Alice Climent

2.1K posts

Alice Climent banner
Alice Climent

Alice Climent

@AliceCliment

Malware and EDR stuff @harfanglab 🤓 || PTC || Sister of @h313n_0f_t0r & @lauriewired

xchg eax, eax Katılım Kasım 2018
282 Takip Edilen3.4K Takipçiler
Sabitlenmiş Tweet
Alice Climent
Alice Climent@AliceCliment·
Curious about what's happening in the Windows Kernel after a Syscall? I just wrote this post following the worfkflow from the Syscall instruction to the target kernel routine ⬇️ alice.climent-pommeret.red/posts/a-syscal… Thanks again to @Set_hyx for the proofreading!
English
4
248
570
0
Alice Climent retweetledi
Karsten Hahn
Karsten Hahn@struppigel·
I have created a website, where you can share your sample analysis (via links or posts) and search samples for training based on tags and difficulty. If you write analysis blogs, you can share them there. samplepedia.cc
Karsten Hahn tweet mediaKarsten Hahn tweet media
English
14
122
404
29.9K
Alice Climent retweetledi
vx-underground
vx-underground@vxunderground·
You don't have to write super sophisticated malware with 9000 different evasion techniques Just name it important_file.pdf.exe and have it prompt for UAC. They'll probably allow it
English
29
41
828
36.5K
matteyeux
matteyeux@matteyeux·
Looks like someone got a 0day burned ?
matteyeux tweet media
ZeroZenX@zerozenxlabs

🚨 $1,000,000 Bounty for iOS Zero-Day! 🚨 ZeroZenX is offering a $1M reward for a working zero-day exploit that bypasses USB Restricted Mode on the latest version of iOS. If you’re a top-tier security researcher and have a reliable exploit, we want to hear from you! 💰 Reward: $1,000,000 🔎 Target: iOS USB Restricted Mode Bypass 📩 Submit here: vrp.zerozenx.com We value responsible disclosure and work with researchers to ensure security vulnerabilities are handled ethically. If you have what it takes, submit your findings today! #zerozenx #CyberSecurity #cybersecuritynews #vulnerability #ios

English
2
24
244
37.5K
Artem I. Baranov
Artem I. Baranov@artem_i_baranov·
@AliceCliment We need a better vulnerability severity scoring system, right?.. It's typical that in most cases each side calculates the score differently
English
1
0
1
116
Alice Climent
Alice Climent@AliceCliment·
I just realized something. The advisory says: "This issue does not add additional capabilities to an attacker with administrative privileges to damage the attacked system." Well, that's not true. The PoC allows an attacker to remove EDR/AV files (exe, dll, drivers) and
Alice Climent@AliceCliment

The vulnerability I've found last year in @kaspersky AV is nows patched 🥳 #220125" target="_blank" rel="nofollow noopener">support.kaspersky.com/vulnerability/…

English
2
0
14
1.9K
BrHackeuses
BrHackeuses@BrHackeuses·
Kudos to @AliceCliment for her great work ! 🎉 She found a vulnerability in @kaspersky AV, now patched. 🔎✨ Proud to celebrate our @BrHackeuses members making the world safer! 💜 🔗 Read more: #220125" target="_blank" rel="nofollow noopener">support.kaspersky.com/vulnerability/… #CyberSecurity #BrHackeuses #BugHunting
Alice Climent@AliceCliment

The vulnerability I've found last year in @kaspersky AV is nows patched 🥳 #220125" target="_blank" rel="nofollow noopener">support.kaspersky.com/vulnerability/…

English
1
0
5
186
Alice Climent
Alice Climent@AliceCliment·
@artem_i_baranov 4.4 according to them. They choose None for availability. For me it's High 🤷‍♀️ #CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N" target="_blank" rel="nofollow noopener">first.org/cvss/calculato…
Alice Climent tweet media
English
1
0
0
129
Alice Climent
Alice Climent@AliceCliment·
@artem_i_baranov yes and no. Usually vuln that need admin priv are not eligible for the bounty (which was ok with me because I wasn't asking/seeking any bounty. However after they analyze my report and PoC they decided to give me 1000€. Which was pretty cool of them !
English
1
0
0
96
Alice Climent
Alice Climent@AliceCliment·
a registry key, they are able to remove any AV/EDR on a Windows machine. BYOVD Style ( but without interacting directly with the driver though 😅). If I found the time I'll write a blog post about this vuln
English
0
0
3
513
Alice Climent
Alice Climent@AliceCliment·
without any tools. The PoC is using the driver indirectly (via specificaly crafted data in registry keys) to remove ANY files or registry keys after a reboot. So yes, it adds new capabilities for the attackers to damage the system. Because with just the driver load and data in
English
1
1
2
575

Keşfet

@Myrtus0x0 @insidestory_gr @haaretzcom @amnesty @vxunderground @gzobraJn @matteyeux @artem_i_baranov