What are the factors behind this stark rise, and how can the skills gap be closed?
Great news!
An article about ropci is in the latest free issue of the Pentest Magazine!
The article has a lot more info then my ropci blog post or the info on the ropci Github repo.
Get your copy and check it out! It also has an article about Nuclei, one of my favorite tools.
Cheers.
Link: https://p...
Scammers are attempting to solicit PII, financial information or payment from potential victims
This post will highlight a pattern I have seen across multiple production Microsoft Azure Active Directory tenants which led to MFA bypasses using ROPC.
The key take-away: Always enforce MFA! Sounds easy, but there are often misconfigurations and unexpected exceptions. So, test your own AAD tenant f...
It will focus on protecting suppliers to critical information infrastructure operators
Noose tightens around notorious cybercrime group
There are some neat TTPs that I don’t use frequently, and if the time arises, I need to dig up details again. So, I figured to write some of them down, starting with SSH Agent Hijacking.
What is SSH Agent Hijacking? Short story, if you have keys added to an SSH Agent an adversary with root permissio...
UK security agency makes it easier to assess credibility of alerts
Researchers claim thousands of global customers were impacted
With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.
Rob Joyce was invited to speak during the Mandiant Worldwide Information Security Exchange (mWISE) event on October 18, 2022
Most of the funds were later returned following negotiations with the hacker
Andrew Haberlandt During my summer internship at Trail of Bits, I worked on the fork of the RBPF JIT compiler that is used to execute Solana smart contracts. The RBPF JIT compiler plays a critical role on the Solana blockchain, as it facilitates the execution of contracts on validator nodes by defa...
EY finds younger workers are prone to engage in risky behavior
For this year’s edition, ENISA introduced a new slogan for the event, #Choose2BeSafeOnline
Each month we publish numerous new articles and known issues to the WatchGuard Knowledge Base. Here is the new content published in August and September.
Articles
AuthPoint ADFS agent installation fails on secondary server
AuthPoint Gateway status is Not Installed or Not Connected after upgrade to...
New report provides in-depth look at novel NAS-based threat
Sonatype reveals scale of threats to open source ecosystem
Earlier this year, I successfully completed my internship at Trail of Bits and secured a full-time position as a Blockchain Security Analyst. This post is not intended to be a technical description of the work I did during my internship. Rather, it is intended to describe my general experience as a...
The flaw could allow an attacker to connect to clients and control the Zoom Apps running in it