Information Technology Security

By Davey Winder, Forbes PWN2OWN Vancouver 2022 has now come to an end with seven hackers picking up a total of $240,000 for successful Windows 11 zero-day exploits. The hacking competition saw Windows 11 successfully hacked six times in all, along with one attempt that failed to work within the allotted time. The six successful Windows 11 hacks were spread across all three days of the hacking competition, two on day one, one on day two, and three on the final day of the event. Marcin Wiazowski executed an out-of-bounds escalation of privilege exploit that earned a $40,000 reward. Phan Thanh Duy and Le Hu'u Quang Linh demonstrated another Windows 11 elevation of privilege attack but this with a use after-free-exploit, also winning a $40,000 cash prize. A hacker known as T0 used an improper access control bug, again resulting in elevation of privilege success and getting another $40,000 prize. Escalation of privilege hacks were the order of the day, well all three days to be precise,...

By Bill Toulas, Bleeping Computer A new malware framework known as NetDooka has been discovered being distributed through the PrivateLoader pay-per-install (PPI) malware distribution service, allowing threat actors full access to an infected device. This previously undocumented malware framework features a loader, a dropper, a protection driver, and a powerful RAT component that relies on a custom network communication protocol. The first samples of NetDooka were discovered by researchers at TrendMicro, who warn that while the tool is still in an early development phase, it is already very capable. The fact that it’s being distributed through the PrivateLoader malware distribution service reflects this potency, as its authors deemed the malware ready for large-scale deployment. PrivateLoader deployment The PrivateLoader PPI service was first spotted a year ago and analyzed by Intel471 in February 2022. In short, it’s a malware distribution platform that relies on SEO poisoning and lace...