illmob

It’s that time of year for Derbycon \0/ most of the illmob crew will be down there partying all weekend. See you there!

In April 2013, a piece of malware was found embedded in Freedom Hosting’s darknet server that would exploit a security hole in a particular web browser and execute code on the user’s computer. This code gathered some information about the user and sent it to a server in Virginia and then crashed – it had no obvious malicious intent that is so characteristic of malware. It was therefore theorised that the FBI, who have offices in Virginia, and who have ‘form’ for writing malware, may have authored it – this now appears to be true.
http://oweng.myweb.port.ac.uk/fbi-tor-malware-analysis/

Using a technique he outlined over 10 years ago, starbug from CCC has broken the biometric lock on the new iPhone.
Source: ccc.de

Neat little trick to get internal IP address using HTML5 WebRTC from 2x.io blog. Which also can be used for nasty javascript to do internal attacks, on your router for instance. Check out the :::DEMO:::.

carnal 0wnage blog has an “evil pass filter” .dll example that logs passwords to a textfile or http post every time someone changes their password on a windows box. Works on Windows 2000, XP all the way up to Windows 8 & 2012.