Whitepaper
CQTools: The New Ultimate Hacking Toolkit
+
Видео с BlackHat Asia 2019
CQTools: The New Ultimate Hacking Toolkit
https://www.youtube.com/watch?v=MZ0nSO0WOJg
+
Сами тулы
https://xn--r1a.website/tech_b0lt_Genona/472

> Today we’re unveiling the newest architecture for the Windows Subsystem for Linux: WSL 2! Changes in this new architecture will allow for: dramatic file system performance increases, and full system call compatibility, meaning you can run more Linux apps in WSL 2 such as Docker.

Announcing WSL 2
https://devblogs.microsoft.com/commandline/announcing-wsl-2/

Релизнули
https://developers.redhat.com/products/rhel/download/

In the 1960s-1970s, Ken Thompson co-invented the UNIX operating system along with Dennis Ritchie at Bell Labs. He also worked on the language B, the operating system Plan 9, and the language Go. He and Ritchie won the Turing Award. He now works at Google.

VCF East 2019 -- Brian Kernighan interviews Ken Thompson
https://www.youtube.com/watch?v=EY6q5dv_B-o

90% «умных» телевизоров можно взломать вредоносной ТВ-передачей и шпионить за телезрителями
https://habr.com/ru/post/402733/

​​Обожаю питоновский requests и BeautifulSoup.

К чему я это…. с 29.04 по 02.05 проходил DockerCon 2019 в Сан-Франциско, после которого они выложили все сессии на своей странице здесь - https://www.docker.com/dockercon/2019-videos/. Впереди много выходных и надо не забыть посмотреть что-нибудь интересное, но проблема в том, что на ютубе этих сессий нет, представление на странице не самое удобное, так еще и в своём собственном плеере. И вот тут приходит бьютифулсоуп. It’s time ту распарсить и получить прямые ссылки на видео. 😉 10 строчек и готово - https://1drv.ms/w/s!Al94Zc0K-izog6s3Bvhh6ZnUDCTjyg

 import requests
from bs4 import BeautifulSoup
url = 'https://www.docker.com/dockercon/2019-videos/'
page = requests.get(url)
soup = BeautifulSoup(page.text, 'html.parser')

for item in soup.find_all('div', class_="video"):
    title = item.find('p').text.strip()
    description = item.find('div', class_='description hidden').text.strip()
    link = item.find('img')
    print(title + ' - ' + link['src'].replace('.jpg', ''))

Одна строчка в bash

$ curl -s "https://www.docker.com/dockercon/2019-videos/" | grep -i -A3  "2019-videos?"  | grep -v "\-\-" | grep -v "img id" | sed 's/<a href="/https:\/\/www.docker.com/g' | sed 's/">//g' | sed 's/<p>//g' | sed 's/<\/p>//g' | sed 'n;G;'

Бест практисы

The WSL community has given amazing feedback on how we can improve through platforms like Twitter, Github, and UserVoice. Our team has taken that feedback to heart. In this session, they’ll be showing off how the new WSL architecture will improve your development environment with: faster file performance speed, Linux file access from Windows, better support for Linux applications, and more.

The new Windows subsystem for Linux architecture: a deep dive - BRK3068
https://www.youtube.com/watch?v=lwhMThePdIo

Ongoing Credit Card Data Leak
https://blog.netlab.360.com/ongoing-credit-card-data-leak/

Alpine Linux Docker Image root User Hard-Coded Credential Vulnerability
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0782

Мякотка

After discussions with Alpine Linux, it was discovered that this issue was also reported in their Github prior to our report, but was not flagged as a security issue and thus remained unresolved until it was rediscovered and reported by Cisco.

Build Container Images In Kubernetes
https://github.com/GoogleContainerTools/kaniko

В Samsung произошла утечка исходного кода, ключей к закрытым проектам и паролей к аккаунтам разработчиков
https://habr.com/ru/news/t/451128/

А вот и техническое описание произошедшего

Technical Details on the Recent Firefox Add-on Outage
https://hacks.mozilla.org/2019/05/technical-details-on-the-recent-firefox-add-on-outage/

Технические детали недавнего сбоя расширений Firefox
https://habr.com/ru/post/451220/

Выложили скрижали

Previously unseen Sega Mega Drive, MegaCD and Saturn developer documentation, technical bulletins and specifications.
https://archive.org/details/SegaManuals

> My company stands to lose several million pounds as a result of this.

> Oh, and all of the backups were encrypted too, using the same key :(

Oracle Wallet Master Key Lost :(
https://www.reddit.com/r/sysadmin/comments/bn38pp/oracle_wallet_master_key_lost/

TURLA LIGHTNEURON. One email away from remote code execution.

ESET выложили очень подробный отчет с описанием того как работает бэкдор LightNeuron ориентированный на Microsoft Exchange. Куча технических деталей и подходов.

Категорически рекомендую.