When the knowledge of a language model is insufficient to answer questions, integrating additional data sources comprehensively can be beneficial. Retrieval Augmented Generation (RAG) serves this purpose by connecting to data sources outside the trained language model. Microsoft 365 Copilot already works with RAG and is now expanding with GraphRAG to unlock even more extensive knowledge.

By Joe Doyle If you’ve encountered cryptography software, you’ve probably heard the advice to never use a nonce twice—in fact, that’s where the word nonce (number used once) comes from. Depending on the cryptography involved, a reused nonce can reveal encrypted messages, or even leak your secret key! But common knowledge may not cover every […]  ( 13 min )

NVIDIA's quasi-monopoly in the AI GPU market is achieved through its CUDA platform's early development and widespread adoption. It serves as a moat by becoming the industry standard due to its superior performance and integration with key AI tools. While NVIDIA's dominance is bolstered by its proprietary advantages and developer lock-in, emerging competitors like AMD and innovations such as AMD's ROCm, OpenAI's Triton, and PyTorch 2.0 are beginning to challenge this stronghold by offering open-source alternatives and reducing reliance on CUDA.

As you may know, I recently presented my Exchange-related talk during OffensiveCon 2024. This series of 4 blog posts is meant to supplement the talk and provide additional technical details. You can read the first post in this series here. In part 2, I describe the ApprovedApplicationCollection gadget, which was available for abuse because it did not appear on the deny list and could therefore be accessed via MultiValuedProperty. I am also presenting a path traversal in the Windows utility extrac32.exe, which allowed me to complete the chain for a full RCE in Exchange. For the moment, at least, Microsoft has made a decision not to fix this path traversal bug. You can watch the full talk here: “Half Measures and Full Compromise: Exploiting Microsoft Exchange PowerShell Remoting”. This blog …

Hands-on security testers need the best tools for the job. Tools you have faith in, and enjoy using all day long. Burp Suite has long been that tool, and now, it's faster than ever. We’ve listened to  ( 5 min )

In today’s world, organizations are increasingly depending on their third-party vendors, suppliers, and partners to support their operations. This way of working, in addition to the digitalization era we’re in, can have great advantages such as being able to offer new services quickly while relying on other’s expertise or cutting costs on already existing processes. … Continue reading Introduction to Third-Party Risk Management →  ( 12 min )

TL;DR The ability to edit  Group Policy Object (GPOs) from non-domain joined computers using the native Group Policy editor has been on my list for a long time.  This blog […] Living off the land, GPO style first appeared on Pen Test Partners.  ( 12 min )

This is a silly example of a basic mistake leading to a funny discovery… When I was experimenting with the imported phantom DLLs I accidentally placed a dummy 64-bit DLL in a place of a 32-bit phantom DLL called WDSUTIL.dll … Continue reading →  ( 2 min )

Learn why more organizations are including their bug bounty programs in S-1 filings and other corporate disclosures.  ( 5 min )

Explore research on isolating functional expectations for LLMs using a controller to manage access between privileged and quarantined LLMs.  ( 28 min )

How secure is the data in Microsoft 365, and what basic measures does Microsoft offer for data protection and reliability? The company has integrated some safeguarding mechanisms to protect customers from data mishaps. There is also a new framework that outlines the responsibilities of both the provider and the customer. Here's an overview of tools and regulations.

In this blog post, we will explore the new ESC6/ESC9/ESC10 edges we have introduced with ADCS support in BloodHound.  ( 29 min )

Performance is a critical factor in the usability and efficiency of any software, and Burp Suite is no exception. We've recently focused on enhancing Burp Suite's performance across several key areas  ( 6 min )

Performance is a critical factor in the usability and efficiency of any software, and Burp Suite is no exception. We've recently focused on enhancing Burp Suite's performance across several key areas  ( 6 min )

We’ve reached September and the pumpkin spice floats in the air. While they aren’t pumpkin-spiced, Microsoft and Adobe have released their latest spicy security patches – including some zesty 0-days. Take a break from your regular activities and join us as we review the details of their latest security alerts.If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for September 2024 For September, Adobe released eight bulletins covering 28 CVEs in Adobe Acrobat and Reader, ColdFusion, Photoshop, Media Encoder, Audition, After Effects, Premier Pro, and Illustrator. A total of seven of these bugs came through the ZDI program. If you’re prioritizing, I would look at the ColdFusion patch first. It corrects a single code execution bug rat…

We're excited to introduce Hai Plays, a powerful new feature for Hai, HackerOne’s AI co-pilot. Hai Plays is designed to make your interactions with Hai more efficient and tailored to your specific security needs.  ( 5 min )

No content preview  ( 5 min )

VMware Workstation Pro 17.6 introduces a couple of valuable changes. Notably, it is now available for free for personal use. The update enhances OS support, adding compatibility with systems like Windows Server 2025 and Ubuntu 24.04 as both hosts and guests. Additionally, new tools like the vmcli command-line utility streamline virtual machine management, while crucial bug fixes and security updates enhance the platform's reliability and efficiency.

Learn how threat actors can exploit SQL Server credential objects to escalate domain privileges and how you can detect it. The post Hijacking SQL Server Credentials using Agent Jobs for Domain Privilege Escalation  appeared first on NetSPI.  ( 11 min )

By Dominik Klemba and Dominik Czarnota AddressSanitizer (ASan) is a compiler plugin that helps detect memory errors like buffer overflows or use-after-frees. In this post, we explain how to equip your C++ code with ASan annotations to find more bugs. We also show our work on ASan in GCC and LLVM. In LLVM, Trail of […]  ( 20 min )

The post CloudGoat Official Walkthrough Series: ‘glue_privesc’ appeared first on Rhino Security Labs.  ( 6 min )

Introduction This guide covers the security of smart home security products from Ring, Yale, Swann, and SimpliSafe. Whether you’re looking to monitor your property remotely, enhance your home’s security, or […] Smart home security advice. Ring, SimpliSafe, Swann, and Yale first appeared on Pen Test Partners.  ( 16 min )

A blog about using the Admiralty System for better cyber threat intelligence (CTI).  ( 26 min )

Master SBOM management to secure your software supply chain. Explore the SBOM lifecycle with our guide and enhance your compliance and security strategy.  ( 20 min )

Capital One has officially launched a public bug bounty program with HackerOne, partnering with ethical hackers to secure their assets and prevent security breaches.  ( 5 min )

In my last post, I discussed three standard methods to block AI crawlers that have little prospect of being successful. Please also read it if you want to know why it is important to block AI scrapers. One way that works reliably for 4sysops is leveraging Cloudflare's Web Application Firewall (WAF). Cloudflare's free plan provides all the essential tools to safeguard your site against content theft by AI companies. However, I found that Cloudflare's new Block AI Scrapers and Crawlers feature is insufficient for the task. Fortunately, Cloudflare's WAF is sophisticated enough to reliably block all AI scrapers and other web parasites with a single, relatively simple rule. My proposed method serves as a way to enforce an opt-in approach, rather than relying on the non-binding opt-out recommendations in your robots.txt file.

SANS Cybersecurity Blog pertaining to a summary of the SANS AI Cybersecurity Summit 2024  ( 10 min )

A blog detailing strategies to protect industrial control systems (ICS) and critical infrastructure.  ( 13 min )

Over 6 years ago I decided to pursue yet another silly idea: extract all the unique .ico files from PE resources from as many samples as I can. This exercise yielded ~450K unique .ico files. If I remember correctly, the … Continue reading →  ( 2 min )

In my previous post I created a posh artisan .exe file ornamented with a large number of intricate system32 DLL imports. The process of building that file was painful – before I even managed to run the final executable I … Continue reading →  ( 3 min )

No content preview  ( 5 min )

Activating BitLocker encryption on a drive automatically generates a 48-digit numeric recovery password. This password is crucial if other unlocking methods fail and Windows prompts you with the BitLocker recovery console during startup.

By Jason An GDB loses significant functionality when debugging binaries that lack debugging symbols (also known as “stripped binaries”). Function and variable names become meaningless addresses; setting breakpoints requires tracking down relevant function addresses from an external source; and printing out structured values involves staring at a memory dump trying to manually discern field boundaries. […]  ( 12 min )

Browser notifications provide social-engineering opportunities. In this post we'll cover the associated forensic artifacts, threat hunting possibilities and hardening recommendations.  ( 9 min )

Some time ago I came up with a silly idea: i’d like to build an executable that statically links to most of the c:\windows\system2 libraries. It’s a non-sensical programming exercise, but it’s also an interesting challenge. Forcing a static import … Continue reading →  ( 2 min )

Thanks to @sixtyvividtails who corrected a mistake I made in the earlier version of the post Updated post One of a less known paths that is being searched when the libraries are loaded is C:\Windows\System. Anytime the search for a … Continue reading →  ( 2 min )

As you may know, I recently presented my Exchange-related talk during OffensiveCon 2024. This series of four blog posts is meant to supplement the talk and provide additional technical details. For those who did not attend OffensiveCon, you can also watch the full talk here: “Half Measures and Full Compromise: Exploiting Microsoft Exchange PowerShell Remoting”. This blog post covers the part from 12:05 to 18:10. In this article, part one of the series, I describe the MultiValuedProperty exploitation primitive, which became fundamental for my further exploitation of Exchange PowerShell. I also present a bypass for Microsoft’s first patch for this vulnerability, accomplished by chaining MultiValuedProperty with the Command class. Introduction You might already be familiar with the Exchange…

The content wars are on. AI crawlers ignore robots.txt, scraping greedily any web content they can reach to train their models. If search engine traffic from Google and Bing is helpful for your website, you must block all AI scrapers. This post covers three standard but ineffective methods for blocking AI crawlers on your site: robots.txt, authentication, and CAPTCHAs. In my next post, I'll introduce a solution that effectively blocks AI crawlers and other web parasites: Cloudflare.

Zuzana Hromcová explores how Iran-aligned APT OilRig targets healthcare and local governments with a stream of updated and newly developed tools.  ( 23 min )

By Artem Dinaburg and Peter Goodman (Would you get up and throw it away?) [sing to the tune of The Beatles – With A Little Help From My Friends] Here’s a riddle: when new GPUs are constantly being produced, product cycles are ~18-24 months long, and each cycle doubles GPU power (per Huang’s Law), what […]  ( 9 min )

We provide a KQL query that will help you validate your defined Windows audit security policy configuration. Defining a Windows audit policy is an important step in establishing a robust security posture. Ensuring that the audit policy is applied consistently across your environment is just as important as defining that policy and quality controls should be in place.  ( 18 min )

A blog detailing what to do once you have completed a SANS Live Training course.  ( 17 min )

Is ROI the right method to measure bug bounty value? Check out the cost-benefit analysis of ROI vs. ROM.  ( 6 min )

As I have shown in the last post, there exists a class of DLLs on Windows OS that load other libraries via import table, and sometimes these needed imported libraries do not exist. This creates an opportunity that we can … Continue reading →  ( 2 min )

In addition to the default domain password policy, administrators can assign different password rules to specific users or groups using fine-grained password policies. When multiple policies exist, it can become unclear which one is effective for a particular user.

MEGAsync forensics can be leveraged to identify exfiltrated files, additional victims and, subsequently, perform attribution.  ( 9 min )

TL;DR  A walk-through of forensic data recovery  Detailed example of how to retrieve potentially sensitive deleted data  Includes location, sleep and activity tracking  Understand the security and privacy implications of […] Advanced forensic techniques for recovering hidden data in wearable devices first appeared on Pen Test Partners.  ( 14 min )

A blog about what you can expect when you attend a SANS Live Training event.  ( 14 min )

A blog about the professional and personal benefits of attending a SANS Live Training event.  ( 18 min )

This may be a new, kinda ephemereal addition to the lolbin world (not sure if anyone covered it before). Windows 11 comes with a large number of DLLs – some of which are broken. DuCsps.dll on Windows 11 Pro 22H2 … Continue reading →  ( 2 min )

FUD can overshadow proactive collaboration with ethical hackers. Let's explore how to combat FUD and get organizational buy-in for bug bounty and VDP.  ( 7 min )

This version of the blog is preserved for archival purposes only. An updated version of this blog, including links to new PoC code, can be found here. What do you do when you’ve found an arbitrary file delete as NT AUTHORITY\SYSTEM? Probably just sigh and call it a DoS. Well, no more. In this article, we’ll show you some great techniques for getting much more out of your arbitrary file deletes, arbitrary folder deletes, and other seemingly low-impact filesystem-based exploit primitives. The Trouble with Arbitrary File Deletes When you consider how to leverage an arbitrary file delete on Windows, two great obstacles present themselves: Most critical Windows OS files are locked down with DACLs that prevent modification even by SYSTEM. Instead, most OS files are owned by TrustedInstaller, and…

URL validation bypasses are the root cause of numerous vulnerabilities including many instances of SSRF, CORS misconfiguration, and open redirection. These work by using ambiguous URLs to trigger URL  ( 5 min )

Amazon Web Services (AWS) offers two popular solutions for deploying virtual machines (instances): Lightsail and AWS EC2. While Amazon Lightsail is frequently recommended for smaller projects, is it really better than EC2 in terms of ease of use, flexibility, performance, and pricing?

A blog about the top five items you should bring to a SANS Live Training event.  ( 13 min )

We are excited to announce the release of Goffloader, a pure Go implementation of an in-memory COFFLoader and PE loader. This tool is designed to facilitate the easy execution of Cobalt Strike BOFs and unmanaged PE files directly in memory without writing any files to disk. Goffloader aims to take functionality that is conventionally within […] The post Introducing Goffloader: A Pure Go Implementation of an In-Memory COFFLoader and PE Loader appeared first on Praetorian.  ( 9 min )

Windows Terminal unveiled a range of noteworthy features in versions 1.21 and 1.22 Preview, including the capacity to retrieve previous sessions' output buffer upon startup, store code snippets for reuse within the console, and utilize a scratchpad for crafting intricate commands.

A blog about how to best prepare for a SANS Live Training event.  ( 16 min )

Introduction Constructing your own hash algorithm is controversial because there will always be professionals in the field of cryptography and engineering that can expose vulnerabilities in the design. I’m not encouraging anyone to construct a cryptographic hash algorithm without extensive … Continue reading →  ( 12 min )

Here is an overview of content I published in August: SANS ISC Diary entries: OOXML Spreadsheets Protected By Verifier Hashes Wireshark 4.4.0rc1’s Custom Columns Wireshark 4.4.0 is now available  ( 11 min )

Introduction Malware like OceanLotus have used RSA-256 to hide strings. Darkhotel used RSA to hide code. For fun, some crackmes used RSA-32 or RSA-64 for simple keygen challenges. The RSA cryptosystem uses two exponents (or keys) and a modulus derived … Continue reading →  ( 10 min )

Introduction Not sure if the title is an accurate description, but when you apply a self-inverse permutation or involution twice, you get back the original data and that’s pretty much what the code shown in this post does. There’s a … Continue reading →  ( 11 min )

No content preview  ( 6 min )

VirtualBox, the popular open-source virtualization software from Oracle, has recently released its 7.1 Beta version, bringing exciting new features and improvements. The new update aims to improve the user experience and performance, ensuring that VirtualBox remains a viable option in the desktop virtualization market. This post focuses on the new features, thoroughly summarizing what users can expect.

TL;DR  Strong passwords: Use a password manager. Multi-factor authentication (MFA): MFA requires multiple forms of identification, adding an extra layer of security. This makes it harder for unauthorised users to […] How to enhance the security of your social media accounts first appeared on Pen Test Partners.  ( 12 min )

Learn the different methodologies and best practices for pentesting for iOS applications.  ( 9 min )

SquaredUp Cloud allows the creation of dashboards and visualizations of data as a SaaS solution with many sharing options, 70+ plugins, custom APIs, and on-prem integration for hybrid cloud monitoring. The dashboard solution is easy to set up and has many features and integrations.

Here is an overview of content I published in July: Blog posts: Update: hash.py Version 0.0.13 Update: oledump.py Version 0.0.77 Update: cut-bytes.py Version 0.0.17 SANS ISC Diary entries: 16-bit Hash Collisions in .xls Spreadsheets Wireshark 4.2.6 Released Protected OOXML Spreadsheets Create Your Own BSOD: NotMyFault Quickie: Password Cracking & Energy CrowdStrike Outage Themed Maldoc  ( 11 min )

We teamed up with VirusTotal to take a deep dive into the platform's extensive query capabilities through both the web and API interfaces.  ( 42 min )

An analysis of current TIBER implementations ahead of DORA’s TLPT requirements Introduction TIBER (Threat Intelligence-Based Ethical Red Teaming) is a framework introduced by the European Central Bank (ECB) in 2018 as a response to the increasing number of cyber threats faced by financial institutions. The framework provides a standardized methodology and guidelines for conducting controlled … Continue reading The Big TIBER Encyclopedia →  ( 18 min )

Overview In an effort to safeguard our customers, we perform proactive vulnerability research with the goal of identifying zero-day vulnerabilities that are likely to impact the security of leading organizations. Recently, we decided to take a look at the 3CX Phone Management System with the goal of identifying an unauthenticated remote code execution vulnerability within […] The post 3CX Phone System Local Privilege Escalation Vulnerability appeared first on Praetorian.  ( 15 min )

Learn how HackerOne's AI co-pilot, Hai, bridges communication gaps and streamlines collaboration.  ( 5 min )

Mythic 3.3 was released in a Beta six weeks ago, and since then there has been a bunch of feedback, not just about new Mythic 3.3 features…  ( 14 min )

Microsoft Purview is a data governance and compliance solution tailored for Microsoft's ecosystem, predominantly used in Microsoft 365. Microsoft Purview AI Hub is a feature within the platform that secures and proactively monitors AI applications, such as Microsoft Copilot for Microsoft 365 and third-party large language models (LLMs).

In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Grigory Dorodnov and Guy Lederfein of the Trend Micro Research Team detail a recently patched code execution vulnerability in the VMware vCenter Server. This bug was originally discovered by Hao Zheng and Zibo Li from TianGong Team of Legendsec at Qi'anxin Group. Successfully exploiting this vulnerability could lead to a heap buffer overflow, which could result in the execution of arbitrary code in the context of the vulnerable service. The following is a portion of their write-up covering CVE-2024-37079, with a few minimal modifications. An integer underflow vulnerability has been reported for VMware vCenter Server. The vulnerability is due to a lack of validation of the calculated response header size u…

Explore the EU's new DORA regulation and how financial entities and their ICT vendors must promptly align their security frameworks with DORA's requirements to mitigate potential risks and ensure operational stability.  ( 8 min )

Incorporating new components into existing systems is such a pain, this process has been labeled “Integration Hell”. To ease tool…  ( 7 min )

By Artem Dinaburg Today we’re going to provision some cloud infrastructure the Max Power way: by combining automation with unchecked AI output. Unfortunately, this method produces cloud infrastructure code that 1) works and 2) has terrible security properties. In a nutshell, AI-based tools like Claude and ChatGPT readily provide extremely bad cloud infrastructure provisioning code, […]  ( 10 min )

NetSPI discovered CVE-2024-37888, a cross-site scripting (XSS) vulnerability in the CKEditor 4 Open Link plugin. Read about the nature of the vulnerability and its implications. The post CVE-2024-37888 – CKEditor 4 Open Link plugin XSS appeared first on NetSPI.  ( 9 min )

In this blog, we look at how we were able to use new C features and GCC plugin additions to eliminate over a megabyte of changes from grsecurity patches without any change in functionality.  ( 15 min )

In this blog, we look at how we were able to use new C features and GCC plugin additions to eliminate over a megabyte of changes from grsecurity patches without any change in functionality.  ( 15 min )

This post describes vulnerability in Microsoft 365 Copilot that allowed the theft of a user’s emails and other personal information. This vulnerability warrants a deep dive, because it combines a variety of novel attack techniques that are not even two years old. I initially disclosed parts of this exploit to Microsoft in January, and then the full exploit chain in February 2024. A few days ago I got the okay from MSRC to disclose this report.  ( 5 min )

Most organizations view Microsoft Active Directory as a "black box," lacking full visibility into its activities. ManageEngine ADAudit Plus aims to change that with its Active Directory auditing solution.

I’m a little late (one whole month passed in a blink of an eye!). Let’s catch up.  ( 10 min )

Sending a high number of emails in Microsoft 365 without hitting the throttling limits has always been an issue. Microsoft has introduced a new feature called High Volume Email to address this issue.

The modern web is constantly developing, with new potential vulnerabilities emerging all the time. Ensuring your web applications are secure in the face of this evolving threat is a constant challenge  ( 5 min )

TL;DR Rooting is useful for Android assessments The process is relatively simple It will wipe all user data from the device and void any warranty Introduction For mobile testing, be […] How to root an Android device for analysis and vulnerability assessment first appeared on Pen Test Partners.  ( 9 min )

This blog highlights two vulnerabilities that were disclosed by researchers from Synacktiv in the Autel Maxicharger firmware at the Pwn2Own Automotive 2024 event and how Autel responded to and patched these in their latest firmware release. At the Pwn2Own event,  the Synacktiv researchers demonstrated two unique remote attacks on the Autel Maxicharger running firmware v1.32 that demonstrated RCE.  Autel was later informed of these issues and they responded with firmware update v1.35 before ZDI publicly disclosed the research to the public. The first vulnerability we discuss in this blog was addressed in ZDI-24-851, while the second is covered by ZDI-24-852. In this blog, we describe the reverse engineering process used to find the vulnerabilities in the original firmware and how ZDI observ…

Since its debut in 2015, Visual Studio Code (VS Code) has become the preferred code editor for most developers. A 2023 Stack Overflow survey revealed that 73% of users favored VS Code. It is free and packed with features and extensions. So why did I switch to Zed?

Recently, I found what appeared to be a regression or bypass that again allowed data exfiltration via image rendering during prompt injection. See the previous post here for reference. Data Exfiltration via Rendering HTML Image Tags During re-testing, I had sporadic success with markdown rendering tricks, but eventually, I was able to drastically simplify the exploit by asking directly for an HTML image tag. This behavior might actually have existed all along, as Google AI Studio hadn’t yet implemented any kind of Content Security Policy to prevent communication with arbitrary domains using images.  ( 2 min )

SANS Cybersecurity Blog pertaining to a summary of the SANS DFIR Summit 2024  ( 12 min )

Come work with us!  ( 13 min )

A Decade of Distilled Phishing Wisdom  ( 8 min )

As electorates across the US and Europe go to the polls in 2024, this must-see talk on large-scale state influence operations could hardly be more timely or relevant.  ( 25 min )

Enforcing a policy for regular password changes is no longer recommended, as it can result in more helpdesk requests due to expired passwords, especially for VPN users, and may actually undermine security. However, timely notifications can help mitigate issues when password changes are necessary. Learn how to notify users with Group Policy or a PowerShell script.

Example exploit path using GCPwn covering enumeration, brute forcing secrets manager versions, and downloading data from cloud storage both through default enum_buckets and with HMAC keys. The post An Introduction to GCPwn – Parts 2 and 3 appeared first on NetSPI.  ( 45 min )

By Opal Wright Among the cryptographic missteps we see at Trail of Bits, “let’s build our own tool out of a hash function” is one of the most common. Clients have a problem along the lines of “we need to hash a bunch of different values together” or “we need a MAC” or “we need […]  ( 14 min )

Whether you’ve just started hacking or are a real pro, we’ve created the ultimate list of 100 hacking tools for your toolkit!  ( 13 min )

Swiss sportswear brand On provides insights into the threats to the retail industry and how human-powered security addresses them.  ( 6 min )

Microsoft 365 Backup is a new solution for recovering and restoring data in case of malicious or accidental deletion. It provides coverage for critical data by backing up SharePoint sites, OneDrive accounts, and Exchange mailboxes. Third-party backup solutions for Microsoft 365 typically provide more comprehensive features, granular control, and cross-platform capabilities for organizations with complex needs.

This is the second post in a series on Identity-Driven Offensive Tradecraft, which is also the focus of the new course we will launch in…  ( 13 min )

Microsoft introduced Data Protection Application Programming Interface (DPAPI) in Windows environments as a method to encrypt and decrypt sensitive data such as credentials using the… Continue reading → Web Browser Stored Credentials  ( 19 min )

With the new Teams client, Microsoft has imposed a challenging migration to unfinished software for its users. The hasty transition is especially problematic in Remote Desktop Services (RDS) environments, where the prerequisites and installation process for terminal servers are not fully documented and require significant manual intervention.

Cloud attack tool has been repurposed by multiple threat actors to push SMS spam and smishing campaigns through major SaaS providers.  ( 28 min )

A blog summarizing an in-depth discussion about Zero Trust privileged access management.  ( 14 min )

No content preview  ( 5 min )

Explore the highlights of DEF CON 32 through the eyes of The NetSPI Agents. Discover key takeaways, expert insights, and firsthand experiences from this year's premier hacker conference. The post DEF CON 32 Recap: Insights and Experiences from The NetSPI Agents  appeared first on NetSPI.  ( 20 min )

Model fine-tuning involves adjusting the weights (parameters) between the nodes, providing additional training to the model. This process allows the model to learn relevant information to your organization. This post's example demonstrates how to fine-tune an OpenAI GPT model. After reading this article, you will able to fine-tune models and understand how an LLM learns additional information.

TL; DR Event Dates: August 8-11, 2024, in Las Vegas. PTP Presentations: Windows Hello: Our Ceri Coburn (with Outsider Security’s Dirk-Jan Mollema) revealed vulnerabilities in biometric authentication. Maritime Security: Paul […] Insights and highlights from DEF CON 32 first appeared on Pen Test Partners.  ( 10 min )

A blog about best practices for securing networks with Zero Trust network access.  ( 14 min )

The government’s case against the SolarWinds CISO has been dismissed. What does this development mean?  ( 5 min )

Multiple users have reported that the Microsoft Remote Desktop for Mac and iPhone is not working when connecting to a remote desktop session, particularly when using a Remote Desktop Gateway on Windows Server 2022. The issue is associated with two error codes: 0x3000064 and 0x3000066.

Zero Day Initiative threat researchers discovered CVE-2024-38213, a simple and effective way to bypass Windows mark-of-the-web protections leading to remote code execution. In March 2024, Trend Micro’s Zero Day Initiative Threat Hunting team started analyzing samples connected to the activity carried out by DarkGate operators to infect users through copy-and-paste operations. This DarkGate campaign was an update from a previous campaign  in which the DarkGate operators were exploiting a zero-day vulnerability, CVE-2024-21412, which we disclosed to Microsoft earlier this year. The investigation into this campaign directly influenced further vulnerability research into Windows Defender SmartScreen and how files originating from WebDAV shares are handled during copy-and-paste operations. As …

We’re excited to announce that all of NCC Group’s latest research findings and articles are now hosted on our website at the following link: NCC Group Research Blog. (https://www.nccgroup.com/us/research-blog/) To stay up-to-date with our latest research, you can also subscribe to our RSS feed here: NCC Group Research Blog RSS Feed. (https://www.nccgroup.com/us/research-blog/feed/) Be sure to […]  ( 63 min )

In this blog post we describe how the MSC file format can be leveraged to execute arbitrary code via MMC (Microsoft Management Console) for initial access or lateral movement purposes. A sample payload that implements this technique was publicly shared recently. This sample was generated using our Outflank Security Tooling (OST) offering and hence we decided to publish additional details on this method and its discovery. Context of this blog post Recently, Elastic released details on a new initial access vector technique leveraging MSC files, which they dubbed “GrimResource”. These files can be used to execute code within MMC (Microsoft Management Console). This technique was researched and developed by Outflank as part of the Outflank Security Tooling (OST) toolkit. The analyzed sample was a payload generated using our In-Phase Builder, Read full post The post Will the real #GrimResource please stand up? – Abusing the MSC file format appeared first on Outflank.  ( 12 min )

This post explores Windows Side-by-Side (WinSxS) and DLL hijacking, deep-diving some tooling I've written and some of the fun along the way.  ( 10 min )

The term “special relationship,” coined by Winston Churchill, describes the close, longstanding alliance between the United States and the United Kingdom. It has been applied to cooperation during war, to trade and commerce, and even to intelligence sharing. That special relationship has clearly influenced the two nations’ recent policy papers on national cybersecurity. The U.K. […] The post Protecting Critical Infrastructure: A Tale of Two National Cybersecurity Strategies appeared first on Synack.  ( 7 min )

Scoping Adventures is a series of blogs about some of the more interesting penetration tests that the Synack Customer Success teams have worked on over the last few months. Each blog outlines how we engage with the client to achieve the best results from a pentest. Pentesters love colors—red, blue, purple, black, white and grey […] The post Scoping Adventures: How to Get the Most Out of Your Synack Pentesting appeared first on Synack.  ( 11 min )

The Synack Platform & Five Pillars of Strategic Pentesting Why You Need to Think Strategically It’s no great revelation that tactics, techniques, and procedures utilized by nefarious hackers hacking activities are evolving on a daily basis. In 2022, 18,828 common vulnerabilities and exposures (CVEs) were published. At the same time, organization attack surfaces are expanding. […] The post Applying Strategic Thinking in Your Pentesting Program appeared first on Synack.  ( 7 min )

One week ago, the Biden administration unveiled its long-awaited U.S. National Cybersecurity Strategy, with an eye toward centralizing government cyber resources and holding IT vendors more accountable for their digital defenses. Now that the ink is dry on the 35-page document, top officials like Acting National Cyber Director Kemba Walden are busy putting it into […] The post The U.S. has a new cybersecurity strategy. What’s next for CISOs? appeared first on Synack.  ( 7 min )