HaxRob

A friend asked me to find out why his connected lightbulb app was asking for his location, so I ducked out to Australia’s favourite hardware store, Bunnings, and grabbed one to check out.

The Android grid connect app has 500k+ downloads.

Let’s take a quick look! 🧵
(1/n)

#BPFDoor controller's source code (likely) originating from an owned host based in 🇰🇷. Found by pivoting on details in #rapid7's post, published today.

Find the reconstructed / deobfuscated source here:
github.com/haxrob/BPFDoor…

A relatively unknown but particularly stealthy technique to hide files on Linux hosts. On unhardened boxes, unprivileged users can conceal files from even the root user. Disk content remains in memory, hindering disk acquisition during forensic investigation. (1/7) 👇

Forget compliance by severity color, how about compliance by emoji happiness level?

#systemd, stay classy. 🙃

Newer variants of the #BPFDoor has an interesting modification made that avoids detections looking for processes with raw sockets. The kernel reports SOCK_DGRAM rather then rather loud "SOCK_RAW". Here we have a sample found in the recent SKT telco breach. (1/20)