Week of July 17, 2023

A security researcher published a proof-of-concept bypass for Promon SHIELD's Android application protection, specifically demonstrating APK signature authentication bypass. The repository analyzes the protector's obfuscation techniques and provides code to circumvent its integrity checks, building on prior 2018 research.

A researcher demonstrates a technique to evade EDR call stack analysis by using Windows callback functions to spoof the origin of sensitive API calls. The method makes malicious calls appear to originate from trusted modules like ntdll.dll, reducing detection rates in a proof-of-concept from 45/71 to 6/71 on VirusTotal.

A deserialization vulnerability in Apache ShardingSphere-Agent allows remote code execution by crafting a malicious YAML configuration file. The attacker needs permission to modify the agent's YAML config and the target must be able to access a URL hosting a malicious JAR. The vulnerability affects versions through 5.3.2 and is fixed in 5.4.0.

A proof-of-concept repository demonstrates two methods to bypass the Antimalware Scan Interface (AMSI) on Windows 11 by patching AmsiOpenSession and AmsiScanBuffer functions in memory. The AmsiScanBuffer patch successfully evades detection for Assembly.Load() calls, while the AmsiOpenSession patch does not. This highlights a persistent evasion technique against Microsoft's AMSI.