Discover and read the best of Twitter Threads about #ShadowBrokers
Most recents (2)
Inspired by @osxreverser analysis of NSA BPF port-knocking implant, I decided to take a 2nd look at #ShadowBrokers leak of windows implants. Lo and behold, a couple of hardly mentioned kernel drivers (#DoormanGauze and #FlewAvenue) caught my attention. (1/11)
Information publicly available on these drivers is scarce and for the most part flat out wrong. Instead of going for the usual deep-dive blog post, lets try a light-speed tweeter thread analysis. In this thread we'll take a brief look at #DoormanGauze. (2/11)
So, what is #DoormanGauze... In a nutshell, its a plugin for #DanderSpritz / #ExpandingPulley implants implementing an in-kernel mailslot server, allowing for stealthy inter-process communication. This can replace the usual named pipes/windows sockets IPC. (3/11) 
NSA just lost control of its Top Secret arsenal of digital weapons; hackers leaked it.
1) github.com/x0rz/EQGRP
2) medium.com/@shadowbrokers…
1) github.com/x0rz/EQGRP
2) medium.com/@shadowbrokers…
For those who have never heard of the hacker group behind today's leak of NSA's cyberweapons, last year's story: nytimes.com/2016/08/17/us/…
Quick review of the #ShadowBrokers leak of Top Secret NSA tools reveals it's nowhere near the full library, but there's still so... (1/2)
