Learn how Purple Teaming brings together offensive and defensive strategies for a more comprehensive and impactful cybersecurity approach.  ( 7 min )

By Paweł Płatek We are publishing a set of custom CodeQL queries for Go and C. We have used them to find critical issues that the standard CodeQL queries would have missed. This new release of a continuously updated repository of CodeQL queries joins our public Semgrep rules and Automated Testing Handbook in an effort […]  ( 16 min )

Tom Hegel explores China's influence in Africa and highlights an opportunity for broader understanding of global cyber threat landscapes.  ( 24 min )

An Ansible playbook is a YAML file that contains a set of instructions and configurations for automating tasks on one or more remote machines using the Ansible automation tool. In this post in our Ansible beginner's series, I will explain how to use an Ansible Playbook by example. Ansible Playbook examples first appeared on 4sysops.  ( 52 min )

Introduction Security information and event management (SIEM) tooling allows security teams to collect and analyse logs from a wide variety of sources. In turn this is used to detect and handle incidents. Evidently it is important to ensure that the log ingestion is complete and uninterrupted. Luckily SIEMs offer out-of-the-box solutions and/or capabilities to create … Continue reading Data Connector Health Monitoring on Microsoft Sentinel →  ( 12 min )

A message from HackerOne's CEO about the power of both artificial and human intelligence.  ( 10 min )

Previously, we looked at the attack surface of the ChargePoint Home Flex EV charger – one of the targets in the upcoming Pwn2Own Automotive contest. In this post, we look at the attack surface of another EV Charger. The Ubiquiti Connect EV Station is a weatherproof Level 2 electric vehicle charging station designed for organizations. We cover the most obvious areas a threat actor would explore when attempting to compromise the device. The Ubiquiti Connect EV Station is a Level 2 charging station for electric vehicles. The EV Station is meant to be managed by a Ubiquiti management platform running the UniFi OS Console, such as the Ubiquiti Dream Machine or Cloud Gateway. Users can also use the iOS or Android UniFi Connect mobile apps to configure the EV Station. Attack Surface Summary The U…

This is a gif of the exfiltration process (We've increased the speed so you're not waiting around for 1 minute). Read on to discover how this works... Why would we want to do blind CSS exfiltration? I  ( 9 min )

The post Multiple Vulnerabilities In Extreme Networks ExtremeXOS appeared first on Rhino Security Labs.  ( 7 min )

Overview Recently, we decided to perform some reverse engineering of the SonicWall NSv appliance to identify any potential remote code execution vulnerabilities within the appliance. During our initial analysis of a virtual machine image for the application, we discovered a customized LUKS encryption mechanism meant to hinder reverse engineering of the application. We were able […] The post Analyzing the SonicWall Custom Grub LUKS Encryption Modifications appeared first on Praetorian.  ( 14 min )

SystoLOCK offers a robust solution for enhancing security through multi-factor authentication (MFA) without passwords in an Active Directory environment. Unlike other methods, SystoLOCK does not rely on cloud services. The solution introduces the convenience similar to smartcard-based authentication, eliminating the need for complex password management. Moreover, SystoLOCK allows users to log in securely via VPN connections and supports offline login functionality. SystoLOCK in review: Logging in to Active Directory with multi-factor authentication without passwords first appeared on 4sysops.  ( 54 min )

We carry out lots of attack surface assessments, parts of which involve investigating information that has been unintentionally disclosed. To help OPSEC people I thought it might be useful to […] OSINT. What can you find from a domain or company name first appeared on Pen Test Partners.  ( 6 min )

Learn more about the new SANS Challenge Coin for LDR521: Security Culture for Leaders, the transformational triad, and the transformational triad coin  ( 12 min )

HackerOne's Kayla Underkoffler shares her career journey and how she arrived at her current role.  ( 10 min )

In a previous post in this Kubernetes guide, you learned about deploying stateful applications with Kubernetes StatefulSets. Today's post will discuss Kubernetes CoreDNS. Earlier versions of Kubernetes used kube-dns to provide service discovery and name resolution within the cluster, which was based on dnsmasq and SkyDNS. The kube-dns had many problems, such as security vulnerabilities, scalability concerns, and higher latency, so starting with Kubernetes version 1.13, CoreDNS became the default cluster DNS server. Kubernetes CoreDNS first appeared on 4sysops.  ( 55 min )

Vendor: Sonos Vendor URL: https://www.sonos.com/ Versions affected: * Confirmed 73.0-42060 Systems Affected: Sonos Era 100 Author: Ilya Zhuravlev Advisory URL: Not provided by Sonos. Sonos state an update was released on 2023-11-15 which remediated the issue. CVE Identifier: N/A Risk: High Summary Sonos Era 100 is a smart speaker released in 2023. A vulnerability exists […]  ( 64 min )

Research performed by Ilya Zhuravlev supporting the Exploit Development Group (EDG). The Era 100 is Sonos’s flagship device, released on March 28th 2023 and is a notable step up from the Sonos One. It was also one of the target devices for Pwn2Own Toronto 2023. NCC found multiple security weaknesses within the bootloader of the […]  ( 68 min )

A blog about the MITRE ATT&CK framework version 14 cloud security updates  ( 15 min )

Here is an overview of content I published in November: Blog posts: Update: 1768.py Version 0.0.20 SANS ISC Diary entries: Quick Tip For Artificially Inflated PE Files Wireshark 4.2.0 Released OVA Files  ( 10 min )

‘Blade Runner’ – the cult classic movie – teaches us that the (non-)human traits/behaviors can be detected with a so-called Voight-Kampff test. This post is about discussing (not designing yet) a similar test for our threat hunting purposes… The key … Continue reading →  ( 5 min )

In the last article in this series, we looked at how to merge branches on GitHub as a way to incorporate the changes from one branch into another. This article will demonstrate how to merge branches on the command line using Git. A git merge example first appeared on 4sysops.  ( 53 min )

Defend your web applications from XPath Injection: Explore the intricacies of this critical threat, understand its impact, and learn effective mitigation strategies. The post Exploiting XPath Injection Weaknesses appeared first on NetSPI.  ( 59 min )

Many organizations are behind the curve in understanding their SaaS applications and governance. In fact, for many IT admins, SaaS applications and SaaS app governance can be very challenging in terms of visibility and control. ENow has introduced a free assessment tool called AppGov Score that quantifies the governance state of Microsoft Entra ID apps and gives admins visibility into SaaS apps in the Microsoft cloud. What’s your ENow AppGov Score? Free Microsoft Entra ID app security assessment first appeared on 4sysops.  ( 52 min )

Over the last few years I’ve carried out a lot of phishing, and have some interesting observations on how organisations respond. However, the purpose of this blog is to highlight […] OPSEC failures when threat hunting first appeared on Pen Test Partners.  ( 7 min )

In a previous blog, we took a look at the ChargePoint Home Flex EV charger – one of the targets in the upcoming Pwn2Own Automotive contest. In this post, dive in with even greater detail on all of the EV Chargers targeted in the upcoming Pwn2Own Automotive competition. This isn’t meant to be a detailed exploitation guide. However, we hope these high-resolution images will inspire some of the research we hope to see on display in Tokyo. This post provides detailed imagery of the target EV chargers we are including in the upcoming Pwn2Own Automotive contest. Our intention is to help contestants understand the component hardware included in the EV chargers for the competition. But first, a safety reminder: EV Chargers contain high voltages. Use extreme caution when working with them.  Never …

New UI and quality of life updates!  ( 18 min )

Defender for Office 365 and Exchange Online Protection monitor all emails hitting your domain and block harmful messages and spam. However, emails from legitimate sources can sometimes also be blocked for various reasons. In this scenario, as an admin, you want to whitelist the sender or the domain. In this post, you will learn how to whitelist a domain in Microsoft 365 and the necessary precautions you must take while doing so. Whitelist a domain in Microsoft 365 first appeared on 4sysops.  ( 54 min )

Earlier this month I had the opportunity to present at Ekoparty 2023 about Prompt Injections in the Wild, and the video of the talk was just posted to YouTube. Check it out. It starts with a basic overview of LLMs and then dives deep into exploits and mitigations across various LLM applications and chatbots, including (but not limited) to demos of exploits with Bing Chat, ChatGPT, Anthropic Claude, Azure AI, GCP Vertex AI and Google Bard.  ( 1 min )

HackerOne is delighted to announce the launch of Mercado Libre’s Public Bug Bounty Program.  ( 18 min )

Explore how revisiting past cyber incidents can empower defenders and help to anticipate future threats more effectively.  ( 27 min )

Microsoft’s Azure Active Directory B2C service allows cloud administrators to define custom policies, which orchestrates trust between principals using standard authentication protocols. One such custom policy that B2C defines by default is the Resource Owner Password Credentials (ROPC) flow, which implements the OAuth standard authentication flow of the same name and allows users to simply […] The post Why Azure B2C ROPC Custom Flows Are Inherently Insecure appeared first on Praetorian.  ( 10 min )

Get insights into offensive security trends in the healthcare sector with data from the Ponemon Institute’s 2023 State of Offensive Security Report.  ( 8 min )

Leveraging TPM 2.0 to unlock Linux Unified Key Setup (LUKS) encrypted partitions ensures an added layer of protection, utilizing hardware-backed security measures to safeguard critical data while automating the unlocking of encrypted drives at boot time. Unlock Linux Unified Key Setup (LUKS) encrypted partitions with TPM 2.0 first appeared on 4sysops.  ( 52 min )

No content preview  ( 2 min )

This Bishop Fox advisory highlights three critical severity vulnerabilities in the RAY application versions 2.6.3 and 2.8.0.  ( 13 min )

Copa, an open-source container image security tool from Microsoft, addresses the need to update container images. It lets you immediately patch container image vulnerabilities without relying on developers or maintainers. Update container images with Copa first appeared on 4sysops.  ( 52 min )

If you didn’t already know, I’m a massive fan of electric vehicles. One of the aspects that intrigues me is Vehicle to Grid (V2G), the potential for our car batteries […] Are Vehicle to Grid spikes coming? first appeared on Pen Test Partners.  ( 8 min )

[…]  ( 6 min )

Inspired by Phill Moore’s new project called Ruler, I combed my collection of all old HijackThis logs (that I web scraped a long time ago) looking for paths that may be associated with security software. Unlike Phill’s, the resulting data … Continue reading →  ( 2 min )

Syslog-ng stands out as an essential log management tool in Linux environments. Its advanced functionalities, coupled with extensive configurational options and robust integration capabilities with SIEM systems, make it an indispensable asset in effective log management and cybersecurity operations.  ( 19 min )

This update to 1768.py, my Cobalt Strike beacon analysis tool, adds “runtime configuration” extraction. Although 1768.py could already search for beacon configurations inside process memory dumps, the dump was just processed as a raw file. With this update, 1768.py will also search for the runtime configuration inside a process memory dump. The runtime configuration, is […]  ( 10 min )

Here’s an old-school file name-based research… it is not game changing, it won’t bring any immediate solution, but it’s still worth doing today… The software we install (focus here is on Windows, as usual) creates a loooot of files, and … Continue reading →  ( 3 min )

Here is an overview of content I published in October: Blog posts: Update: simple_listener.py Version 0.1.3 Update: xor-kpa.py Version 0.0.8 Update: pecheck.py Version 0.7.16 Update: myjson-filter.py Version 0.0.5 Update: python-per-line.py Version 0.0.11 Update: simple_listener.py Version 0.1.4 Update: 1768.py Version 0.0.19 Update: format-bytes.py Version 0.0.15 SANS ISC Diary entries: Analyzing MIME Files: a Quick Tip Friendly […]  ( 10 min )

Are you wondering why your printer spooler stopped? This article addresses common Windows print spooler errors and various methods for fixing them. If the print spooler stops—how to fix common print spooler errors first appeared on 4sysops.  ( 51 min )

It is astonishing that over 200 billion spam emails are sent out every single day. One way to tackle this problem in Microsoft 365, formerly Office 365, is to use anti-spam policies. Anti-spam policies in Microsoft 365 (Office 365) first appeared on 4sysops.  ( 54 min )

TL;DR What Capability Development (Cap Dev) is in this context The big Cap Dev benefits for red teaming Operations and Development, sharing and improving Improvements to TTPs, hardware, and developing […] Cap Dev. Better red teaming with continuous Capability Development first appeared on Pen Test Partners.  ( 7 min )

Anytime you download a file via a browser, instant messenger, or other apps… it is first saved to a temporary file… These temporary files are saved with some particular extensions: For Browsers: For email clients: For Instant Messengers: Are there … Continue reading →  ( 2 min )

By Yarden Shafir Why has Event Tracing for Windows (ETW) become so pivotal for endpoint detection and response (EDR) solutions in Windows 10 and 11? The answer lies in the value of the intelligence it provides to security tools through secure ETW channels, which are now also a target for offensive researchers looking to bypass […]  ( 16 min )

The advent of Secure Boot technology has significantly changed the security landscape and gradually gained traction in operating systems, including Linux, offering an additional layer of protection against various forms of malware and unauthorized system alterations. Install Secure Boot in Linux first appeared on 4sysops.  ( 52 min )

The ss command is a versatile and powerful tool for incident responders. Its ability to provide detailed socket information, coupled with advanced filtering and process association capabilities, makes it essential for modern network traffic analysis and incident investigation  ( 13 min )

Rootkits are an ongoing problem in cybersecurity, particularly within the Linux ecosystem. These surreptitious entities pose a considerable threat by affording unauthorised access and perpetuating control over compromised systems. In this comprehensive exploration, we will delve into the intricacies of Linux rootkits, unravelling their nature, the diverse types they encompass, their intricate construction techniques, and their historical evolution.  ( 21 min )

The inaugural Glass Firewall Conference: Breaking Bytes and Barriers was sponsored by Capital One, GitHub, and HackerOne.  ( 9 min )

Introduction To overcome the shortcomings of password-based authentication, organizations are exploring innovative mechanisms for signing in. In this blog, we’ll delve into various mechanisms and technologies that address the limitations of passwords and highlight the pros and cons of these solutions. Mechanisms to Replace Passwords Authenticators are means to prove a user’s identity in the […] The post Passwordless Authentication: Going Beyond Passkeys appeared first on SecureAuth.  ( 34 min )

In the previous post of this Ansible beginner series, we covered the installation of Ansible, as well as some basic deployment tasks. In this post, we will explore Ansible's remote management features in more detail. The Ansible shell mode is a command-line tool that allows users to execute commands directly on remote hosts through Ansible. It is used for running arbitrary commands that don't require a module, providing a quick and direct way to perform tasks on managed nodes. Ansible shell module: Run remote shell commands first appeared on 4sysops.  ( 52 min )

Multiple vulnerabilities identified in Adobe ColdFusion allow an unauthenticated attacker to obtain the service account NTLM password hash, verify the existence of a file or directory on the underlying operating system, and configure central config server settings.  ( 72 min )

A core component of Zero Trust is enabling external testers to validate the continuous security of external-facing assets, like through a VDP.  ( 10 min )

By Jim Miller The US government recently issued a request for information (RFI) about open-source software (OSS) security. In this blog post, we will present a summary of our response and proposed solutions. Some of our solutions include rewriting widely used legacy code in memory safe languages such as Rust, funding OSS solutions to improve […]  ( 10 min )

Windows 11 23H2 introduces a range of new Group Policy settings. These target new features like Dev Drive and extend the management options for existing components. The corresponding ADMX templates are already available for download, as is the setting reference spreadsheet. New Group Policy settings in Windows 11 23H2 first appeared on 4sysops.  ( 52 min )

Windows Task Scheduler enables windows users and administrators to perform automated tasks at specific time intervals. Scheduled tasks has been commonly abused as a method… Continue reading → Persistence – Scheduled Task Tampering  ( 15 min )

Author: Alex Jessop (@ThisIsFineChief) Summary Tl;dr This post will delve into a recent incident response engagement handled by NCC Group’s Cyber Incident Response Team (CIRT) involving the Ransomware-as-a-Service known as NoEscape. Below provides a summary of findings which are presented in this blog post:  NoEscape NoEscape is a new financially motivated ransomware group delivering a […]  ( 67 min )

The increase in threat activity requires an informed and proactive response from cybersecurity professionals. It is important that we understand the attacker behaviors and are able to take the right measures to detect and respond. This post includes a summary of the key findings from the reports and how it can impact you as a cybersecurity professional.  ( 17 min )

As ICS risk grows, so too must the skills of the ICS cyber defender.  ( 20 min )

Welcome back! Today we’re going to talk about hosting encrypted stager shellcode. There are a lot of uses for this. Whether you’re trying to implement a “fileless” implant or you’ve found writable…  ( 10 min )

One of the main new features of Windows Server 2022 is SMB over QUIC. QUIC serves as an alternative to TCP and RDMA, providing a secure connection to a file server over untrusted networks. This protocol is based on UDP and TLS 1.3, enhancing the security and performance of file shares. Windows Server 2025 will include it in all editions, along with the new QUIC Client Access Control. QUIC has been exclusive to the Azure Edition until now. Windows Server 2025 will support SMB over QUIC in all editions first appeared on 4sysops.  ( 51 min )

The SANS Security Awareness Professional (SSAP) is the world’s leading industry-recognized credential that signifies that the holder has the knowledge and expertise to build, maintain and measure a mature security awareness program.  ( 11 min )

Examine the differences between the LDR433: Managing Human Risk course and LDR521: Security Culture for Leaders course.  ( 10 min )

SecureAuth has just announced the major release of Arculix, our next-gen authentication platform that delivers major enhancements to its low code/no code orchestration engine. Since our orchestration product was built from the ground up, not acquired via acquisition, to be Arculix’s policy engine, we were able to focus on designing a product specifically to extend […] The post SecureAuth Drives Major Additions to Arculix’s Orchestration Engine to Deliver Optimal User Experience with No Code, Low Code appeared first on SecureAuth.  ( 31 min )

After the SEC's recent charges against SolarWinds, publicly traded companies need robust cybersecurity risk management.  ( 10 min )

Exploring the technical intricacies of Appin, a hack-for-hire group, revealing confirmed attribution and global threat activity, both old and new.  ( 33 min )

NetSPI explores extracting managed identity credentials from Azure Function Apps to expose sensitive data. The post Mistaken Identity: Extracting Managed Identity Credentials from Azure Function Apps  appeared first on NetSPI.  ( 54 min )

The new graphical console brings a number of improvements over the classic console host. However, for the foreseeable future, both environments are available. In Windows 11, the new terminal is already set as the default, but you can switch between both as needed. Unfortunately, the coexistence between the two terminals is suffering from some inconsistencies. Switch between Windows Terminal and the legacy console first appeared on 4sysops.  ( 50 min )

SANS Cybersecurity Blog pertaining to a summary of the SANS HackFest Summit 2023  ( 11 min )

I love exploring unexplored software paths. And not necessarily on the assembly level – and that’s because often… it’s not even necessary. They often lead me to some really weird places f.ex. discovering a software that reads a memory address … Continue reading →  ( 3 min )

No content preview  ( 9 min )

Over the past year, I’ve been working on making significant updates to Merlin in my free time. Today, I’m ready to release version 2 of…  ( 16 min )

By Alvin Crighton, Anusha Ghosh, Suha Hussain, Heidy Khlaaf, and Jim Miller TL;DR: We identified 11 security vulnerabilities in YOLOv7, a popular computer vision framework, that could enable attacks including remote code execution (RCE), denial of service, and model differentials (where an attacker can trigger a model to perform differently in different contexts). Open-source software […]  ( 18 min )

At Fox-IT (part of NCC Group) identifying servers that host nefarious activities is a critical aspect of our threat intelligence. One approach involves looking for anomalies in responses of HTTP servers. Sometimes cybercriminals that host malicious servers employ tactics that involve mimicking the responses of legitimate software to evade detection. However, a common pitfall of […]  ( 72 min )

Ansible, an open-source automation platform, is rapidly gaining popularity among IT experts and organizations seeking simple yet powerful solutions for automation. It streamlines IT operations by automating configuration management, application deployment, and task automation. It speeds up tasks and ensures infrastructure consistency. This Ansible beginner tutorial will take you through the essential steps of getting started with Ansible, providing you with a foundational understanding, and examples to kickstart your automation journey. Ansible beginner tutorial first appeared on 4sysops.  ( 54 min )

In August 2023, Meta engaged NCC Group’s Cryptography Services practice to perform an implementation review of their Auditable Key Directory (AKD) library, which provides an append-only directory of public keys mapped to user accounts and a framework for efficient cryptographic validation of this directory by an auditor. The library is being leveraged to provide an […]  ( 66 min )

I am proud to share that I was elected the Vice Chair of the RISC-V J-extension (so-called J-ext) Task Group 🙂 My last 3-4 years of work on the RISC-V architecture were quite fruitful: Thanks,Adam  ( 3 min )

Nosey Parker is Praetorian’s secret detection tool, used regularly in our offensive security engagements. It combines regular expression-based detection with machine learning (ML) to find misplaced secrets in source code and web data. We originally wrote a blog post in March, 2022, detailing our approach to integrating machine learning into secrets detection. We have not […] The post Nosey Parker’s Ongoing Machine Learning Development appeared first on Praetorian.  ( 9 min )

It’s the penultimate second Tuesday of 2023, and Microsoft and Adobe have released their latest security patches into the crisp, fall air. Take a break from your scheduled activities and join us as we review the details of their latest advisories. If you’d rather watch the video recap, you can check it out here: Adobe Patches for November 2023 For November, Adobe released 14 bulletins addressing 76 CVEs in Adobe Acrobat and Reader, ColdFusion, Audition, Premiere Pro, After Effects, Media Encoder, Dimension, Animate, InCopy, InDesign, RoboHelp, FrameMaker Publishing Server, Bridge, and Photoshop. A total of 54 of these bugs came through the ZDI program, with most attributed to ZDI vulnerability researcher Mat Powell. The patch for Acrobat and Reader is the largest with 17 CVEs, and likely t…

A data-informed prioritization strategy is integral to ensuring remediation efforts are practical — and severity does not always mean priority.  ( 11 min )

Part 11: Functional Composition  ( 31 min )

By William Woodruff This is a joint post with the PyPI maintainers; read their announcement here! This audit was sponsored by the Open Tech Fund as part of their larger mission to secure critical pieces of internet infrastructure. You can read the full report in our Publications repository. Late this summer, we performed an audit […]  ( 13 min )

Linux's logical volume management (LVM) system manages and provisions data on physical disks. In this article, I will explain how LVM functions, how to manage it on a single volume, and how to encrypt it using Cockpit. In future articles, we'll discuss how to set up your Linux distribution with full-disk encryption, Secure Boot, and TPM2.0 integration (similar to BitLocker on Windows or FileVault on Mac). Encrypt Linux LVM with Linux Unified Key Setup (LUKS) using Cockpit first appeared on 4sysops.  ( 53 min )

You've might have heard of Lambdas. But have you heard of Bambdas? They're a unique new way to customize Burp Suite directly from the UI, using only small snippets of Java. Changing the face of Burp S  ( 4 min )

Unveiling the Dark Side: A Deep Dive into Active Ransomware Families  Author: Molly Dewis  Intro  Our technical experts have written a blog series focused on Tactics, Techniques and Procedures (TTP’s) deployed by four ransomware families recently observed during NCC Group’s incident response engagements.    In case you missed it, our last post analysed an Incident Response […]  ( 71 min )

Admins who work with WSUS regularly are used to connection issues of the MMC console. However, it is not clear from the error message what the cause of these problems could be. One possible reason is an expired certificate. After renewing it, you assign it to the WSUS website. For Server Core, you can do this using PowerShell. Connection error: renew WSUS certificate first appeared on 4sysops.  ( 50 min )

There is a lot talk about whoami.exe recently, so here’s one more post about it… When we talk about whoami.exe we often think of it in ‘atomic’ terms. You run it, and you get the results. But by doing so … Continue reading →  ( 3 min )

Introduction If you are a pentester and enjoy tinkering with Windows, you have probably come across the following post by Raphael Mudge: Windows Access Tokens and Alternate Credentials In this post, he explains how the Windows program runas works and how the netonly flag allows the creation of processes where the local identity differs from […]  ( 73 min )

Working with nested Docker containers has several use cases. In this article, I will discuss three methods to create a container inside a Docker container: Docker socket (Dood), dind tag, and Sysbox. You will learn about the advantages and disadvantages of each solution, and I will outline the downsides of nested containers. Nested Docker containers: Run Docker in a Docker container first appeared on 4sysops.  ( 54 min )

Previously, we looked at the ChargePoint Home Flex EV charger – one of the targets in the upcoming Pwn2Own Automotive contest. In this post, we look at how to safely modify an EV charger to perform research through benchtop experiments. This isn’t meant to be a comprehensive guide, but it should provide you with a solid base to start your own research into these devices. In some of our previous blogs, we’ve looked at the attack surface of devices included in the Pwn2Own Automotive competition. In this post, we provide some information on hardware modifications that can be made to most electric vehicle (EV) chargers to assist in benchtop experimentation. But first, a safety reminder:  EV Chargers contain high voltages, use extreme caution when working with them.  Never touch interior compo…

U.S. policymakers are increasingly encouraging and mandating public and private sector organizations to enhance their cybersecurity programs by adopting VDPs. Have you planned for a VDP in next year’s budget?  ( 9 min )

When I first started diving into offensive Slack access, one of the best public resources I found was a blog post by Cody Thomas from back…  ( 13 min )

Loki is an open-source log aggregation system developed by Grafana Labs and tailored for cloud-native and containerized apps. Loki is often used in conjunction with Grafana for log visualization. In this guide, I will explain how to install Loki and outline how you can integrate the log aggregation solution with Grafana. Install Loki and visualize logs with Grafana first appeared on 4sysops.  ( 50 min )

A blog about using Generative AI quickly and cost effectively create customized images for your organization.  ( 19 min )

Do pentesting and bug bounties serve the same purpose or complement each other? Let’s explore the four different approaches to pentests and the key differences between bug bounty and pentesting.  ( 10 min )

Clients can connect to VMs on a remote host via the VirtualBox Remote Display Protocol (VRDP) without the need to enable Remote Desktop (RDP) in the guest OS. This allows VirtualBox to be used to host virtual desktops that users can access from various clients. Remote connect to VirtualBox VMs via RDP (VRDP) first appeared on 4sysops.  ( 51 min )

Overview Android 14 introduced a new feature which allows to remotely install CA certificates. This change implies that instead of using the /system/etc/security/cacerts directory to check the trusted CA’s, this new feature uses the com.android.conscrypt APEX module, and reads the certificates from the directory /apex/com.android.conscrypt/cacerts. Inspired by this blog post by Tim Perry, I decided to create a […]  ( 69 min )

Learn about cloud security and cloud penetration testing in Part 2 of Seth Art's interview with Cloud Security Podcast.  ( 12 min )

Introduction In today’s digital environment, we encounter a mix of evolving cyber systems and the complexities they introduce. One notable influence in this space is artificial intelligence (AI), alongside associated technologies such as machine learning, which offer promising avenues for reshaping cyber strategies. Traditionally, cybersecurity has operated with definitive parameters, set boundaries, and post-event counteractions. … Continue reading AI in Cybersecurity: Bridging the Gap Between Imagination and Reality →  ( 16 min )

Blog outlining the SANS Cloud Security Curriculum offerings and resources.  ( 17 min )

HackerOne builds upon the foundation of bug bounty in our approach to AI Red Teaming.  ( 10 min )

An emerging infostealer being sold on Telegram looks to harness generative AI to streamline cyber attacks on cloud services.  ( 26 min )

Introduction  ( 18 min )

Token stealing is getting harder. Instead, stealing whole logged-in browser instances may be an easier and more generic approach. One…  ( 16 min )

Merging branches in Git is a way to incorporate changes from one branch into another branch. In the previous article in this series, we looked at the basics of branching in Git and GitHub, as a means of achieving isolated lines of development for parallel work and feature separation. Once the code on a branch has been judged production-ready, it can be merged into the production-ready line. Merge branches on GitHub first appeared on 4sysops.  ( 52 min )

The term “special relationship,” coined by Winston Churchill, describes the close, longstanding alliance between the United States and the United Kingdom. It has been applied to cooperation during war, to trade and commerce, and even to intelligence sharing. That special relationship has clearly influenced the two nations’ recent policy papers on national cybersecurity. The U.K. […] The post Protecting Critical Infrastructure: A Tale of Two National Cybersecurity Strategies appeared first on Synack.  ( 7 min )

Scoping Adventures is a series of blogs about some of the more interesting penetration tests that the Synack Customer Success teams have worked on over the last few months. Each blog outlines how we engage with the client to achieve the best results from a pentest. Pentesters love colors—red, blue, purple, black, white and grey […] The post Scoping Adventures: How to Get the Most Out of Your Synack Pentesting appeared first on Synack.  ( 11 min )

The Synack Platform & Five Pillars of Strategic Pentesting Why You Need to Think Strategically It’s no great revelation that tactics, techniques, and procedures utilized by nefarious hackers hacking activities are evolving on a daily basis. In 2022, 18,828 common vulnerabilities and exposures (CVEs) were published. At the same time, organization attack surfaces are expanding. […] The post Applying Strategic Thinking in Your Pentesting Program appeared first on Synack.  ( 7 min )

One week ago, the Biden administration unveiled its long-awaited U.S. National Cybersecurity Strategy, with an eye toward centralizing government cyber resources and holding IT vendors more accountable for their digital defenses. Now that the ink is dry on the 35-page document, top officials like Acting National Cyber Director Kemba Walden are busy putting it into […] The post The U.S. has a new cybersecurity strategy. What’s next for CISOs? appeared first on Synack.  ( 7 min )