Loading video...

Video Failed to Load

Go Home

Dismantling Smart App Control (And SmartScreen) - 4 new initial access techniques with no security warnings or popups - including LNK mark-of-the-web bypass with over 5 years of ITW use Article: POC: #rephijack #lnkstomping

dez_'s profile picture

Joe Desimone

5,662 subscribers

21,052 views • 2 years ago •via X (Twitter)

Science & Technology#rephijack#lnkstomping
LIVE

Anya Rossi• Live Now

Private livecam show

3 Comments

HotCakeX ✡︎ סגול's profile picture
HotCakeX ✡︎ סגול2 years ago

Few notes for readers 1) SAC is for home users, App control for Business is the enterprise ver 2) WDAC cannot be bypassed like this. 3) Using legit certificate to sign malware doesn't end up good for the person acquired the cert. 4) Windows has a lot more than 2 security layers

Squiblydoo's profile picture
Squiblydoo2 years ago

Thanks for calling out code signing certs. :) Would you mind uploading a compiled copy of rep-check? It just makes it a little more accessible.

Joe Desimone's profile picture
Joe Desimone2 years ago

done,

Related Videos

The new sims 4 update includes a bunch of new club activities including "use water vehicles" and I ended up with the most chaotic club gathering ever
0:14

The new sims 4 update includes a bunch of new club activities including "use water vehicles" and I ended up with the most chaotic club gathering ever

OnlyAbiDoang

267,911 views • 1 year ago

As of today, the new Lenovo Chromebook Plus 14 is available and comes with a whole suite of new AI features, including access to NotebookLM directly from the shelf. From web, to mobile, now to direct on desktops— where should we go next? 🗺️
0:17

As of today, the new Lenovo Chromebook Plus 14 is available and comes with a whole suite of new AI features, including access to NotebookLM directly from the shelf. From web, to mobile, now to direct on desktops— where should we go next? 🗺️

NotebookLM

49,758 views • 1 year ago

The all-new App Store on Apple Vision Pro has over 1 million apps, including new experiences that take advantage of the unique capabilities of Vision Pro. There will be plenty of apps to play with on launch - and not just games!
0:12

The all-new App Store on Apple Vision Pro has over 1 million apps, including new experiences that take advantage of the unique capabilities of Vision Pro. There will be plenty of apps to play with on launch - and not just games!

Brandon Butch

203,752 views • 2 years ago

New app is live! 🎉 Will attempt to grow this app to 5K downloads by the end of January :) Perfect timing to use it with my family & friends for Xmas and New Years Eve to record cute small Snappits 🎬
0:15

New app is live! 🎉 Will attempt to grow this app to 5K downloads by the end of January :) Perfect timing to use it with my family & friends for Xmas and New Years Eve to record cute small Snappits 🎬

Vivien Mahé

21,317 views • 7 months ago

A new chapter of VeVe begins. For years, VeVe has partnered with some of the world's most iconic brands and creators including Disney, Marvel, Star Wars, and DC. Now, we're bringing that universe to Telegram, starting this Saturday. Get first access:
0:15

A new chapter of VeVe begins. For years, VeVe has partnered with some of the world's most iconic brands and creators including Disney, Marvel, Star Wars, and DC. Now, we're bringing that universe to Telegram, starting this Saturday. Get first access:

VeVe Stickerverse

42,789 views • 2 months ago

In the initial days of my trading, I had no clue about order flow. 4 years later, order flow is a critical final part of my trading. I've built a list of the top 3 ways I use order flow in a systematic way. Today, I am sharing it with you 🧵
0:13

In the initial days of my trading, I had no clue about order flow. 4 years later, order flow is a critical final part of my trading. I've built a list of the top 3 ways I use order flow in a systematic way. Today, I am sharing it with you 🧵

Goshawk Trades

76,593 views • 2 years ago

🔥New Feature Alert!😱 Match someone with one click through Control Roulette!😍Enjoy a quick, easy, and safe real-time toy control session, and no more worries about finding a control link partner.💦 Available on the latest version of Lovense Remote App:
0:14

Sensitive content

🔥New Feature Alert!😱 Match someone with one click through Control Roulette!😍Enjoy a quick, easy, and safe real-time toy control session, and no more worries about finding a control link partner.💦 Available on the latest version of Lovense Remote App:

LovenseOfficial

25,513 views • 2 years ago

Every time I’m riding along Indian Creek Drive in Miami Beach, I’m impressed with the changes done to this area. West side of the road used to be dirt and grass with no pedestrian access. Over the past 1-2 years, new sidewalks were added with landscaping. Bike lane also got upgraded to ZICLA zipper dividers 👏🏼
0:15

Every time I’m riding along Indian Creek Drive in Miami Beach, I’m impressed with the changes done to this area. West side of the road used to be dirt and grass with no pedestrian access. Over the past 1-2 years, new sidewalks were added with landscaping. Bike lane also got upgraded to ZICLA zipper dividers 👏🏼

Joel Franco

49,733 views • 7 months ago

NEW: BNB Chain SAYS A FORMER EMPLOYEE CREATED A WALLET ADDRESS FOR A TOKEN AS PART OF A VIDEO TUTORIAL - "THAT INDIVIDUAL IS NO LONGER WITH THE COMPANY" THE SAME ADDRESS IS NOW BEING USED INDEPENDENTLY FOR A NEW MEME TOKEN "BNB CHAIN DID NOT CREATE, AUTHORISE, PROMOTE OR PARTICIPATE IN THE CREATION OF THIS TOKEN AND HAS NO CONTROL OVER THE TOKEN OR WALLET ADDRESS" THEY ARE TAKING LEGAL ACTION AGAINST THE FORMER EMPLOYEE AND COOPERATING WITH AUTHORITIES
0:16

NEW: BNB Chain SAYS A FORMER EMPLOYEE CREATED A WALLET ADDRESS FOR A TOKEN AS PART OF A VIDEO TUTORIAL - "THAT INDIVIDUAL IS NO LONGER WITH THE COMPANY" THE SAME ADDRESS IS NOW BEING USED INDEPENDENTLY FOR A NEW MEME TOKEN "BNB CHAIN DID NOT CREATE, AUTHORISE, PROMOTE OR PARTICIPATE IN THE CREATION OF THIS TOKEN AND HAS NO CONTROL OVER THE TOKEN OR WALLET ADDRESS" THEY ARE TAKING LEGAL ACTION AGAINST THE FORMER EMPLOYEE AND COOPERATING WITH AUTHORITIES

DEGEN NEWS

47,783 views • 6 days ago

Today we're shipping the governance layer enterprise AI was missing. Every organization running AI at scale faces the same choice: turn off AI connections to tools entirely, or let agents have full access to everything. Today we're launching a better path: precise control over connections, actions, and models across every surface. The goal is simple: IT gets visibility and control, teams keep building, no approval queue in between. 6 new capabilities in Zapier today: 1. Action restrictions at the endpoint level 2. Managed app connections with domain control 3. Bring your own model through AWS Bedrock 4. A queryable audit trail 5. Agents GA with MCP governed across every surface 6. Workspaces (GA later this quarter) One set of rules for your entire AI stack. Try it now. If you've had early access, let me know what you think.
0:16

Today we're shipping the governance layer enterprise AI was missing. Every organization running AI at scale faces the same choice: turn off AI connections to tools entirely, or let agents have full access to everything. Today we're launching a better path: precise control over connections, actions, and models across every surface. The goal is simple: IT gets visibility and control, teams keep building, no approval queue in between. 6 new capabilities in Zapier today: 1. Action restrictions at the endpoint level 2. Managed app connections with domain control 3. Bring your own model through AWS Bedrock 4. A queryable audit trail 5. Agents GA with MCP governed across every surface 6. Workspaces (GA later this quarter) One set of rules for your entire AI stack. Try it now. If you've had early access, let me know what you think.

Wade Foster

32,542 views • 3 months ago

We’ve spent 2 years growing one of the best communities on Base, and we’re making room for more. 🧑‍🌾 The next 4 weeks will be packed with new updates, events, and rewards to welcome the next generation of onchain farmers! Join us on Base app Today! 🔗
0:10

We’ve spent 2 years growing one of the best communities on Base, and we’re making room for more. 🧑‍🌾 The next 4 weeks will be packed with new updates, events, and rewards to welcome the next generation of onchain farmers! Join us on Base app Today! 🔗

pixotchi.base.eth

13,527 views • 4 months ago

The latest loophole that third-party file manager apps were using to get access to files and folders under /Android/data and /Android/obb has been patched. As part of Android 11's Scoped Storage restrictions, apps that use the Storage Access Framework (SAF) to launch the documents picker are not supposed to be able to get access to files and folders under the /Android/data or /Android/obb directories. However, third-party file managers figured out that if they set the initial directory when launching the documents picker to either /Android/data or /Android/obb, the documents picker lets the user grant the app full access to directories. This loophole was patched in Android 13, but then another loophole was discovered that got around this. Since Android 13 only blocked apps from setting /Android/data or /Android/obb as the initial directory when launching the documents picker, it was quickly discovered that you could set the initial directory to one of the subdirectories under /Android/data or /Android/obb, thus the user could grant access to individual subdirectories one-by-one. However, this latest loophole was patched with a recent Google Play System Update. The latest version of the DocumentsUI app, the Project Mainline module that comprises the documents picker, now restricts the initial location for the ACTION_OPEN_DOCUMENT/_TREE intent so that apps cannot request the initial location to be one of /Android/data, /Android/sandbox, /Android/obb, or one of their subdirectories. If the DocumentsUI app (AKA 'Files' app) on your device is on version 14-10492947 (version code 340916000), then this loophole is patched.
0:15

The latest loophole that third-party file manager apps were using to get access to files and folders under /Android/data and /Android/obb has been patched. As part of Android 11's Scoped Storage restrictions, apps that use the Storage Access Framework (SAF) to launch the documents picker are not supposed to be able to get access to files and folders under the /Android/data or /Android/obb directories. However, third-party file managers figured out that if they set the initial directory when launching the documents picker to either /Android/data or /Android/obb, the documents picker lets the user grant the app full access to directories. This loophole was patched in Android 13, but then another loophole was discovered that got around this. Since Android 13 only blocked apps from setting /Android/data or /Android/obb as the initial directory when launching the documents picker, it was quickly discovered that you could set the initial directory to one of the subdirectories under /Android/data or /Android/obb, thus the user could grant access to individual subdirectories one-by-one. However, this latest loophole was patched with a recent Google Play System Update. The latest version of the DocumentsUI app, the Project Mainline module that comprises the documents picker, now restricts the initial location for the ACTION_OPEN_DOCUMENT/_TREE intent so that apps cannot request the initial location to be one of /Android/data, /Android/sandbox, /Android/obb, or one of their subdirectories. If the DocumentsUI app (AKA 'Files' app) on your device is on version 14-10492947 (version code 340916000), then this loophole is patched.

Mishaal Rahman

17,039 views • 2 years ago

Canadian Prime Minister Mark Carney just confirmed that if the US was to invade Greenland, Canada would view it as an attack on Canada, would be obligated to assist in Greenland's defense, and could use military force against the United States. “The future of Greenland is a decision for Greenland and for the kingdom of Denmark. We are NATO partners with Denmark and so our full partnership stands. Our obligations on Article 5, an Article 2 of NATO stand and we stand fully squared behind those.”
0:18

Canadian Prime Minister Mark Carney just confirmed that if the US was to invade Greenland, Canada would view it as an attack on Canada, would be obligated to assist in Greenland's defense, and could use military force against the United States. “The future of Greenland is a decision for Greenland and for the kingdom of Denmark. We are NATO partners with Denmark and so our full partnership stands. Our obligations on Article 5, an Article 2 of NATO stand and we stand fully squared behind those.”

Ed Krassenstein

1,807,119 views • 6 months ago

Excellent announcement today by Mark Carney that Canada will achieve 2% of GDP NATO target this year. This will be additional $20B a year or so plus there is still the consideration of $60B spending for the Golden Dome by Donald Trump. NATO's Secretary is now calling for 5% of GDP military spending. This is a huge industry and economic stimulator especially if the money can stay in Canada and develop supply capabilities to others. This also means we have to print over $100B in new spending or so over the next 4 years.
0:11

Excellent announcement today by Mark Carney that Canada will achieve 2% of GDP NATO target this year. This will be additional $20B a year or so plus there is still the consideration of $60B spending for the Golden Dome by Donald Trump. NATO's Secretary is now calling for 5% of GDP military spending. This is a huge industry and economic stimulator especially if the money can stay in Canada and develop supply capabilities to others. This also means we have to print over $100B in new spending or so over the next 4 years.

Kirk Lubimov

71,690 views • 1 year ago

Experiment ⬇️ „Dubai is empty“ When I post a picture or video, I have already left, for my security When I post, I make sure I choose a moment and angle, with no faces visible or edit them out of the content, for their security For the same security reasons, the UAE doesn’t want us to film and post sensitive footage People like to make up stories and look for faults, here is an experiment: A teacher writes down: 1+1=2 2+2=4 3+3=6 4+4=8 5+5=9 Every student raises their hand and points out the last mistake, instead of pointing out that 4/5 calculations are correct At the end, we are all human and must protect each other, instead of making each other vulnerable
0:09

Experiment ⬇️ „Dubai is empty“ When I post a picture or video, I have already left, for my security When I post, I make sure I choose a moment and angle, with no faces visible or edit them out of the content, for their security For the same security reasons, the UAE doesn’t want us to film and post sensitive footage People like to make up stories and look for faults, here is an experiment: A teacher writes down: 1+1=2 2+2=4 3+3=6 4+4=8 5+5=9 Every student raises their hand and points out the last mistake, instead of pointing out that 4/5 calculations are correct At the end, we are all human and must protect each other, instead of making each other vulnerable

Tima

17,337 views • 4 months ago

☠️US-Israel aggression against Iran could leave a TOXIC legacy, warns Egyptian climate and environmental economics professor Alaa Sarhan, referring to missile and ammunition debris. The use of advanced weapons — including potentially chemical or biological munitions — can pollute air, water, and soil, with visible signs already emerging, including a large black cloud observed over parts of Iran, he adds.
0:15

☠️US-Israel aggression against Iran could leave a TOXIC legacy, warns Egyptian climate and environmental economics professor Alaa Sarhan, referring to missile and ammunition debris. The use of advanced weapons — including potentially chemical or biological munitions — can pollute air, water, and soil, with visible signs already emerging, including a large black cloud observed over parts of Iran, he adds.

Sputnik

14,099 views • 4 months ago

New updates for the Public Preview of the Google Home app for Wear OS by Google: 🏡 Access your devices with a simple list view ✅ Control devices that are linked to you and are not yet assigned to a home ⏱ Enjoy faster load times Learn more:
0:14

New updates for the Public Preview of the Google Home app for Wear OS by Google: 🏡 Access your devices with a simple list view ✅ Control devices that are linked to you and are not yet assigned to a home ⏱ Enjoy faster load times Learn more:

Made by Google

36,697 views • 3 years ago

How to scale your app past $20k/mo with AI UGC in literally 5 steps: 1. Connect Higgsfield MCP 2. create a character using nano banana pro 3. use the MCP + claude to produce seedance 2.0 videos using the start frame of your AI character 4. use postbridge to scheduele out videos to accounts 5. repeat across multiple accounts Congratulations you now own a team of 10 UGC creatorsFor 1/10th of the price and fully automated. I must have spoke to 5+ founders by now that have apps doing anywhere from $30k/mo to $100k/mo purely scaled with AI UGC I attached a case study of an account generating 14M+ views per month with an AI character in the fitness niche. This is the future of marketing. I give this 2 years before everyone finds out and competition sky rockets but right now, competition is virtually 0.01% if you are serious about winning, take 5 minutes to read this article:
0:12

How to scale your app past $20k/mo with AI UGC in literally 5 steps: 1. Connect Higgsfield MCP 2. create a character using nano banana pro 3. use the MCP + claude to produce seedance 2.0 videos using the start frame of your AI character 4. use postbridge to scheduele out videos to accounts 5. repeat across multiple accounts Congratulations you now own a team of 10 UGC creatorsFor 1/10th of the price and fully automated. I must have spoke to 5+ founders by now that have apps doing anywhere from $30k/mo to $100k/mo purely scaled with AI UGC I attached a case study of an account generating 14M+ views per month with an AI character in the fitness niche. This is the future of marketing. I give this 2 years before everyone finds out and competition sky rockets but right now, competition is virtually 0.01% if you are serious about winning, take 5 minutes to read this article:

Ernesto Lopez

41,007 views • 2 months ago

Native ADI Chain support is officially live in Ledger Wallet™. You can now securely send and receive ADI and ecosystem tokens like DDSC directly from your dashboard. Take your digital assets off exchanges and maintain absolute control over your wealth. The seamless experience of the Ledger Wallet™ app, paired with the offline security of your Ledger signer. True digital ownership. Free from compromise.
0:14

Native ADI Chain support is officially live in Ledger Wallet™. You can now securely send and receive ADI and ecosystem tokens like DDSC directly from your dashboard. Take your digital assets off exchanges and maintain absolute control over your wealth. The seamless experience of the Ledger Wallet™ app, paired with the offline security of your Ledger signer. True digital ownership. Free from compromise.

Ledger

12,994 views • 2 months ago