/twitter/news/224621.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10052 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10052 ESRT @humanhacker @exploitdb - local - MS Office 2010 RTF Header Stack Overflow Vulnerability Exploit - CVE: 2010-3333 http://www.secuobs.com/twitter/news/224056.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10038 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10038 PE Import Table and custom DLL paths http://www.secuobs.com/revue/news/314974.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10012 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#10012 ESRT @etlow - RT @swik_ - Syringe - Dll/Shellcode Injection Tool http://www.secuobs.com/twitter/news/223017.shtml http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#9997 http://www.secuobs.com/news/comments4123032009-exploitable_windbg_dump_audit_msec.shtml#9997 ESRT @MarcoFigueroa - Another great paper on Writing JIT Shellcode by Alexey Sintsov http://www.secuobs.com/twitter/news/222361.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9993 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9993 Unobfuscate Visual Basic Script malware dropper http://www.secuobs.com/revue/news/314163.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9981 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9981 ESRT @pentestit - ksymhunter: Routines For Hunting Down Kernel Symbols http://www.secuobs.com/twitter/news/221001.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9971 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9971 ESRT @y0ug @Ivanlef0u - MS11-039 NET JIT logic flaw was previously disclosed on stackoverflow http://www.secuobs.com/twitter/news/218050.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9932 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9932 Microsoft June 2011 Black Tuesday Overview, Tue, Jun 14th http://www.secuobs.com/revue/news/311217.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9915 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9915 ESRT @mosesrenegade @dm557 - He also point some LPC 0day information if you able to read Chinese http://www.secuobs.com/twitter/news/216725.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9908 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9908 How to crash EXPLORER.EXE on all Windows versions 0-day DoS http://www.secuobs.com/revue/news/310711.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9894 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9894 processhacker2 plugins WindowExplorer-1.2.zip http://www.secuobs.com/revue/news/310414.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9889 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9889 Patch Tuesday heads-up Critical holes in Windows, IE, MS Office http://www.secuobs.com/revue/news/310259.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9875 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9875 ESRT @t0ka7a - Nice article about kernel privilege exploitation and SMEP - by @j00ru @gynvael http://www.secuobs.com/twitter/news/214267.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9833 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9833 ESRT @Ivanlef0u @daveaitel - 64 bit kernel rootkits FTW - DD Post http://www.secuobs.com/twitter/news/213181.shtml http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9795 http://www.secuobs.com/news/comments4023032009-exploitable_windbg_dump_audit_msec.shtml#9795 ESRT @aszy - nt!NtMapUserPhysicalPages and Kernel Stack-Spraying Techniques http://www.secuobs.com/twitter/news/211898.shtml http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9766 http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9766 processhacker-2.16-bin.zip http://www.secuobs.com/revue/news/307934.shtml http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9748 http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9748 Hotmail Exploit Has Been Silently Stealing E-mail http://www.secuobs.com/revue/news/306754.shtml http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9712 http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9712 Reversing Sandboxie http://www.secuobs.com/revue/news/306556.shtml http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9688 http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9688 UPDATE ESAPI 2.0GA http://www.secuobs.com/revue/news/304038.shtml http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9605 http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9605 MS11-036 - Important Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution 2545814 http://www.secuobs.com/revue/news/303840.shtml http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9602 http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9602 MS11-035 - Critical Vulnerability in WINS Could Allow Remote Code Execution 2524426 http://www.secuobs.com/revue/news/303841.shtml http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9601 http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9601 Unpatched DLL bugs let hackers exploit Windows 7 and IE9, says researcher http://www.secuobs.com/revue/news/303749.shtml http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9592 http://www.secuobs.com/news/comments3923032009-exploitable_windbg_dump_audit_msec.shtml#9592