Infosec chews for geeks 43/17

1. Bypassing Intel Boot Guard
2. Someone Created a Tor Hidden Service to Phish my Tor Hidden Service
3. Testing Security Keys
4. Investigating Security Incidents with Passive DNS
5. Macro-less Code Exec in MSWord / Abusing Microsoft Office DDE (incl reg entries to disable DDEAUTO)
   - reports of “in the wild” exploitation 15/10/2017 and new crypto worm 24/10/2017!
   - e.g. securingtomorrow.mcafee.com/mcafee-labs/apt28-threat-group-adopts-dde-technique-nyc-attack-theme-in-latest-campaign/ (7/11)
   - Microsoft advisory (incl KB3123630) 10/10/2017 for patches
   - 0patching the Office DDE / DDEAUTO Vulnerability… ehm… Feature
   — (note that, similar to the MS advisory “workarounds”, this might break functionality – e.g. Excel auto-updating of externally linked cells)
6. Peeking into .msg files
7. It’s in the signature
8. Attacking a co-hosted VM: A hacker, a hammer and two memory modules
9. Microsoft VulnScan – Automated Triage and Root Cause Analysis of Memory Corruption Issues
10. (Ok so Google is picking on all the competition but these are still interesting…)
    1. Using Binary Diffing to Discover Windows Kernel Memory Disclosure Bugs
    2. Over The Air – Vol. 2, Pt. 3: Exploiting The Wi-Fi Stack on Apple Devices

Enjoy and feel free to share your own with csirt AT sanren . ac za