SMBaloo 🔗 A CVE-2020-0796 (aka “SMBGhost”) exploit for Windows ARM64. Because vulnerabilities and exploits don’t need to always have scary names and logos. GitHub Repository: https://www.github.com/msuiche/smbaloo Original post on Comae’s blog: https://www.comae.com/posts/2020-06-25_smbaloo-building-a-rce-exploit-for-windows-arm64-smbghost-edition/ Author: Matt Suiche (@msuiche) Acknowledgments 🔗 @hugeh0ge for his great blogpost and @chompie1337 for her excellent POC! On top of answering my questions on Twitter, their materials were really good and helped me immensely to understand the vulnerability and the exploitation part. Really HUGE kudos to both of them! ZecOps & Michael Maltsev (@m417z) for their write-ups. Special thanks to Stephen Ridley (@s7ephen) for being the ultimate ARM64 enabler and a great Aniki. Barnaby (RIP), I also gave a refresh to your APC injection technique. I hope you like it, we miss you.. Alex says hi. Thanks to Satoshi Tanda (@standa_t) and Petr Beneš (@PetrBenes) for helping me troubleshooting my original debugging set-up :) A big thanks to Sean Dillon (@zerosum0x0) for his prior work on SMB exploitation and our brainstorming sessions :) Laurent Gaffie (@PythonResponder) for his prior work on SMB. The NSA for developing (or buying) (and leaking? Cheers to TheShadowBrokers) ETERNALBLUE and DOUBLEPULSAR, that exploit is soon gonna be 10 years old… it almost feels like nothing new got released since then. Microsoft Platform Security Assurance & Vulnerability Research for finding CVE-2020-0796. Nicolas Economou (@NicoEconomou) and Alex Ionescu (@aionescu) for their publications on HAL stuff. Nikita Karetnikov (@karetnikovn) for the ARM ninjutsu. Souhail Hammou (@Dark_Puzzle) for making fun of APC ETW. And the OPCDE community for the continuous support! Join us on Discord or go on our website if the link is dead :) Introduction 🔗Do not use this for anything else other than educational purposes, this was only tested on the only ARM64 machine (Windows 10 18362 ARM 64-bit (AArch64)) that I had a direct access to. I have been happy enough that it was running consistently against it. Make sure that KB4551762 is not installed if you do some tests. I’m gonna try to make this write-up as readable as possible even if you have limited experience with exploit development, if you have any questions - do not hesitate just to come on Discord to ask them on the OPCDE Discord server.

Key Takeaways 🔗 Twitter is doing better than other platforms by releasing datasets, albeit partial, on Information Operations (IO). There is so much more information yet to be disclosed. Recommendations are given. Attribution blindspots seem to be a common problem with social media companies. Aggregated Twitter data and Python scripts are available on Github - and will be kept up-to-date. Beautiful dynamic data visualization for Twitter’s IO datasets, generated in real time from our GitHub datasets. A similar study for other platforms such as YouTube would be interesting. Maybe Google’s Threat Analysis Group could start publishing comprehensive datasets? :) In our last OSINT analysis of Facebook’s Coordinated Inauthentic Behavior we highlighted the pitfalls of Facebook’s data-sharing policies and the lack of transparency when it comes to processes and awareness of influence campaigns on the platform. Although, previous work has been done on some of the Twitter datasets - in this analysis, we extend our work to examine Twitter’s Information Operations (IO) and the measures they are taking (or neglecting) to combat the rampant growth of disinformation, misinformation, and influence campaigns. All the data used in this analysis was downloaded from Twitter’s archives of suspended accounts. The data from Twitter can be accessed on their transparency report, whereas our aggregated data for this analysis is available through GitHub, including the script used to generate the datasets – feel free to send us pull requests.

Key Takeaways 🔗 A lot of the information shared by social media companies is still incomplete or missing. Further transparency on processes and data is required to increase visibility and awareness of campaigns. Elections have been a key focus of CIB campaigns. CIBs are also currently used in conflict-affected & politically vulnerable countries (e.g. Northern & Eastern Africa), although under-reported by media outlets. The data collected on Facebook’s CIBs is available on GitHub. A similar study for Twitter is on its way. Introduction 🔗In this era of the internet and social media, the ability to control information and to spread disinformation has become easier and more consequential. With #WWIII a trending hashtag in early 2020, this connection between social media and the battle for global hegemony by steering the public debate and manipulating narratives or even to “to steal and spread damaging information and target vulnerable election systems ahead of the 2020 election” seems to be only getting stronger.