When you are hunting, finding out where your target frequents and laying in wait is an often-used tactic. If your information is good, you are going to have a successful hunt. The same is true in cybersecurity, both from an attacker and researcher perspective. These attacks are called watering hole attacks. You are looking for your intended target to come and “take a drink” so you can spring your trap.

A newly released CVE (common vulnerabilities and exposures) CVE-2021-4034 for Linux has identified a vulnerability in PolKit’s (formerly PolicyKit) pkexe that exists in very major release of Linux. The vulnerability known as PwnKit can be exploited to gain full root on a target system. The flaw, according to researchers has also been present for more than 12 years.

The NFT or Non-Fungible Token is becoming a rather big deal in circles where blockchain and cryptocurrency are popular. The NFT, as designed, is supposed to represent ownership, or the chain of ownership back to the original creator. However, as nothing really changes hands it is not much more than a list in a distributed database. NFT themselves are neither a good thing nor bad thing. They just are, but they can be and have been used as parts of scams. They have also turned out to be not exactly what the buyer thought when they dumped a ton of cash on buying or creating one.

Malware delivery and distribution techniques always changing. As blue teams develop an understanding of one type of attack, the attackers shift to something different. Security researchers and security teams follow (or should follow) these methods so they can shift defensive tactics and software to meet the new challenge. This brings us to our topic for today. Researchers over at Proofpoint have identified an unusual packer called DTPacker, a .NET packer that not only obfuscates the payload that it is delivering but can act as both a runtime packer (a self-executing archive) as well as a downloader. This is unusual all on its own, but there are other factors that have been observed in this packer that make it the odd person out.