changedetection.io’s Post

In early 2023, the Chrome browser began randomizing the order in which extensions are issued in the client Hello message. Other browser and client implementations are also adopting this same change. So at every connection, the order of the TLS extensions is changed. As a result, the computation of the extensions list in JA3 returns different results for every connection, and thus the JA3 fingerprint changes, rendering JA3 useless for identifying clients and user agents. Is there a more powerful TLS client fingerprinting technique? Learn more: https://hubs.la/Q02hMZJ50

Google released patches for a similar integer overflow flaw in the same component (CVE-2023-2136) in April 2023 that had also come under active exploitation as a zero-day, raising the possibility that CVE-2023-6345 could be a patch bypass for the former. CVE-2023-2136 is said to have allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. With the latest update, the tech giant has addressed a total of six zero-days in Chrome since the start of the year - CVE-2023-2033 (CVSS score: 8.8) - Type confusion in V8 CVE-2023-2136 (CVSS score: 9.6) - Integer overflow in Skia CVE-2023-3079 (CVSS score: 8.8) - Type confusion in V8 CVE-2023-4863 (CVSS score: 8.8) - Heap buffer overflow in WebP CVE-2023-5217 (CVSS score: 8.8) - Heap buffer overflow in vp8 encoding in libvpx

Trend Micro Search: ParaSiteSnatcher: How Malicious Chrome Extensions Target Brazil: We detail the modular framework of malicious Chrome extensions that consist of various highly obfuscated components that leverage Google Chrome API to monitor, intercept, and exfiltrate victim data. Check it out!

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2024-2887.

To Prevent malicious bot requests in our application, I have written this blog this includes the whole story

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2024-3159.

9 Ways to Bypass SSL Pinning in Android Found very useful https://lnkd.in/d-Tjgmqp

A valuable brief by SANS on how to detect anomalies in DNS queries which can be used to identify potential Command and Control (C2) activities. https://lnkd.in/eqdc7tcu #ThreatHunting #C2Detection

The TCP3 WAY handshake. . . . . . #datasecurity #networking #penetrationtesters #banking #business #informationsecurity #data #Ai #tech #technology #computer #software #cybersecurity #networksecurity #networking #companies #ethicalhacker #datasecurity https://lnkd.in/e2jm4nyu