• Open

    What Has Always Been the Moat in Pentesting?
    Artificial intelligence has prompted a question our industry should have asked long ago: what is the moat in pentesting? For years, my answer was simple: hire the best hackers and customers will come. That answer is not wrong. Technical competence is necessary. Poor work destroys a consultancy's reputation, while technical excellence attracts talent and builds trust. But it may not be enough. Imagine two consultancies bidding for a penetration test at a regional healthcare provider. The first employs elite researchers with impressive discoveries and conference credentials. The second is less prestigious, but its consultants understand healthcare environments, regulatory constraints, common authentication systems and which recommendations the cu…  ( 5 min )

  • Open

    Traefik | Version Through 3.7.11
    Traefik's request read timeout is enabled by default and documented without exception, but it has never applied to HTTP/3. Bishop Fox confirmed the gap across four years of releases, measured it against the backend, and reported it to the vendor, who shipped a fix within twelve days.  ( 7 min )

  • Open

    Website Launch
    NSLog(@"Hello World"); objective-see.org is alive!  ( 42 min )
    Reversing to Engineer: Learning to 'Secure' XPC from a Patch
    How reversing Apple's 'RootPipe' patch provided the means to secure TaskExplorer's XPC service  ( 42 min )
    More on, "Adware for OS X Distributes Trojans"
    A deeper dive into 'MacInstaller' and the adware it installs  ( 42 min )
    Building HackingTeam's OS X Implant For Fun & Profit
    How to build HackingTeam's OS X implant in Xcode  ( 42 min )
    Kernel Debugging a Virtualized OS X El Capitan Image
    How to remotely kernel-debug a OS X 10.11 VM  ( 42 min )
    Monitoring Process Creation via the Kernel (Part I)
    Why BlockBlock needs a kext (hint: process monitoring), and how the kext was created  ( 42 min )
    Dylib Hijack Scanner Released
    Announcing the release of DHS; a tool to help detect (dylib) hijackers  ( 42 min )
    Phoenix: RootPipe lives! ...even on OS X 10.10.3
    Exploiting RootPipe on OS X 10.10.3  ( 42 min )
    Analyzing the Anti-Analysis Logic of an Adware Installer
    Dissecting string obfuscations, junk code insertions, and anti-debugging logic of InstallCore  ( 5 min )
    Are you from the Mac App Store?
    How to verify that an application came from the official Mac App Store, via receipt validation  ( 7 min )
    Monitoring Process Creation via the Kernel (Part III)
    Getting process creation notifcations from kernel-mode to user-mode, via the undocumented kev_msg_post function  ( 8 min )
    HackingTeam Reborn; A Brief Analyis of the RCS Implant Installer
    HackingTeam using native OS X crypto to protect malware -neat! New blog w/ sample + decryptions/dumpings/detections  ( 5 min )
    Two Bugs, One Func(), part three
    Analyzing code within the macOS kernel audit subsystem uncovered an exploitable heap overflow.  ( 5 min )
    Towards Generic Ransomware Detection
    By monitoring file I/O events and detecting the rapid creation of encrypted files by untrusted processes, can ransomware be generically detected?  ( 26 min )
    Happy Birthday to Objective-See
    Today is our 2nd birthday! Let's look at our past, present, and future.  ( 2 min )
    Analysis of an Intrusive Cross-Platform Adware; OSX/Pirrit
    In Objective-See's first guest blog post, Amit Serper presents his detailed analysis of OSX/Pirrit  ( 10 min )
    Mac Malware of 2016
    Let's analyse the malware that appeared in 2016, discussing the infection vector, persistence mechanism, feature, and disinfection for each.  ( 12 min )
    CVE-2015-3673: Goodbye Rootpipe...(for now?)
    Details on bypassing Apple's original rootpipe patch  ( 42 min )
    [0day] Bypassing Apple's System Integrity Protection
    Read how an attacker can bypass Apple's SIP, via the local OS upgrade process  ( 11 min )
    Persisting via a Finder Sync
    Learn how a Finder Sync can 'extend' Finder.app and how this could be abused for persistence  ( 5 min )
    Two Bugs, One Func(), part one
    The macOS kernel had an (intentional?) off-by-one bug that could trigger a kernel panic.  ( 13 min )
    Click File, App Opens
    The 'Mac File Opener' adware is fairly normal, except for it how it persists via registered document handlers  ( 9 min )
    'Untranslocating' an App
    Apple's App Translocation broke several of my tools, but we can locally undo it to restore broken functionality!  ( 11 min )
    Forget the NSA, it's Shazam that's always listening!
    Does Shazam's Mac App keep recording even when you turn the app off? ...yes :/  ( 8 min )
    From Italy With Love?
    Reverse-engineering a 'Russian' implant reveals HackingTeam's code!?  ( 10 min )
    Two Bugs, One Func(), part two
    Apple's 'fix' for a macOS kernel panic, fixes nothing and worse, introduces a new bug.  ( 13 min )
    New Attack, Old Tricks
    A Word document targets Mac users with malicious macros and an open-source payload.  ( 4 min )
    Mac Malware of 2017
    Let's look at all the mac malware from 2017, for each - discussing their infection vector, persistence mechanism, features & goals.  ( 40 min )
    Monitoring Process Creation via the Kernel (Part II)
    Process monitoring via the KAuth Subsystem (and some limitations)  ( 5 min )
    All Your Docs Are Belong To Us
    Here, we reverse, then 'extend' a popular macOS anti-virus engine. With the creation of a new anti-virus signature, classified documents will be automatically detected!  ( 14 min )
    Analyzing OSX/CreativeUpdater
    Recently, the popular MacUpdate website was subverted to distribute a new macOS cryptominer; OSX/CreativeUpdater.  ( 5 min )
    Ay MaMi - Analyzing a New macOS DNS Hijacker
    OSX/MaMi (the first Mac malware of 2018) hijacks infected users' DNS settings and installs a malicious certificate into the System keychain, in order to give remote attackers 'access' to all network traffic  ( 9 min )
    OSX/Proton.B; a brief analysis, 6 miles up
    Analysis of OSX/Proton.B reveals some interesting tricks plus a command file that can be decrypted to reveal the malware's capabilities  ( 10 min )
    When Disappearing Messages Don't Disappear
    Did you know on macOS, notifications are stored in a unencrypted database? Which means that even 'disappearing' messages from apps such as Signal - may not really disappear. Yikes!  ( 4 min )
    WTF is Mughthesec!? poking on a piece of undetected adware
    Some undetected adware named "Mughthesec" is infecting Macs...let's check it out!  ( 5 min )
    Why _blank_ Gets You Root
    Yet another a massive security flaw affects the latest version of macOS (High Sierra), allowing anybody to log into the root account with a blank, or password, of their choosing!  ( 7 min )
    Cache Me Outside
    Are full paths and preview thumbnails for files even on encrypted containers and removable usb devices really persistently stored? ...yes :( Apple's 'QuickLook' cache is to blame.  ( 7 min )
    OSX/MacRansom; analyzing the latest ransomware to target macs
    Looks like somebody on the 'dark web' is offering 'Ransomware as a Service'...that's designed to infect Macs!  ( 6 min )
    High Sierra's 'Secure Kernel Extension Loading' is Broken
    A new 'security' feature in macOS 10.13, is trivial to bypass.  ( 5 min )
    Analyzing CrossRAT
    The EFF/Lookout discovered a cross-platform implant, named CrossRat with ties to nationstate operators. Here, we tear it apart; analyzing its persistence mechanisms, features, and network communications.  ( 13 min )
    From the Top to the Bottom; Tracking down CVE-2017-7149
    High Sierra suffered from a nasty bug (CVE-2017-7149) that afforded local attackers access to the contents of encrypted APFS volumes.  ( 12 min )
    An Insecurity in Apple's Security Framework?
    Turns out that writing security tools is a great way to inadvertently uncover bugs in macOS. How about a crash in Apple's 'Security' framework ... that can't be good!?  ( 7 min )
    HandBrake Hacked! OSX/Proton (re)Appears
    The website of a popular application was hacked, and the application trojaned with a new variant of osx/proton.  ( 3 min )
    An Unpatched Kernel Bug
    On my flight to ShmooCon, I managed to panic my fully-patched MacBook. Here we analyze the kernel panic report, finding that Apple's AMDRadeonX4150 kext is responsible for the crash.  ( 7 min )
    Tearing Apart the Undetected (OSX)Coldroot RAT
    I uncovered a new cross-platform backdoor that provides remote attackers persistent access to infected systems  ( 12 min )
    A Surreptitious Cryptocurrency Miner in the Mac App Store?
    Turns out the innocuously named "Calendar 2" app, found on the official Mac App Store, was surreptitiously turning Mac into cryptocurrency miners!  ( 4 min )
    Who Moved My Pixels?!
    In this guest blog post my friend Mikhail Sosonkin reverses Apple's screencapture utility, discusses Mac malware that captures desktop images, and suggests methods for screen-capture detection!  ( 11 min )
    Breaking macOS Mojave (Beta)
    In macOS Mojave apps, to have to obtain user permission before using the Mac camera & microphone. We'll illustrate how this is trivial to bypass (at least in the current beta).  ( 4 min )
    Block Blocking Login Items
    Apple recently updated the way login items are stored by the OS. In this post, we'll illustrate how to parse the (new) login item files to detect persistence
    A Remote iOS Bug
    Apple wrote code to appease the Chinese government ...it was buggy. In certain configurations, iOS devices were vulnerable a "emoji-related" flaw that could be triggered remotely!
    [0day] Bypassing SIP via Sandboxing
    In this guest blog post @CodeColorist writes about a neat macOS vulnerability. Ironically, by abusing security mechanisms such as sandboxing, macOS can be coerced to load an untrusted library, into a SIP-entitled process!
    OSX.Dummy
    A new Mac malware targets the cryptocurrency community. In this post, we dive into the malware and illustrate how Objective-See's tools can generically thwart this new threat at every step of the way.
    The Mac Malware of 2019
    Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!  ( 41 min )
    The Mac Malware of 2018
    Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!  ( 26 min )
    Middle East Cyber-Espionage
    The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's analyze their 1st-stage macOS implant: OSX.WindTail!  ( 7 min )
    Getting Root with Benign AppStore Apps
    In this guest blog post, "Objective by the Sea" speaker, Csaba Fitzl writes about an interesting way to get root via Apps from the official Mac App Store!  ( 17 min )
    [0day] Mojave's Sandbox is Leaky
    The macOS sandbox is seeks to prevent malicious applications from surreptitiously spy on unsuspecting users. Turns out, it's trivial to sidestep some of these protections, resulting in significant privacy implications!  ( 7 min )
    Escaping the Microsoft Office Sandbox
    Imagine you've gained remote code execution on a Mac via a malicious Word document. Turns out, you're still stuck in a sandbox. However, via a faulty regex, you can escape and persist!  ( 5 min )
    A Deceitful 'Doctor' in the Mac App Store
    A massively popular app from the official Mac App Store, surreptitiously steals your browsing history! By fully reversing the application, we can fully expose its functionality and rather shady capabilities.  ( 13 min )
    The 'S' in Zoom, Stands for Security
    Today we uncover two (local) security flaws in Zoom's latest macOS client. First, a privilege escalation vulnerability, and second, a method to surreptitiously access a user's webcam and microphone (via Zoom).  ( 12 min )
    Writing a Process Monitor with Apple's Endpoint Security Framework
    Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) Process Monitor for macOS 10.15!  ( 14 min )
    Burned by Fire(fox) (Part III)
    Recently, an attacker targeted (Mac) users via a Firefox 0day. In this third post, we analyze a second backdoor used in the attack, detailing its persistence, capabilities, and ultimate identify it a new variant of the cross-platform Mokes malware!  ( 6 min )
    Writing a File Monitor with Apple's Endpoint Security Framework
    Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) File Monitor for macOS 10.15!  ( 10 min )
    Burned by Fire(fox) (Part II)
    Recently, an attacker targeted (Mac) users via a Firefox 0day. In this second post, we fully reverse OSX.NetWire.A, revealing (for the first time!), its inner workings and complex capabilities.  ( 12 min )
    "Objective by the Sea" v2.0
    After the success of #OBTS v1.0, we decided to go international and plan #OBTS v2.0 in Europe! In this blog post, we re-live the highlights (from Monaco!) of "Objective by the Sea" v2.0.  ( 3 min )
    Pass the AppleJeus
    A new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine it's infection vector, method of persistence, capabilities, and more!  ( 10 min )
    Mass Surveillance, is an (un)Complicated Business
    A massively popular iOS application turns out to be a government spy tool! Here, we analyze the app; decrypting its binary and studying its network traffic.  ( 12 min )
    Remote Mac Exploitation Via Custom URL Schemes
    The WINDSHIFT APT group is successfully infecting Macs with a novel infection mechanism. By abusing custom URL scheme handlers and minimal user interaction, Macs can be remotely compromised!  ( 8 min )
    Word to Your Mac
    A malicious Word document targeting macOS users, was recently uncovered. Let's extract the embedded macros, decode an embedded downloader, and retrieve the 2nd-stage payload!  ( 5 min )
    Death by vmmap
    A core Mojave utility is rather disastrously broken - causing a full-system lockup. Let's find out why!  ( 6 min )
    Middle East Cyber-Espionage (part two)
    The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's (continue to) analyze their 1st-stage macOS implant: OSX.WindTail!  ( 8 min )
    [0day] Synthetic Reality
    If you can programmatically generate synthetic mouse clicks, you can break macOS! Approving kernel extensions, dismissing privacy alerts, and much more more...  ( 8 min )
    Mac Adware, à la Python
    Let's tear apart a persistent piece of adware, decompiling, decoding, and decompressing it's code to uncover its methods and capabilities.  ( 8 min )
    [0day] Abusing XLM Macros in SYLK Files
    A 0day logic flaw in Microsoft Excel leads to 'remote' code execution on macOS, via malicious macros.  ( 6 min )
    Burned by Fire(fox) (Part I)
    Recently, an attacker targeted (Mac) users via a Firefox 0day. In this first post, we triage and identify the malware (OSX.NetWire.A) utilized in this attack, identifying its methods of persistence, and more!  ( 6 min )
    Rootpipe Reborn (Part II)
    @CodeColorist continues writing about bugs, such as CVE-2019-8521 and CVE-2019-8565 that provide a mechanism to elevate privileges to root on macOS.  ( 4 min )
    The Dacls RAT ...now on macOS!
    A sophisticated Lazarus Group implant has arrived on macOS. In this post, we deconstruct the Mac variant of a OSX.Dacls, detailing its install logic, persistence, and capabilities.  ( 11 min )
    Lazarus Group Goes 'Fileless'
    The rather infamous APT group, "Lazarus", continues to evolve their macOS capabilities. Today, we tear apart their latest 1st-stage implant that supports remote download & in-memory execution of secondary payloads!  ( 9 min )
    Weaponizing a Lazarus Group Implant
    The Lazarus group's latest implant/loader supports in-memory loading of 2nd-stage payloads. In this post we describe exactly how to repurposing this 1st-stage loader to execute *our* custom 'fileless' payloads!  ( 14 min )
    Rootpipe Reborn (Part I)
    In part one of a guest blog post, @CodeColorist writes about several neat macOS vulnerabilities.  ( 4 min )
    Sniffing Authentication References on macOS
    CVE-2017-7170 was a local priv-esc vulnerability that affected OSX/macOS for over a decade! Here (for the first time!), we dive into the technical details of finding the bug, the core flaw, and exploitation.  ( 10 min )

  • Open

    Research Worth Reading - Week 35, 2026
    Ruby, escapes and good memories... 💎 Ruby Marshal Kick-off Gadgets - elttam 👍 0 Luke Jahnke is back at it. Two weeks after publishing a universal Ruby 4.0 deserialization chain, he questioned whether removing explicit callbacks and RubyGems gadgets would eventually exhaust the attack surface. Luke found six methods that Marshal.load invokes implicitly, including hash, eql?, and to_s. These calls emerge from rebuilding ordinary Ruby objects, making them difficult to remove without changing the language itself. Gadget hardening raises the cost of exploitation, but it cannot make untrusted Marshal data safe. The durable defence remains removing the primitive. Ruby Marshal Kick-off Gadgets - elttam. ␛ VMs won't contain cyber-capable agents - The Trail of Bits Blog 👍 0 Trail of Bit…  ( 5 min )

  • Open

    Why SpecterOps Signed OpenAI’s Call for Collective Cyber Defense
    Our response to OpenAI’s call for stronger, more widely shared cyber defense We are signing OpenAI’s call for collective action on cyber defense because we agree with the three principles at its center: the weaknesses already exist, advanced AI needs to reach more defenders, and the response must be collective and widespread. SpecterOps has operated […] The post Why SpecterOps Signed OpenAI’s Call for Collective Cyber Defense appeared first on SpecterOps.  ( 12 min )
    Cleartext Credential Recovery in ServiceNow
    TL;DR: This post explores using ServiceNow script includes to create a cleartext credential retrieval mechanism valid for any discovery credential type and LDAP credential records. Introduction ServiceNow is a cloud IT service management platform (ITSM) enabling enterprise scale asset tracking, workflow automation, and much more. I first leveraged ServiceNow on a red team assessment in […] The post Cleartext Credential Recovery in ServiceNow appeared first on SpecterOps.  ( 15 min )

  • Open

    Inside 90 days of attacks on AI infrastructure
    Wiz honeypots uncover active campaigns targeting LiteLLM, MCP servers, and AI frameworks through RCE, blind prompt injection, and memory credential theft.  ( 60 min )
    From Concept to Context Engine: How Wiz Built AI-Powered Data Discovery
    Inside the multi-agent pipeline and feedback loops that turned a bucket scanner into a context engine.  ( 59 min )
    Version Control DFIR: a Cheatsheet to GitHub, GitLab, Bitbucket, and Azure DevOps
    A practitioner’s guide to log visibility, incident readiness, and threat hunting across the major version control services.  ( 60 min )

  • Open

    PCI DSS Penetration Testing Requirements: What Enterprises Actually Need for Compliance
    Getting PCI DSS Requirement 11.4 Right From the Start Introduction The post PCI DSS Penetration Testing Requirements: What Enterprises Actually Need for Compliance appeared first on Synack.  ( 24 min )

  • Open

    Breaking Claude Code Opus 5 Auto Mode
    In this post, we explore how a simple website summary request hijacks Claude Code Opus 5 in Auto Mode and achieves code execution with 60-80% attack success rate using a small sample size. This is interesting because a third-party evaluation commissioned by Anthropic showed a 0.00% prompt injection attack success rate for Opus 5 in Auto Mode. Auto Mode Is Now the Default in Claude Code Auto Mode replaces human approval prompts with a safety classifier. Since mid-August it is the default starting mode for Claude Code.  ( 8 min )

  • Open

    Democratizing FinOps with Wiz: Driving Cost Attribution with the Wiz Service Catalog
    How the Wiz Cloud Cost automates cost allocation to power developer-led cost optimization and connect cost to business value.  ( 56 min )
    The State of Cloud Risk 2026: Most Security Findings Aren’t Real Attacker Opportunities
    Wiz Research telemetry reveals why the majority of high-severity findings lack a path to compromise  ( 53 min )

  • Open

    A GUID is Not a Credential: Unauthenticated RCE in Veeam Service Provider Console
    Two critical vulnerabilities in Veeam Service Provider Console chain into unauthenticated remote code execution on the management server sitting above every tenant's backups. Bishop Fox confirmed the full chain end to end, breaks down both root causes, and shares a safe detection tool and IOCs.  ( 18 min )

  • Open

    VMs won't contain cyber-capable agents
    As part of Patch the Planet, we received preview access to GPT 5.6-Cyber with a simple task: evaluate its cyber capabilities. Recent events inspired me to give it a challenge to work through: escape the VM I’d normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three different times. First, it used recently disclosed bugs in my host kernel. When I fully updated, it used disclosed bugs that had not yet reached package maintainers or were not classified as security bugs. When I rebuilt QEMU and dependencies from the latest upstream source, it found several 0-days. It operated autonomously for hours, backtracked from approaches that didn’t work, pulled code and research papers, wrote oracles, made its own minimal exa…  ( 6 min )

  • Open

    Estate planning of credentials
    A sad start  Last year one of my colleagues, Ken, received the sad news that a father of a friend had passed away. He was a tech-savvy gentleman and had invested in smart tech to make his and his family’s life easier and, just as we recommend, he used strong and unique passwords everywhere. He stored all his passwords in an encrypted Excel spreadsheet… the […] The post Estate planning of credentials   appeared first on Pen Test Partners.  ( 7 min )

  • Open

    How Continuous Pentesting Became Standard Practice at Dow
    A few years ago, Dow's cyber engineering team made the switch from point-in-time pentesting to continuous coverage for their high-value assets. How'd they do it? By partnering with Synack. And keep in mind this was before the recent wave of AI-powered pentesting solutions. Dow was ahead of the curve. The post How Continuous Pentesting Became Standard Practice at Dow appeared first on Synack.  ( 17 min )

  • Open

    What's in a tag name? JavaScript, apparently
    I was on my laptop, as I often am when there's rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with "a-zA-Z", but what about after that? I t  ( 5 min )

  • Open

    State divergence enables unauthorized access
    We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK, that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bridged assets, and asset registries. Our bug affected 82 markers representing live financial assets on mainnet. We found the bug, which affects versions before 1.28.0, in March 2026, and reported it to Provenance on April 1. It was mitigated in PR #2627 (commit c81fd65), which shipped in v1.28.0 on May 1, 2026, and fixed in PR #2734, which shipped in v1.29.0 on June 8, 2026. What is a marker? The marker module is Provenance’s core primitive for fungible tokens. Chain participant…  ( 5 min )

  • Open

    Untitled
    No content preview

  • Open

    Malware development trick 64: PE file bloating and overlay data. Simple C example
    ﷽  ( 5 min )

  • Open

    Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
    Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 30 days of past cases. Analysts now clear most alerts with a single click in Slack.  ( 105 min )
    Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy
    Elastic's InfoSec team runs three agents that read the detection rule's investigation guide and the closure reasons on 30 days of past cases. Analysts now clear most alerts with a single click in Slack.  ( 29 min )

  • Open

    From Mayhem to Atlantis: how AI is changing Capture the Flag and what this means for cybersecurity
    Ten years after DARPA's first all-machine hacking tournament, AI agents are solving live CTF challenges, competing with human teams and pushing cybersecurity toward an AI-vs.-AI future. Read on to discover how this future can affect your cybersecurity.  ( 25 min )

  • Open

    Infrared: How External Researchers Bring Tools into OST
    In this blog, we want to do more than point at a new capability inside OST. We want to show how external researchers can bring their own tools into the platform, using InfraRED as a practical example of what that process can look like from both sides. InfraRED was created by Dominic Penn-Newman, and in this post we cover how the collaboration started, what it takes to turn a promising tool into something OST customers can rely on, and how Dominic experienced the process as the developer. Let’s go. Why Do We Integrate External Projects Into OST? Outflank Security Tooling (OST) is Outflank’s main product: a commercial offering designed to make life easier for red teams. OST brings together 30+ tools, a substantial knowledge base with 15k+ lines of documentation and 40+ hours of video content, Read full post The post Infrared: How External Researchers Bring Tools into OST appeared first on Outflank.  ( 11 min )

  • Open

    One SSID To Rule Them All
    TL;DR  How we ended up here  My colleague Adam Bromiley and I recently tripped over one of those ‘What!?’ findings. We could completely break an IT-OT segmentation without having to do … anything.  We were on an OT-focused engagement, working out of a control room.   We use a risk-averse methodology for these engagements, so we began with passive monitoring and low-risk […] The post One SSID To Rule Them All  appeared first on Pen Test Partners.  ( 8 min )

  • Open

    Malware development trick 63: modifying PE version metadata and icon. Simple C example
    ﷽  ( 6 min )

  • Open

    How a team of entity maintainers monitors, connects and scores entities in Elastic Security
    Inside Elastic Security, background jobs called maintainers each own one piece of every user, host and service record, from building entities out of raw logs to resolving identities and scoring risk.
    How a team of entity maintainers monitors, connects and scores entities in Elastic Security
    Inside Elastic Security, background jobs called maintainers each own one piece of every user, host and service record, from building entities out of raw logs to resolving identities and scoring risk.  ( 36 min )

  • Open

    Update: base64dump.py Version 0.0.31
    More info on this update: “zipdump.py: Metadata Encoding“. base64dump_V0_0_31.zip (http)MD5: E54FFB4F618E47FAA724C9F16CF21E7ASHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D  ( 11 min )

  • Open

    RedNova: From arbitrary file write to command execution using COM in windows
    Imagine a scenario where you are a low-privilege user who can write files as SYSTEM on the filesystem, and you want to abuse that primitive to achieve command execution. On top of that, you want to do it all from a single executable, you drop just one binary and  ( 11 min )

  • Open

    Detecting (Evil) Dylibs
    Attackers are increasingly turning to dylibs to host malicious code, gain stealth, and inherit the trust of legitimate processes. In this blog post, we explore how to statically enumerate dylib dependencies, inspect libraries loaded into running processes, and leverage Endpoint Security to detect, and even block, malicious dylibs at load time.  ( 14 min )

  • Open

    Research Worth Reading - Week 34, 2026
    Another week in AI security news... 🤖 Patterns and problems in multiagent systems \ Anthropic 👍 0 Anthropic gave 45 agents their own machines, a shared forum, and the same goal of finding vulnerabilities across 15 open-source projects, then measured what happened. The coordinating swarm kept finding vulnerabilities at a roughly constant rate and found many issues that independently assigned agents missed. The interesting part is not just that a bigger budget found more bugs. Coordination changed the search strategy. The agents could decide where the interesting work was, specialise, share tooling, peer-review findings, and follow promising paths instead of staying inside a pre-assigned part of the codebase. The two approaches found surprisingly little overlap, so they are complementar…  ( 6 min )

  • Open

    Introducing EchoBench: A Human Calibrated Benchmark for Autonomous Pentesting
    Evaluating Autonomous Pentesting Tools If you have spent any time evaluating autonomous pentesting tools, you have seen the numbers: “A model finds 42 percent of the available issues in this open source repository,” “An agent completes 18 objectives on this benchmark,” “A new harness improves recall by 11 percentage points”, etc. Every one of those The post Introducing EchoBench: A Human Calibrated Benchmark for Autonomous Pentesting appeared first on NetSPI.  ( 23 min )

  • Open

    No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452
    CVE-2026-8452 lets an unauthenticated attacker corrupt memory in Citrix NetScaler's SAML parser with a single request, potentially leading to remote code execution. Bishop Fox breaks down the patch, how to safely verify it across a fleet, and what exploitation actually looks like in the logs.  ( 17 min )

  • Open

    DEFCON 34: Planes, PLCs and 6am runs
    TL;DR  A perfectly normal amount of luggage  On Tuesday 4th August, 5 brave souls set off to the faraway climes of Nevada, bound for DEF CON 34. We had 9 cases of tech with us, a motley assortment of flight simulators, industrial control CTFs and plenty more.  We supported the ICS Village for the first time, reflecting our […] The post DEFCON 34: Planes, PLCs and 6am runs appeared first on Pen Test Partners.  ( 10 min )

  • Open

    Intelligence Insights: August 2026
    Debuts, departures, and danger on the blockchain in this month’s edition of Intelligence Insights.  ( 32 min )

  • Open

    Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
    Malicious versions of the arrayref Rust crate (and others) executed a backdoor at compile time. The campaign's infrastructure overlaps with recent DPRK supply chain attacks, including Mastra and axios.  ( 54 min )

  • Open

    GivEnergy enters administration, batteries expose home networks
    TL;DR  Introduction   In late 2024, we found multiple vulnerabilities in GivEnergy home battery systems that could allow attackers to access customers’ home networks, disrupt battery operation, and potentially violate UK product security regulations.  While GivEnergy updated installer guidance for newer deployments, older installations may still be exposed, with no clear remediation plan communicated to customers. Even before the latest news, this was already […] The post GivEnergy enters administration, batteries expose home networks appeared first on Pen Test Partners.  ( 12 min )

  • Open

    If Apple says your iPhone was targeted by mercenary spyware, treat it like an incident
    Apple's Threat Notifications signal mercenary spyware targeting; learn verification steps, response actions, and layered mobile security defenses for high-risk users.  ( 11 min )
    Back to school: Your students are back. Is your security?
    Learn how to move from summer drift to a security posture built for classroom learning.  ( 7 min )

  • Open

    How Often Should Enterprises Run a Penetration Test?
    Most enterprises should treat annual penetration testing as a baseline, not a complete answer. PCI DSS is the one framework with an explicit annual and change-triggered mandate. SOC 2, the current HIPAA Security Rule, and ISO 27001 all expect testing to follow the organization's own risk assessment and control design, not one fixed calendar date. HHS has proposed an annual HIPAA pentesting requirement, but that rule has not been finalized. Enterprises that combine a formal annual assessment with change-triggered and continuous validation stay ahead of frameworks that were never designed around a single testing frequency. The post How Often Should Enterprises Run a Penetration Test? appeared first on Synack.  ( 25 min )

  • Open

    CTEM 101: Moving From Spreadsheets to Continuous Risk Reduction
    Traditional vulnerability management was built for a smaller, slower problem than most teams face today. This post breaks down CTEM, why it exists, how its five stages work, and what it actually takes to move from a reactive pile of findings to a continuous, prioritized risk reduction program.  ( 9 min )

  • Open

    Jamf After Dark: JNUC
    Kat Garbis and Josh Thornton sit down with Jeff Ovik and Kelsey Dahl to preview JNUC 2026 in Kansas City — new programs, sessions and the after-party.  ( 8 min )

  • Open

    BOFScale: A CDN-Fronted Tailnet from a BOF-PE
    Discover how BOFScale leverages a modified Tailscale daemon compiled as a BOF-PE to seamlessly hide C2 traffic and DERP relays behind CDNs using standard WebSockets. The post BOFScale: A CDN-Fronted Tailnet from a BOF-PE appeared first on NetSPI.  ( 35 min )

  • Open

    AWSHound: An OpenSource AWS OpenGraph Collector
    Daniel Heinsen and I have spent a lot of my time trying to answer one question inside AWS environments, usually in a hurry: “Starting from the access I have right now, where can I actually end up?” That turns out to be a hard question to answer in AWS. iam:SimulatePrincipalPolicy will evaluate one action, against […] The post AWSHound: An OpenSource AWS OpenGraph Collector appeared first on SpecterOps.  ( 27 min )

  • Open

    AI Pentesting Works. Building It Yourself Is the Hard Part.
    AI pentesting works, but building it in-house is the hard part. Synack VP Chris Brown breaks down the reliability, token economics, model dependency and validation costs that come with building versus buying an AI pentesting capability. The post AI Pentesting Works. Building It Yourself Is the Hard Part. appeared first on Synack.  ( 19 min )

  • Open

    Wiz Penetration Test Findings is now GA
    Transform point-in-time pen-tests into continuous exposure management with unified platform combining pen-test findings and real-time cloud context  ( 56 min )

  • Open

    How to Spot and Stop Rogue Device Joins
    Instead of leaving behind recognizable fingerprints from public tooling, adversaries can now generate realistic device names that blend naturally into enterprise environments. This blog explores how that changes Entra ID detection and what are the behavioral signals that still expose these attacks.  ( 56 min )
    Announcing the 2026 Wiz Partner Alliance Award Winners
    Recognizing the partners, integrators, and visionaries driving cloud security transformation, AI risk management, and SOC modernization across AMER, EMEA, and ANZ.  ( 50 min )

  • Open

    Wiz Red Agent Finds Its Way Into Snowflake’s Internal Jira Through a Flaw in a GitHub Copilot–Assisted PR
    Wiz Red Agent independently discovered and exploited a GitHub Actions injection missed by GitHub’s AI review, validated access to sensitive data in Snowflake’s internal Jira, and assessed the blast radius—all without human intervention, five days after the flaw became live.  ( 57 min )
    The Closed Loop Remediation Playbook with Wiz
    Start your path to a self-healing cloud today, with Wiz Workflows now GA and Remediation and Response in public preview.  ( 58 min )

  • Open

    Recovering Encrypted LLM Reasoning Traces
    A few days ago, a paper named “Stealing Reasoning Traces from Proprietary LLM APIs” was published. It describes a simple, yet super elegant way to recover encrypted LLM reasoning traces. Naturally, I had to try it. Background AI labs like OpenAI and Anthropic send reasoning traces back and forth as part of their messaging protocols. However, the actual reasoning text is hidden inside an encrypted, base64-encoded blob.  ( 5 min )

  • Open

    Research Worth Reading - Week 33, 2026
    Ruby gadgets, an AI-found Artifactory hack, and the AI pipeline as both tool and target 💎 Ruby 4.0 Universal RCE Deserialization Gadget Chain - elttam 👍 0 Luke Jahnke published the first universal Ruby RCE deserialization gadget chain back in 2018, and it is great to see him still pushing this research forward. What I find most interesting is what happened after the previous chain was published. Maintainers patched enough gadgets to break that specific chain, but left other pieces untouched. Luke simply reused the surviving gadgets in a new chain. This brings me back to KindaRails2Shell. The patch blocks the file-read stage that gave attackers access to Rails signing secrets, but the dangerous transformation surface used later in the chain was not fully removed. The lesson is importan…  ( 6 min )

  • Open

    Wiz on Wiz: How the Wiz FinOps Team Uses Wiz Cloud Cost
    Powering cost investigation and optimization with deep cloud context  ( 59 min )
    Securing Data in the AI era
    AI is changing the context around data risk, making it critical to understand what’s connected, what’s exposed, and why.  ( 61 min )

  • Open

    Stealing the Artifact – JFrog Artifactory Vulnerability
    Discover how NetSPI uncovered and reported vulnerabilities in JFrog Artifactory that allowed unauthenticated attackers to bypass authentication and steal an arbitrary artifact. The post Stealing the Artifact – JFrog Artifactory Vulnerability appeared first on NetSPI.  ( 26 min )

  • Open

    You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))
    Suddenly, you’re in a room. You look around - oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded. You know the drill - it’s the typical enterprise “please don’t be  ( 15 min )

  • Open

    AI moves faster than your controls. Here’s how to fix it.
    AI tools can accelerate data exposure, compromise software supply chains and trigger risky agentic behavior. Part two of a two-part series.  ( 9 min )

  • Open

    Return of the Cookie Monster
    TL;DR: Cookie protections have made traditional session theft harder, but they do not eliminate the value of an authenticated browser session to adversaries. This post explores enabling the Chrome DevTools Protocol (CDP) inside a running Chromium browser to perform post-ex activities such as browser enumeration, cookie theft, and browser takeover Intro In Dough No! Revisiting […] The post Return of the Cookie Monster appeared first on SpecterOps.  ( 15 min )
    Attack of The Extensions
    TL;DR: Browser extensions can turn Chromium into a persistent foothold. This post introduces a way to silently install extensions turning Chromium browsers into a command and control (C2) platform for persistent cookie theft. Intro This blog is a continuation of Dough No! Revisiting Cookie Theft. In the previous blog, we looked at how Chromium’s Application […] The post Attack of The Extensions appeared first on SpecterOps.  ( 26 min )

  • Open

    How to Investigate GitHub PAT Compromise: Lessons From a Multi-Organization Campaign
    A practical playbook for investigating GitHub token compromise, drawn from Wiz CIRT's response to a coordinated multi-organization campaign.  ( 65 min )
    Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain
    Personal repositories are where corporate secrets quietly escape. Wiz correlates them to your developers, validates the real risk, and drives the fix.  ( 57 min )

  • Open

    The Model Is the Malware | What Four Agentic Intrusions Tell Defenders
    OpenAI, Anthropic and Meta disclosed agents reaching external systems. The tools didn't matter, and that changes the playbook for investigating intrusions.  ( 31 min )

  • Open

    The Model Is the Malware | What Four Agentic Intrusions Tell Defenders
    OpenAI, Anthropic and Meta disclosed agents reaching external systems. The tools didn't matter, and that changes the playbook for investigating intrusions.  ( 31 min )

  • Open

    Research Worth Reading - Week 32, 2026
    AI as a research partner, not a replacement. 🧩 Can AI do novel security research? 👍 0 This is probably the most interesting look I have seen at what AI-assisted security research can actually become. James Kettle does not simply ask a model to find bugs: he breaks his own research process into ideation, evaluation, weaponization and cascading follow-up research, then looks carefully at which parts benefit from AI and which are better handled by deterministic code or a human researcher. One particularly interesting observation is that giving a model more context can actually make it less creative by anchoring it too strongly to known techniques. The resulting HTTP research is good, but the bigger lesson is the methodology for turning AI into a research partner rather than a vulnerabili…  ( 7 min )

  • Open

    Back to school: Is your tech really ready for the classroom?
    You spent the summer getting devices enrolled, updated and compliant. That's the baseline, not the finish line. Learn what it takes to make sure devices are optimized for learning.  ( 7 min )
    Bridging the gap: helping teachers adopt technology with confidence
    Device deployment isn't the finish line. Here's what completes the chain from device-in-hand to technology in confident, everyday use.  ( 8 min )

  • Open

    Blacklight: Illuminating AI Agent Artifacts for Attackers and Defenders
    TL;DR: Blacklight is an open-source security research toolkit for discovering and analyzing AI agent artifacts that reside on endpoints. It helps authorized security teams assess exposure, guide next decisions, and develop detection and hardening guidance. This project used models made available through SpecterOps’ participation in OpenAI’s Trusted Access for Cyber program to support this security […] The post Blacklight: Illuminating AI Agent Artifacts for Attackers and Defenders appeared first on SpecterOps.  ( 24 min )

  • Open

    Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research
    We already know AI can find vulnerabilities. James Kettle, PortSwigger's Director of Research, wanted to answer a harder question: can an autonomous system invent genuinely new attack techniques? To f  ( 5 min )

  • Open

    SAML Vulnerabilities and Attacks: A Practical Guide
    Security Assertion Markup Language (SAML) is a widely deployed standard for Single Sign-On (SSO) in the enterprise, and a recurring source of critical authentication vulnerabilities. If you have ever logged into Salesforce, Workday, an internal admin panel, or a third-party SaaS using your corporate identity, there is a good chance SAML was involved behind the scenes. It is the protocol that lets an Identity Provider (IdP) vouch for who you are, so that dozens of Service Providers (SPs) don't each have to manage passwords. Because SAML sits directly on the authentication path, a single bug in how a Service Provider validates a SAMLResponse can mean full authentication bypass and account takeover, often as any user, including administrators. That makes SAML an attractive target for attacker…  ( 14 min )

  • Open

    The August 2026 Security Update Review
    I’ve successfully survived Hacker Summer Camp, and I have returned with a new outlook on patch density. When even Linus Torvalds says that huge updates are the “new normal”, it’s time to readjust what we consider a true bug apocalypse. This month’s release is thankfully smaller than last months, but still huge by historical standards. Take a break from your regularly scheduled activities as we take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for August 2026 For the first part of the August release, Adobe released five bulletins addressing 51 unique CVEs in Adobe ColdFusion, Commerce, Lightroom Classic, Content Credentials SDK, and Adobe Campaign Classic. Here…

  • Open

    How Trail of Bits helps verify the integrity of your Signal chats
    Every Signal chat starts the same way: the client asks the Signal server for the public key associated with your contact’s phone number. But how do you know the server gave you the right key? A compromised server could provide a false public key, allowing the client to encrypt messages to an attacker rather than the intended recipient. Until now, the only way to detect such malfeasance was to verify safety numbers with your contact in person or over a trusted channel. Signal recently launched an alternative: Automatic Key Verification, a feature that helps validate that your chats are secure without requiring direct safety number comparison. Trail of Bits built and operates one of the three auditors that make this system trustworthy. Our auditor, which is an independent implementation writ…  ( 3 min )

  • Open

    AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers
    Jamf Threat Labs discovers and investigates AmnesiaStealer, a multi-stage Rust-based macOS infostealer spread through a counterfeit GitHub download page that captures the login password, reaches for macOS bypasses Apple has already patched, and can hand the operator live, hidden control of the victim's Chromium browser to steal authenticated sessions.  ( 28 min )

  • Open

    Managed Bug Bounty: Why Provable Coverage Beats Blind Spend
    Most security leaders can report what they spent on bug bounty last year. Far fewer can understand the value being delivered by proving what it actually tested. Open programs show which bugs were reported, not which assets received real, skilled attention. Managed bug bounty closes that gap. Researcher-hour and traffic analytics turn testing depth into evidence you can measure, not an assumption you have to trust, giving you coverage you can hand to a board, an auditor, or a compliance team. The post Managed Bug Bounty: Why Provable Coverage Beats Blind Spend appeared first on Synack.  ( 16 min )

  • Open

    Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898
    Immediate action is advised for all organizations running self-hosted Metabase. A critical, unauthenticated SQL injection vulnerability has been disclosed in Metabase's password reset functionality, and Metabase has confirmed active exploitation in the wild.  ( 7 min )

  • Open

    13 million tool calls: auditing every AI coding agent action with Elastic Agent
    Cursor hooks and Elastic Agent capture every tool call, shell command, file read and MCP request as structured events you can hunt with ES|QL.
    13 million tool calls: auditing every AI coding agent action with Elastic Agent
    Cursor hooks and Elastic Agent capture every tool call, shell command, file read and MCP request as structured events you can hunt with ES|QL.  ( 38 min )

  • Open

    Black Hat USA 2026
    Black Hat USA 2026 highlighted how cybersecurity has fundamentally changed. Here's a peek into what the Jamf team was up to, what we learned, and what we showed at the conference.  ( 11 min )

  • Open

    Inside the Metabase SQLi: Exploited in the Wild
    Reverse engineering GHSA-vwf4-m7j8-wcjf with AI to accelerate defense.  ( 54 min )

  • Open

    Living off the coding agent: Two tales of tunnels and LaunchAgents
    Agent-parented reverse tunnels and LaunchAgents can expose a local admin app to the internet. Endpoint still needs to treat that as high severity even when the activity looks like vibe-coded ops, not confirmed malware.  ( 27 min )
    The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent
    A 40-line CEL integration snapshots .npmrc files every 6 hours to catch cooldown removals. This post walks through the three ways we broke filestream before landing on snapshot semantics.
    The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent
    A 40-line CEL integration snapshots .npmrc files every 6 hours to catch cooldown removals. This post walks through the three ways we broke filestream before landing on snapshot semantics.  ( 41 min )

  • Open

    Breaking the attack chain created by exposed cloud secrets
    TL;DR  A secret is only as safe as the route it takes  Secrets are supposed to let systems authenticate without leaving credentials sitting in plain view. However, a secret still has to be created, stored, retrieved by a workload, used and eventually replaced. Every stage creates another opportunity for it to appear somewhere it shouldn’t.  Cloud service providers offer dedicated tools such […] The post Breaking the attack chain created by exposed cloud secrets  appeared first on Pen Test Partners.  ( 7 min )

  • Open

    CSS:the bomb inside your inbox
    Gareth Heyes - [email protected] - @garethheyes It's quite common for webmail clients to render untrusted CSS in a trusted UI. They attempt to make this safe using CSS sanitization. In this  ( 32 min )

  • Open

    Cloud Threat Highlights: H1 2026
    Cloud and AI threat activity tracked by Wiz Research and CIRT, January through June 2026  ( 63 min )
    Wiz Brings Automated DISA STIG Assessment to Amazon Linux 2023 and Windows Server 2025
    Automating DISA STIG Compliance for Amazon Linux 2023 and Windows Server 2025, giving defense and federal teams immediate and continuous hardening validation.  ( 53 min )

  • Open

    Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
    Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAINDROP, a worm that uses stolen npm credentials to backdoor co-owned packages totaling over 1.3 billion monthly downloads.  ( 14 min )

  • Open

    CRLF-Powered Desync Attacks: Beheading HTTP Streams
    Abstract In this paper we’ll show that HTTP Header Injection is severely underestimated. Forget open redirects or Cross-Site Scripting and instead, embrace the catastrophic potential of the CRLF-Power  ( 20 min )
    Can AI do novel security research? Meet the HTTP Terminator
    Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi  ( 26 min )
    Can AI do novel security research? Meet the HTTP Terminator
    Abstract We all know AI can find bugs. After a decade of research, I asked a harder question: can an autonomous system invent new attack techniques, and use them to hack live websites at scale? Buildi  ( 26 min )

  • Open

    Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1
    TL;DR: This is part 1 of a 2 part blog series sharing what I have discovered in my Windows Service Update Service (WSUS) research. If the WSUS database is configured on a separate server from the upstream WSUS server, we can coerce the WSUS computer account to the WSUS database and establish a SQL session. […] The post Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1 appeared first on SpecterOps.  ( 19 min )
    Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 2
    TL;DR: When WSUS downloads files for updates, it requires the server to leverage the BITS protocol. WSUS normally requires executables to be digitally signed, however this can be bypassed by appending the .esd or .txt file extensions. Introduction In Part 1 of this series, I walked through the necessary stored procedures used to create a […] The post Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 2 appeared first on SpecterOps.  ( 13 min )
    Of Course We Built a WSUS Ludus Lab
    TL;DR: This blog walks you through setting up a WSUS lab using Ludus for testing. The associated GitHub repo is here. Introduction I have been researching the Windows Service Update Service (WSUS) and discovered a new way we could take over the WSUS infrastructure and deploy custom payloads for lateral movement. As part of this […] The post Of Course We Built a WSUS Ludus Lab appeared first on SpecterOps.  ( 12 min )
    Weaponizing Windows Updates with NotWSUSpicious
    TL;DR: NotWSUSpicious is a tool repo to aid in creating custom updates after gaining access to a WSUS database server. The Turning Enterprise Update Servers Into Backdoor Factories (0_o) series covers how the database takeover works. This blog strictly covers how to use the tooling. The series can be found here: Turning Enterprise Update Servers […] The post Weaponizing Windows Updates with NotWSUSpicious appeared first on SpecterOps.  ( 16 min )

  • Open

    AI governance: the missing link in Enterprise security
    AI use in your organization can be a silent threat multiplier. Here's how to ensure your organization's data remains secure. Part one of a three-part series.  ( 7 min )

  • Open

    From DARPA to Black Hat: An SRT Researcher’s Next Chapter
    Synack Red Team researcher Malcolm Stagg takes the stage at Black Hat USA 2026 on August 6 to present three years of independent research on a new class of network infrastructure attacks. Here's who he is and why the talk belongs on your calendar. The post From DARPA to Black Hat: An SRT Researcher’s Next Chapter appeared first on Synack.  ( 15 min )
    Build vs. Buy AI Pentesting: Why Dow Chose to Partner With Synack
    To hear both sides of the build vs buy debate around AI pentesting solutions, we spoke with Dow's cyber engineering team lead Dan Lacher and Synack's CTO Mark Kuhr. From Dow's perspective, Synack served as a force multiplier for a small internal red team. Meanwhile, building the Synack Autonomous Red Agent (Sara) from scratch definitely had some trial and error. The post Build vs. Buy AI Pentesting: Why Dow Chose to Partner With Synack appeared first on Synack.  ( 16 min )

  • Open

    Python Software Foundation - Python 3.11.0a3 to 3.15.0b2
    Bishop Fox discovered a privilege escalation vulnerability in Python for Windows affecting versions 3.11.0a3 through 3.15.0b2. A low-privilege user can plant malicious files and wait for a privileged account to run the interpreter, inheriting that account's elevated access. Patches are available.  ( 14 min )

  • Open

    Borrowing Windows Hello keys for authentication and persistence
    Most research into Windows Hello focuses on the mechanics in use when authenticating to the local device. As an Entra ID researcher, I’ve always been more interested in how these keys are used to authenticate to the cloud. I’ve given several talks on Windows Hello for Business (WHFB for short) and about the many implementation flaws discovered in the process, most of which were fixed by Microsoft. For this blog I want to focus on a technique that was left as-is since it is more or less a consequence of how WHFB works: the ability to perform single-sign on with the backing cryptographic keys from a user session, without needing the PIN or other information/user presence. We will not just look at how we can utilize this to request Primary Refresh Tokens (PRTs), but also how we can use this to perform device registration by using the WHFB key as a FIDO key/passkey.  ( 8 min )

  • Open

    A few notes on AWS Nitro Enclaves: KMS integration
    Nitro Enclaves and Key Management Service (KMS) feel like a natural fit: since the KMS can verify attestation documents generated by the enclaves, developers can offload key management tasks from their applications to the AWS-managed service. But integrating an external service with your trusted enclaves comes with new threats, even if that service comes from the same provider. In this blog post—the third in our series on Nitro Enclaves, following our posts on attack surface and images and attestation—we catalog passive and active attack classes against the enclave-KMS communication channel, and cover the operational risks that persist even when the cryptography is correct. Intro to KMS The KMS is an AWS service that provides a unified public API for creating and managing keys backed by HS…  ( 13 min )

  • Open

    Mythic 4 Public Beta: More Than a New Coat of Paint
    TL;DR: Mythic 4 is now available on the Mythic-v4.0.0 branch and is entering a public beta for the next few months for the community to update their services. Mythic 4 has some breaking changes, new features, AI chat container support, and so much more. Mythic 4 is entering a public beta for the next few […] The post Mythic 4 Public Beta: More Than a New Coat of Paint appeared first on SpecterOps.  ( 17 min )

  • Open

    Fake Zoom installer uses .NET downloader to deliver Overlord RAT on macOS
    Jamf Threat Labs uncovers a macOS campaign using a fake Zoom installer to deploy Overlord RAT. Built with .NET, this cross-platform technique simultaneously targets Windows, joining Go- and Rust-based cross-platform malware.  ( 12 min )

  • Open

    How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
    "It feels like I get 10X the productivity on an engagement. The difference is night and day." Profile Ray Huygen is a Security Analyst at Orange Cyberdefense, a managed security service provider with  ( 6 min )
    Case study: How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
    "It feels like I get 10X the productivity on an engagement. The difference is night and day." Profile Ray H. is a Security Analyst at a managed security service provider with over 2500 employees world  ( 6 min )

  • Open

    Wiz at Black Hat 2026: Driving AI Threat Readiness
    Announcing new capabilities that help organizations prepare for the AI era by expanding visibility and accelerating response, so security teams can defend at machine speed.  ( 59 min )
    keyv and cacheable npm Package Hijacked in Supply Chain Attack
    Wiz Research is actively investigating an ongoing software supply chain attack affecting multiple keyv/cacheable npm packages.  ( 54 min )

  • Open

    Agents vs. agents: how we triage HackerOne reports for $2 each, 85% as well as a human
    LLMs made it cheap to flood bug bounty programs with submissions. Here's how Elastic built an AI triage agent that matches human decisions 85% of the time, including the architecture, threat model and calibration against 3,300 real reports
    Agents vs. agents: how we triage HackerOne reports for $2 each, 85% as well as a human
    LLMs made it cheap to flood bug bounty programs with submissions. Here's how Elastic built an AI triage agent that matches human decisions 85% of the time, including the architecture, threat model and calibration against 3,300 real reports  ( 50 min )

  • Open

    Research Worth Reading - Week 31, 2026
    Reward hacking, shrinking harnesses, LLM-first SAST and agents that cheat. 🤗 Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident 👍 0 Last week, we discussed the OpenAI agent that escaped its sandbox and used an external code-execution environment to attack Hugging Face. Hugging Face has now published the technical timeline: roughly 17600 actions across Kubernetes, cloud infrastructure, internal networks and source control. The link is worth opening for the animation alone. After playing with it, you will never look at an incident report the same way again. The agent did not become evil. It simply found an easier way to complete its objective: steal the benchmark answers instead of solving the benchmark. If you ever needed a clear example of reward…  ( 6 min )

  • Open

    ConfigManBearPig 2.0 – Things Are Getting Cereal
    TL;DR – In the past several years, security researchers have discovered 30+ unique attack techniques targeting Microsoft Configuration Manager (formerly SCCM), as its widespread control of an organization’s devices makes it an appealing target. ConfigManBearPig 2.0 is a Python rewrite of the original PowerShell script that collects data from SCCM to identify the misconfigurations that […] The post ConfigManBearPig 2.0 – Things Are Getting Cereal appeared first on SpecterOps.  ( 11 min )

  • Open

    LLM Heist: Hijacking LiteLLM for Traffic Interception, Key Theft, and Tool-Call Injection
    LiteLLM is a popular AI gateway. It provides a unified interface to LLMs and simplifies governance. It also has access to the backend LLM provider keys. All of that makes it a high-value target. Not only for IP and data theft, but also for response modification and tool invocation. This post walks through a set of TTPs that red teams can integrate into authorized operations to demonstrate rerouting, interception, and modification of LLM traffic. We also cover things defenders can look out for.  ( 8 min )

  • Open

    Introducing the Wiz Sensor for Developer Workstations to Protect Endpoints in the AI Era
    As AI expands who builds software, the developer workstation is becoming a new security perimeter. AI and third-party software increasingly operate with access to your most sensitive credentials and cloud environments.  ( 58 min )

  • Open

    SOC case management and detection rule history in Elastic Security
    Elastic Security now tracks every detection rule change with one-click rollback and makes case data queryable out of the box, so SOC teams get audit trails and reporting without configuring anything.
    Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows
    Public leaderboards can't tell you which LLM to trust in your SOC, so Elastic built an evaluation framework that grades models on the work (tool calls, execution traces, blind judging) across Agent Builder, Attack Discovery, and automatic migration.  ( 43 min )
    SOC case management and detection rule history in Elastic Security
    Elastic Security now tracks every detection rule change with one-click rollback and makes case data queryable out of the box, so SOC teams get audit trails and reporting without configuring anything.

  • Open

    The AI Pentesting Winners May Not Be AI Startups
    AI startups need to solve the last mile of pentest automation. Pentesting boutiques only need to make their humans more productive.  ( 5 min )

  • Open

    RufRoot Exposed the Hidden AI Agent Attack Surface
    The critical RufRoot vulnerability gave unauthenticated attackers a path from an exposed MCP endpoint to shell access, stolen AI provider keys and poisoned agent memory. Paul Mote explains why the incident should change how security teams define, test and recover their AI attack surface. The post RufRoot Exposed the Hidden AI Agent Attack Surface appeared first on Synack.  ( 20 min )

  • Open

    Guest Blog: The Annual Pentest Is No Longer Enough
    Craig Rosewarne, Managing Director of Wolfpack Information Risk, explains why continuous, AI-enabled validation, paired with human-verified exploitability, gives security leaders a real-time view of what's actually at risk. The post Guest Blog: The Annual Pentest Is No Longer Enough appeared first on Synack.  ( 15 min )

  • Open

    Azure Fabric Backdoor With A Twist
    Azure Fabric Backdoor With A Twist  ( 15 min )
    State of the Art of Private Key Security in Blockchain Ops - 4. Approvals and Policies
    State of the Art of Private Key Security in Blockchain Ops - 4. Approvals and Policies  ( 13 min )

  • Open

    A Look at RTEMS Security
    No content preview  ( 7 min )

  • Open

    When Guardrails Aren't Enough: Reinventing Agentic AI Security With Architectural Controls
    David Brauchler III delivers a fascinating Black Hat talk on the root cause of AI-based vulnerabilities and why security architecture is the real solution.  ( 7 min )

  • Open

    MCP Bridge Upgrade
    MCP Bridge Upgrade  ( 7 min )
    Black Hole of Trust: SEO Poisoning in Silver Fox’s Space Odyssey
    Black Hole of Trust: SEO Poisoning in Silver Fox’s Space Odyssey  ( 7 min )

  • Open

    State of the Art of Private Key Security in Blockchain Ops - 3. Private Key Storage and Signing Module
    State of the Art of Private Key Security in Blockchain Ops - 3. Private Key Storage and Signing Module  ( 12 min )

  • Open

    The Symbols of Operation
    The Symbols of Operation code data confusion ada lovelace  ( 6 min )

  • Open

    Public Report: AWS EKS Security Claims
    Public Report: AWS EKS Security Claims  ( 7 min )

  • Open

    Public Report: Google Private AI Compute Review
    Public Report: Google Private AI Compute Review  ( 7 min )

  • Open

    State of the Art of Private Key Security in Blockchain Ops - 2. Common Custody Solutions Architectures
    State of the Art of Private Key Security in Blockchain Ops - 2. Common Custody Solutions Architectures  ( 12 min )
    Legacy Technology in Transport: More Than “Old Tech”
    Legacy Technology in Transport: More Than “Old Tech”  ( 7 min )

  • Open

    Rapid Breach: Social Engineering to Remote Access in 300 Seconds
    No content preview  ( 14 min )
    State of the Art of Private Key Security in Blockchain Ops - 1. Concepts, Types of Wallets and Signing Strategies
    Concepts, Types of Wallets and Signing Strategies  ( 12 min )
    Bridging the Valley of Death
    Bridging the Valley of Death: How Assurance Takes Us from Proof of Concept to Minimum Viable Product  ( 7 min )
    Goal-Based Regulation
    Goal-Based Regulation  ( 7 min )
    Unmasking Techno Sophists
    Unmasking Techno Sophists  ( 6 min )
    Public Report: VetKeys Cryptography Review
    Public Report: VetKeys Cryptography Review  ( 7 min )
    Your point of departure for forensic readiness
    Your point of departure for forensic readiness - Digital Forensics Incident Response  ( 10 min )

  • Open

    Euro 7 Anti-tampering and the Expanding Cybersecurity Landscape
    Euro 7, Anti-tampering, and the Expanding Cybersecurity Landscape  ( 6 min )

  • Open

    Understanding the Impact of Ransomware on Patient Outcomes – Do We Know Enough?
    Discover how ransomware affects patient care, with insights from NCC Group on clinical vulnerabilities and sector trends.  ( 16 min )
    Android-KillPermAndSigChecks
    No content preview  ( 6 min )
    BlackBerry PlayBook Security – Part One
    No content preview  ( 7 min )
    Drupal Vulnerability
    No content preview  ( 8 min )
    Automated enumeration of email filtering solutions
    No content preview  ( 6 min )
    Pairing over BLS12-381, Part 3: Pairing!
    No content preview  ( 13 min )
    Java Web Start File Inclusion via System Properties Override
    This article details a vulnerability in Java Web Start that allows file inclusion through manipulated system properties.  ( 10 min )
    Scenester – A Small Tool for Cross-Platform Web Application
    No content preview  ( 7 min )
    Tool Release – Ghostrings
    No content preview  ( 9 min )
    Tool: WStalker – an easy proxy to support Web API assessments
    No content preview  ( 8 min )
    Technical Advisory – Jitsi Meet Electron – Arbitrary Client Remote Code Execution (CVE-2020-27162)
    No content preview  ( 9 min )
    Tool Release: Blackbox iOS App Analysis with Introspy
    No content preview  ( 7 min )
    Passive Decryption of Ethereum Peer-to-Peer Traffic
    No content preview  ( 10 min )
    Hackproofing Lotus Domino Web Server
    Hackproofing Lotus Domino Web Server  ( 6 min )
    A Survey of Istio’s Network Security Features
    No content preview  ( 24 min )
    Time Trial: Racing Towards Practical Remote Timing Attacks
    No content preview  ( 6 min )
    Technical Advisory – Citrix Access Gateway Command Injection Vulnerability
    Explore how a command injection flaw in Citrix Access Gateway could allow attackers to execute arbitrary system commands.  ( 9 min )
    Principal Mapper (pmapper)
    No content preview  ( 7 min )
    Virtual Access Monitor Multiple SQL Injection Vulnerabilities
    No content preview  ( 6 min )
    General Data Protection Regulation: Knowing your data
    No content preview  ( 7 min )
    Work daily with enforced MFA-protected API access
    No content preview  ( 9 min )
    General Data Protection Regulation – are you ready?
    No content preview  ( 7 min )
    SnapMC skips ransomware, steals data
    No content preview  ( 10 min )
    IP-reputation-snort-rule-generator
    No content preview  ( 6 min )
    IAM user management strategy
    No content preview  ( 9 min )
    Research Blog Test Playground
    No content preview  ( 6 min )
    Public Report – BLST Cryptographic Implementation Review
    No content preview  ( 7 min )
    iOS User Enrollment and Trusted Certificates
    No content preview  ( 11 min )
    Internet of Things Security
    No content preview  ( 7 min )
    In-depth analysis of the new Team9 malware family
    No content preview
    North Korea’s Lazarus: their initial access trade-craft using social media and social engineering
    No content preview  ( 11 min )
    Autochrome
    No content preview  ( 7 min )
    Is this the real life? Is this just fantasy? Caught in a landslide, NoEscape from NCC Group
    No content preview  ( 11 min )
    Improving Software Security through C Language Standards
    No content preview
    MeshyJSON: A TP-Link tdpServer JSON Stack Overflow
    No content preview  ( 30 min )
    How-to: Importing WStalker CSV (and more) into Burp Suite via Import to Sitemap Extension
    No content preview  ( 8 min )
    Crave the Data: Statistics from 1,300 Phishing Campaigns
    No content preview
    Conference Talks – March 2022
    No content preview
    Whitepaper – Weaning the Web off of Session Cookies: Making Digest Authentication Viable
    No content preview
    Technical Advisory – DelTek Vision – Arbitrary SQL Execution (SQLi)
    No content preview
    iSEC Completes TrueCrypt Audit
    No content preview
    LDAPFragger: Bypassing network restrictions using LDAP attributes
    Discover how LDAPFragger uses LDAP attributes to evade network restrictions and exfiltrate data covertly.  ( 15 min )
    Whitepaper – Microcontroller Readback Protection: Bypasses and Defenses
    No content preview
    ISM RAT
    No content preview  ( 11 min )
    The Mobile Application Hacker’s Handbook
    No content preview  ( 6 min )
    Introducing Chuckle and the Importance of SMB Signing
    No content preview  ( 8 min )
    Advanced SQL Injection in SQL Server Applications
    Advanced SQL Injection in SQL Server Applications  ( 6 min )
    IAM user management strategy (part 2)
    No content preview  ( 10 min )
    Cisco ASA series part four: dlmalloc-2.8.x, libdlmalloc, & dlmalloc on Cisco ASA
    No content preview
    Conference Talks – December 2020
    No content preview
    Visualising Firewall Rulesets – Simplifying Firewall Administration and Spotting the Pivot Point
    No content preview
    Xendbg: A Full-Featured Debugger for the Xen Hypervisor
    No content preview
    Writing Secure ASP Scripts
    No content preview
    Whatsupgold Premium Directory traversal
    No content preview
    What the HEC? Security implications of HDMI Ethernet Channel and other related protocols
    No content preview
    whitebox
    No content preview
    Java RMI Registry.bind() Unvalidated Deserialization
    No content preview  ( 6 min )
    Hacking the Extensible Firmware Interface
    No content preview  ( 7 min )
    Premium Practical Law Content Gateway(2)
    No content preview  ( 6 min )
    Technical Advisory: Multiple Vulnerabilities in Kyocera Printers
    No content preview  ( 12 min )
    Modelling Threat Actor Phishing Behaviour
    No content preview  ( 7 min )
    Technical Advisory – Multiple Vulnerabilities in Netgear ProSAFE Plus JGS516PE / GS116Ev2 Switches
    No content preview  ( 19 min )
    Tool Release: PeachFarmer
    No content preview
    Tool Release: A Simple DLL Injection Utility
    No content preview
    Whitepaper – Practical Attacks on Machine Learning Systems
    No content preview
    Tool Release – JWT-Reauth
    No content preview
    Tool Release – ScoutSuite 5.9.0
    No content preview
    The L4m3ne55 of Passw0rds: Notes from the field
    No content preview
    The Paillier Cryptosystem with Applications to Threshold ECDSA
    No content preview
    Technical Advisory: Shell Injection in SourceTree
    No content preview
    Technical Advisory: Administrative Passcode Recovery and Authenticated Remote Buffer Overflow Vulnerabilities in Gigaset DX600A Handset (CVE-2021-25309, CVE-2021-25306)
    No content preview
    Technical Advisory: Heartbleed chained with a Pass-the-Hash attack leads to device compromise on TP-Link C200 IP Camera
    No content preview
    Technical Advisory: Multiple Vulnerabilities in Accellion File Transfer Appliance
    No content preview
    Symantec Backup Exec 2012 – Linux Backup Agent Heap Overflow
    No content preview  ( 7 min )
    Research Insights Volume 9 – Modern Security Vulnerability Discovery
    No content preview
    Symantec Message Filter Unauthenticated verbose software version information disclosure
    No content preview
    Symantec Messaging Gateway Easy CSRF to add a backdoor-administrator (for example)
    No content preview
    Security First Umbrella
    No content preview
    Sharkbot is back in Google Play
    No content preview
    Spy-Pi: Do you trust your laptop docking stations?
    No content preview
    Technical Advisory – playSMS Pre-Authentication Remote Code Execution (CVE-2020-8644)
    No content preview
    Use of Deserialisation in .NET Framework Methods and Classes
    No content preview  ( 7 min )
    log4j-jndi-be-gone: A simple mitigation for CVE-2021-44228
    A practical approach to neutralizing Log4j’s JNDI vulnerability without upgrading the entire library.  ( 12 min )
    WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group
    No content preview  ( 20 min )
    Public Report – Matrix Olm Cryptographic Review
    No content preview  ( 7 min )
    Tool Release – Web3 Decoder Burp Suite Extension
    No content preview  ( 9 min )
    NCC Group Research at Black Hat USA 2022 and DEF CON 30
    No content preview
    Nerve
    No content preview
    POC2021 – Pwning the Windows 10 Kernel with NTFS and WNF Slides
    No content preview
    Technical Advisory: CyberArk EPM Non-paged Pool Buffer Overflow
    No content preview  ( 8 min )
    Shocker
    No content preview  ( 6 min )
    Solaris 11 USB Hub Class descriptor kernel stack overflow
    No content preview  ( 8 min )
    WSMap
    No content preview  ( 6 min )
    Vehicle Emissions and Cyber Security
    No content preview  ( 9 min )
    Threat Modelling Cloud Platform Services by Example: Google Cloud Storage
    No content preview  ( 19 min )
    Lending a hand to the community – Covenant v0.7 Updates
    No content preview
    Memory Gap
    No content preview
    Multiple Buffer Overflows Discovered in AFFLIB
    No content preview
    LibAVCodec AMV Out of Array Write
    No content preview
    McAfee Email and Web Security Appliance Active session tokens of other users are disclosed within the UI
    No content preview
    McAfee Email and Web Security Appliance Arbitrary file download is possible with a crafted URL, when logged in as any user
    No content preview
    Microsoft Zero-Day Vulnerability – OLE2Link – Threat Intelligence and Signatures
    No content preview
    libtalloc: A GDB plugin for analysing the talloc heap
    No content preview
    Analysis of setting cookies for third party websites in different browsers
    No content preview  ( 10 min )
    Writing FreeBSD Kernel Modules in Rust
    No content preview  ( 16 min )
    Introduction to AWS Attribute-Based Access Control
    No content preview  ( 17 min )
    Threats and vulnerabilities within the Maritime and shipping sectors
    No content preview  ( 6 min )
    Comparing AI Against Traditional Static Analysis Tools to Highlight Buffer Overflows
    No content preview  ( 12 min )
    Understanding the insider threat & how to mitigate it
    No content preview  ( 7 min )
    Tool Release: You’ll Never (Ever) Take Me Alive!
    No content preview  ( 7 min )
    Image IO Memory Corruption
    No content preview  ( 6 min )
    Phishing Mitigations: Configuring Microsoft Exchange to Clearly Identify External Emails
    No content preview  ( 10 min )
    Windows IPC Fuzzing Tools
    No content preview  ( 6 min )
    Public Report – Android Cloud Backup/Restore
    No content preview  ( 7 min )
    Flash local-with-filesystem Bypass in navigateToURL
    No content preview  ( 6 min )
    ncccodenavi
    No content preview  ( 7 min )
    Premium Content Gateway
    No content preview  ( 6 min )
    Public Report – Caliptra Security Assessment
    No content preview  ( 8 min )
    Network Attached Security: Attacking a Synology NAS
    No content preview  ( 7 min )
    Technical Advisory – Lenovo ImController Local Privilege Escalation (CVE-2021-3922, CVE-2021-3969)
    No content preview  ( 9 min )
    CVE-2018-8611 Exploiting Windows KTM Part 1/5 – Introduction
    Explore the introduction to exploiting CVE-2018-8611 in Windows Kernel Transaction Manager (KTM) with NCC Group’s expert analysis.  ( 23 min )
    Tool Release – HTTPSignatures: A Burp Suite Extension Implementing HTTP Signatures
    No content preview  ( 12 min )
    An Introduction to Authenticated Encryption
    No content preview  ( 6 min )
    Technical Advisory: Multiple Vulnerabilities in TCPDF
    No content preview  ( 12 min )
    iSEC Engages in TrueCrypt Audit
    No content preview  ( 7 min )
    How we breach network infrastructures and protect them
    No content preview  ( 6 min )
    Conference Talks – March 2020
    No content preview  ( 9 min )
    SysAid Helpdesk stored XSS
    No content preview  ( 6 min )
    Public Report – Google Enterprise API Security Assessment
    No content preview  ( 7 min )
    USB Undermining Security Barriers:further adventures with USB
    No content preview  ( 6 min )
    Impersonating Gamers With GPT-2
    No content preview  ( 19 min )
    Advisory-CraigSBlackie-CVE-2016-9795
    No content preview
    Compromising a Hospital Network for £118 (Plus Postage & Packaging)
    This post reveals how a simulated attack demonstrated the ease of breaching hospital systems using basic resources.  ( 13 min )
    Analyzing Secure AI Design Principles
    No content preview  ( 17 min )
    Introduction to Anti-Fuzzing: A Defence in Depth Aid
    Learn how anti-fuzzing techniques enhance defence-in-depth strategies and protect applications from fuzzing-based vulnerabilities.  ( 13 min )
    Public Report - VeChainThor Galactica Security Assessment
    No content preview  ( 6 min )
    ICS/OT Security & the evolution of the Purdue Model: Integrating Industrial and Business Networks
    No content preview  ( 7 min )
    Research Insights Volume 8 – Hardware Design: FPGA Security Risks
    No content preview  ( 7 min )
    Remote code execution in ImpressPages CMS
    Explore the remote code execution flaw in ImpressPages CMS and learn best practices for vulnerability remediation.  ( 7 min )
    Webinar: SMACK, SKIP-TLS & FREAK SSL/TLS vulnerabilities
    No content preview  ( 6 min )
    White Paper: Cryptopocalypse Reference Paper
    No content preview  ( 7 min )
    Quantum Data Centre of the Future
    No content preview  ( 10 min )
    Research Paper – Recovering deleted data from the Windows registry
    Learn how forensic techniques can recover deleted entries from the Windows Registry for investigation and analysis.  ( 7 min )
    My Hash is My Passport: Understanding Web and Mobile Authentication
    No content preview  ( 7 min )
    Nessus Authenticated Scan – Local Privilege Escalation
    No content preview  ( 6 min )
    Manifest Explorer
    No content preview  ( 7 min )
    Cleaning Up After Cookies
    No content preview  ( 6 min )
    Announcing NCC Group’s Cryptopals Guided Tour!
    No content preview  ( 10 min )
    Tool Release: SSL pinning bypass and other Android tools
    No content preview  ( 7 min )
    Demystifying Multivariate Cryptography
    Discover how multivariate cryptography fits into the future of secure communications and what makes it unique among quantum-safe algorithms.  ( 21 min )
    Cross-Execute Your Linux Binaries, Don’t Cross-Compile Them
    No content preview  ( 11 min )
    SMB hash hijacking & user tracking in MS Outlook
    Understand the mechanics behind SMB hash hijacking and user tracking in MS Outlook. Our advisory covers attack vectors, testing methods, and fixes.  ( 12 min )
    Defending Your Directory: An Expert Guide to Securing Active Directory Against DCSync Attacks
    No content preview  ( 10 min )
    Rustproofing Linux (Part 1/4 Leaking Addresses)
    No content preview  ( 14 min )
    Threat Spotlight – Hydra
    No content preview  ( 12 min )
    Use and enforce Multi-Factor Authentication
    No content preview  ( 9 min )
    Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling (1)
    No content preview  ( 18 min )
    Technical Advisory: Authentication rule bypass
    No content preview  ( 8 min )
    Rust for Security and Correctness in the embedded world
    No content preview  ( 13 min )
    Technical Advisory – OpenOffice.org Multiple Memory Corruption Vulnerabilities
    Discover how attackers could exploit memory handling flaws in OpenOffice.org to compromise system integrity and user safety.  ( 9 min )
    Non-Deterministic Nature of Prompt Injection
    No content preview  ( 9 min )
    Reverse Engineering Coin Hunt World’s Binary Protocol
    No content preview  ( 29 min )
    HITB Phuket 2023 – Exploiting the Lexmark PostScript Stack
    No content preview  ( 7 min )
    In-Depth Technical Analysis of the Bybit Hack
    Explore a detailed breakdown of the Bybit hack, uncovering attack methods, vulnerabilities, and security lessons learned.  ( 15 min )
    iOS MobileSlideShow USB Image Class arbitrary code execution.txt
    No content preview  ( 6 min )
    NCC Group’s 2024 Annual Research Report
    No content preview  ( 7 min )
    Android-SSL-TrustKiller
    No content preview  ( 6 min )
    Symantec Backup Exec 2012 – Backup Exec Utility Stored XSS when adding Groups, Servers and Computers
    No content preview  ( 7 min )
    Whitepaper – XML Schema, DTD, and Entity Attacks: A Compendium of Known Techniques
    Explore known XML-based attack methods including DTD abuse, schema exploits, and entity expansion vulnerabilities.  ( 7 min )
    Public Report – WhatsApp opaque-ke Cryptographic Implementation Review
    No content preview  ( 7 min )
    Violating Database – Enforced Security Mechanisms
    No content preview  ( 7 min )
    Sakula: an adventure in DLL planting
    No content preview  ( 8 min )
    grepify
    No content preview  ( 6 min )
    Public Report – Kubernetes 1.24 Security Audit
    No content preview  ( 7 min )
    Nagios XI Network Monitor Blind SQL Injection
    Nagios XI Network Monitor is vulnerable to blind SQL injection. Learn the impact, exploitation risks, and mitigation steps.  ( 7 min )
    Lumension Device Control Remote Memory Corruption
    No content preview  ( 6 min )
    The ABCs of NFC chip security
    A technical overview of NFC chip vulnerabilities and protection strategies for secure communication.  ( 15 min )
    New Sources of Microsoft Office Metadata – Tool Release MetadataPlus
    No content preview  ( 11 min )
    Exploiting the Sudo Baron Samedit vulnerability (CVE-2021-3156) on VMWare vCenter Server 7.0
    Learn why CVE-2021-3156 poses a threat to VMware vCenter and how to protect your infrastructure from attacks.  ( 30 min )
    Top of the Pops: Three common ransomware entry techniques
    No content preview  ( 9 min )
    Signaturing an Authenticode anomaly with Yara
    Explore how Yara can detect Authenticode timestamp anomalies in PE files and enhance malware analysis.  ( 10 min )
    A glimpse into the shadowy realm of a Chinese APT: detailed analysis of a ShadowPad intrusion
    No content preview  ( 17 min )
    ProxMon
    No content preview  ( 7 min )
    Decoder Improved Burp Suite plugin release part two
    No content preview  ( 9 min )
    Technical Advisory: Ruby on Rails – Possible XSS Vulnerability in ActionView tag helpers (CVE-2022-27777)
    No content preview  ( 9 min )
    Retro Gaming Vulnerability Research: Warcraft 2
    No content preview  ( 18 min )
    RIFT: Detection capabilities for recent F5 BIG-IP/BIG-IQ iControl REST API vulnerabilities CVE-2021-22986
    No content preview  ( 11 min )
    Sifting through the spines: identifying (potential) Cactus ransomware victims
    No content preview  ( 12 min )
    A deeper dive into CVE-2021-39137 – a Golang security bug that Rust would have prevented
    No content preview  ( 12 min )
    A Race to Report a TOCTOU: Analysis of a Bug Collision in Intel SMM
    No content preview  ( 10 min )
    Turla PNG Dropper is back
    No content preview  ( 11 min )
    From ERMAC to Hook: Investigating the technical differences between two Android malware variants
    No content preview  ( 25 min )
    HTTP to MCP Bridge
    No content preview  ( 10 min )
    Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Gzip Extraction (CVE-2020-8260)
    No content preview  ( 10 min )
    A Brief Review of Bitcoin Locking Scripts and Ordinals
    No content preview  ( 16 min )
    The Extended AWS Security Ramp-Up Guide
    No content preview  ( 13 min )
    Technical Advisory – wolfSSL TLS 1.3 Client Man-in-the-Middle Attack (CVE-2020-24613)
    No content preview  ( 8 min )
    Tool Release – Solitude: A privacy analysis tool
    No content preview  ( 9 min )
    Machine Learning for Static Analysis of Malware – Expansion of Research Scope
    No content preview  ( 17 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 9: Adventures with Expert Systems
    No content preview  ( 13 min )
    Fuzzing RTSP to discover an exploitable vulnerability in VLC
    Discover how fuzzing RTSP streams uncovered vulnerabilities in VLC and advanced secure software development.  ( 11 min )
    Tracking a P2P network related to TA505
    No content preview  ( 15 min )
    Ivanti Zero Day – Threat Actors observed leveraging CVE-2021-42278 and CVE-2021-42287 for quick privilege escalation to Domain Admin
    No content preview  ( 8 min )
    Defeating Windows DEP With A Custom ROP Chain
    No content preview  ( 27 min )
    RIFT: F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902 Intelligence
    Insights from honeypot research on F5 TMUI RCE vulnerability. Understand attack patterns and steps to strengthen your security posture.  ( 14 min )
    Hardware & Embedded Systems: A little early effort in security can return a huge payoff
    Discover how early-stage security planning in hardware and embedded systems can dramatically reduce attack surfaces.  ( 12 min )
    NSA & CISA Kubernetes Security Guidance – A Critical Review
    No content preview  ( 16 min )
    Unveiling the Dark Side: A Deep Dive into Active Ransomware Families
    No content preview  ( 15 min )
    Adventures in Xen Exploitation
    No content preview
    Live Incident Blog: June Global Ransomware Outbreak
    No content preview  ( 10 min )
    A brief look at Windows telemetry: CIT aka Customer Interaction Tracker
    A brief look at Windows telemetry: CIT aka Customer Interaction Tracker  ( 24 min )
    DataArmor Full Disk Encryption 3.0.12c – Restricted Environment breakout, Privilege Escalation and Full Disk Decryption
    No content preview
    Cisco IPSec VPN Implementation Group Name Enumeration
    No content preview
    Best practices with BYOD
    No content preview
    Black Hat 2013 – Bluetooth Smart Presentation Available
    No content preview
    Attacking the Windows Kernel (Black Hat Las Vegas 2007)
    No content preview
    A Peek Behind the Great Firewall of Russia
    No content preview
    Back Office Web Administration Authentication Bypass
    No content preview
    Apple CoreAnimation Heap Overflow
    No content preview
    A Simple and Practical Approach to Input Validation
    No content preview
    A Guide to Improving Security Through Infrastructure-as-Code
    No content preview
    Blackbox iOS App Assessments Using idb
    No content preview
    Apple QuickTime Player m4a Processing Buffer Overflow
    No content preview
    Abusing Privileged and Unprivileged Linux Containers
    No content preview
    Blind Security Testing – An Evolutionary Approach
    No content preview
    BlackBerry Link WebDav Server Bound to the BlackBerry VPN Adapter
    No content preview
    Apple Mac OS X ImageIO TIFF Integer Overflow
    No content preview
    Advanced Exploitation of Oracle PL/SQL Flaws
    No content preview
    Broadcasting your attack – DAB security
    No content preview
    Best Practices for the use of Static Code Analysis within a Real-World Secure Development Lifecycle
    No content preview
    A jq255 Elliptic Curve Specification, and a Retrospective
    No content preview
    BAT: a Fast and Small Key Encapsulation Mechanism
    No content preview
    AutoRepeater: Automated HTTP Request Repeating With Burp Suite
    No content preview
    Are you oversharing (in Salesforce)? Our new tool could sniff it out!
    No content preview
    Curve9767 and Fast Signature Verification
    No content preview
    Cisco ASA series part seven: Checkheaps
    No content preview
    Apache Struts Vulnerability
    No content preview
    Automating extraction from malware and recent campaign analysis
    No content preview
    Automated Reverse Engineering of Relationships Between Data Structures in C++ Binaries
    No content preview
    Assessing the security and privacy of Vaccine Passports
    No content preview
    CowCloud
    No content preview
    Content Security Policies Best Practices
    No content preview
    Call Map: A Tool for Navigating Call Graphs in Python
    No content preview
    Approximately 2000 Citrix NetScalers backdoored in mass-exploitation campaign
    No content preview
    Critical Risk Vulnerability in SAP Message Server (Heap Overflow)
    No content preview
    Authorisation
    No content preview
    Android Cloud Backup/Restore
    No content preview
    Cups-filters remote code execution
    No content preview
    Attacking Web Service Security: Message Oriented Madness, XML Worms and Web Service Security Sanity
    No content preview
    Android-OpenDebug
    No content preview
    Azucar
    No content preview
    AssetHook
    No content preview
    Apple OSX/iPhone iOS ImageIO TIFF getBandProcTIFF TileWidth Heap Overflow
    No content preview
    An Introduction to Quantum Computing for Security Professionals
    No content preview
    Common Security Issues in Financially-Oriented Web Applications
    No content preview
    Bypassing Oracle DBMS_ASSERT (in certain situations)
    No content preview
    Berserko: Kerberos Authentication for Burp Suite
    No content preview
    cisco-SNMP-enumeration
    No content preview
    Building Intuition for Lattice-Based Signatures – Part 1: Trapdoor Signatures
    No content preview
    Anti Brute Force Resource Metering
    No content preview
    Cyber Essentials Scheme
    No content preview
    Black Hat USA 2015 presentation: Broadcasting your attack-DAB security
    No content preview
    APT15 is Alive and Strong: An Analysis of RoyalCli and RoyalDNS
    No content preview
    CVE-2017-8570 RTF and the Sisfader RAT
    No content preview
    Compromising Apache Tomcat via JMX access
    No content preview
    Breaking Pedersen Hashes in Practice
    No content preview
    Advice for security decision makers contemplating the value of Antivirus
    No content preview
    Cisco ASA series part one: Intro to the Cisco ASA
    No content preview
    Check out our new Microcorruption challenges!
    No content preview
    Beyond data loss prevention
    No content preview
    Celebrating NCC Con Europe 2018
    No content preview
    Building an RDP Credential Catcher for Threat Intelligence
    No content preview
    Buffer Underruns, DEP, ASLR and improving the Exploitation Prevention Mechanisms (XPMs) on the Windows platform
    No content preview
    Cyber Security of New Space Paper
    No content preview
    Breaking into Security Research at NCC Group
    No content preview
    Assuring Your DDoS Defences
    No content preview
    Critical Risk Vulnerability in Ingres (Pointer Overwrite 2)
    No content preview
    creep-web-app-scanner
    No content preview
    C Language Standards Update – Zero-size Reallocations are Undefined Behavior
    No content preview
    Creating a Safer OAuth User Experience
    No content preview
    Conference Talks – November 2020
    No content preview
    Climbing Mount Everest: Black-Byte Bytes Back?
    No content preview
    CertPortal: Building Self-Service Secure S/MIME Provisioning Portal
    No content preview
    D-LINK DIR-850L web admin interface vulnerable to stack-based buffer overflow
    No content preview
    Conference Talks – November 2021
    No content preview
    Conference Talks – June 2022
    No content preview
    Command Injection in XML Signatures and Encryption
    No content preview
    Cisco VPN Client Privilege Escalation
    No content preview
    Bypassing Android’s Network Security Configuration
    No content preview
    Batten down the hatches: Cyber threats facing DP operations
    No content preview
    Archived Technical Advisories
    No content preview
    Conference Talks – October 2021
    No content preview
    Building WiMap the Wi-Fi Mapping Drone
    No content preview
    ASP.NET Security and the Importance of KB2698981 in Cloud Environments Threat Brief
    No content preview
    Data-mining with SQL Injection and Inference
    No content preview
    Critical Risk Vulnerability in SAP DB Web Server (Stack Overflow)
    No content preview
    Conti-nuation: methods and techniques observed in operations post the leaks
    No content preview
    AWS environment security assessment with Scout2
    No content preview
    Conference Talks – September 2020
    No content preview
    ASP.NET Security and the Importance of KB2698981 in Cloud Environments
    No content preview
    Announcing NCC Group’s Cryptopals Guided Tour: Set 2
    No content preview
    Adversarial Machine Learning: Approaches & defences
    No content preview
    Dancing Offbit: The Story of a Single Character Typo that Broke a ChaCha-Based PRNG
    No content preview
    Cracking RDP NLA Supplied Credentials for Threat Intelligence
    No content preview
    Build Your Own Wi-Fi Mapping Drone Capability
    No content preview
    D-Link routers vulnerable to Remote Code Execution (RCE)
    No content preview
    Cracking Random Number Generators using Machine Learning – Part 2: Mersenne Twister
    No content preview
    Cisco ASA series part six: Cisco ASA mempools
    No content preview
    Business Insights: Cyber Security in the Financial Sector
    No content preview
    CMakerer: A small tool to aid CLion’s indexing
    No content preview
    CloudWatch: Amazon Web Services & Shellshock
    No content preview
    Black Hat 2013 – Cryptopocalypse Presentation Available
    No content preview
    Cracking Random Number Generators using Machine Learning – Part 1: xorshift128
    No content preview
    Conference Talks – September/October 2022
    No content preview
    Cisco ASA series part two: Static analysis & datamining of Cisco ASA firmware
    No content preview
    Application Layer Attacks – The New DDoS Battleground
    No content preview
    Deception Engineering: exploring the use of Windows Installer Packages against first stage payloads
    No content preview
    DDoS Common Approaches and Failings
    No content preview
    Assessing Unikernel Security
    No content preview
    Code Patterns for API Authorization: Designing for Security
    No content preview
    Blind Return Oriented Programming
    No content preview
    BlackBerry PlayBook Security – Part Two – BlackBerry Bridge
    No content preview
    Conference Talks – June 2021
    No content preview
    BlackHat Asia USB Physical Access
    No content preview
    AtHoc Toolbar
    No content preview
    dotnetpaddingoracle
    No content preview
    Do not use your AWS root account
    No content preview
    Demystifying Cobalt Strike’s “make_token” Command
    No content preview
    Abusing Blu-ray Players Part 1 – Sandbox Escapes
    No content preview
    DARPA OnStar Vulnerability Analysis
    No content preview
    Cloud Security Presentation
    No content preview
    Cisco ASA series part five: libptmalloc gdb plugin
    No content preview
    eBook: Breach notification under GDPR – How to communicate a personal data breach
    No content preview
    Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server
    No content preview
    Attacks on SSL
    No content preview
    ASE 12.5.1 datatype overflow
    No content preview
    Detecting anomalous Vectored Exception Handlers on Windows
    No content preview
    Cyber Security in UK Agriculture
    No content preview
    Conference Talks – May 2021
    No content preview
    DECTbeacon
    No content preview
    Dangling Cursor Snarfing: A New Class of Attack in Oracle
    No content preview
    Conference Talks – October 2020
    No content preview
    CyberVillainsCA
    No content preview
    CVE-2018-8611 – Diving into the Windows Kernel Transaction Manager (KTM) for fun and exploitation
    No content preview
    Cross Site Request Forgery: An Introduction to a Common Web Application Weakness
    No content preview
    Common Insecure Practices with Configuring and Extending Salesforce
    No content preview
    Browser Extension Password Managers
    No content preview
    Cranim: A Toolkit for Cryptographic Visualization
    No content preview
    Black Hat Europe 2013 Andy Davis: To dock or not to dock…
    No content preview
    Creating Arbitrary Shellcode In Unicode Expanded Strings
    No content preview
    CECSTeR
    No content preview
    Building Intuition for Lattice-Based Signatures – Part 2: Fiat-Shamir with Aborts
    No content preview
    eBook – Do you know how your organisation would react in a real-world attack scenario?
    No content preview
    Database Security: A Christmas Carol
    No content preview
    Analysing a recent Poison Ivy sample
    No content preview
    Eurocrypt 2023: Death of a KEM
    No content preview
    Decoder Improved Burp Suite plugin release part one
    No content preview
    Exploiting CVE-2015-2426, and How I Ported it to a Recent Windows 8.1 64-bit
    No content preview
    End-of-life pragmatism
    No content preview
    Demystifying AWS’ AssumeRole and sts:ExternalId
    No content preview
    Public Report – AWS Nitro System API & Security Claims Italian
    No content preview  ( 7 min )
    The Browser Hacker’s Handbook
    No content preview  ( 6 min )
    My name is Matt – My voice is my password
    No content preview  ( 7 min )
    NCC Group’s Jeremy Boone recognized for Highest Quality and Most Eligible Reports through the Intel Circuit Breaker program
    No content preview  ( 7 min )
    Technical Advisory: Multiple Vulnerabilities in Brother Printers
    No content preview  ( 9 min )
    Developing Secure Mobile Applications for Android
    No content preview  ( 6 min )
    Revealing Embedded Fingerprints: Deriving Intelligence from USB Stack Interactions 2013
    No content preview  ( 7 min )
    Technical Advisory – Linksys WRT160NL – Authenticated Remote Buffer Overflow (CVE-2020-26561)
    No content preview  ( 7 min )
    CERT Oracle Secure Coding Standard for Java
    No content preview  ( 6 min )
    Public Report – Zcash FROST Security Assessment
    No content preview  ( 6 min )
    osquery Application Security Assessment Public Report
    No content preview  ( 6 min )
    Applying normalised compression distance for architecture classification
    No content preview  ( 7 min )
    The disadvantages of a blacklist-based approach to input validation
    No content preview  ( 7 min )
    SecureCookies
    No content preview  ( 6 min )
    The CIS Security Standard for Docker available now
    No content preview  ( 8 min )
    Welcome to the new NCC Group Global Research blog
    No content preview  ( 6 min )
    Nagios XI Network Monitor – OS Command Injection
    No content preview  ( 7 min )
    Grepify – a Small Tool for Code Reviewers
    No content preview  ( 7 min )
    Tool Release: SSLyze v 0.9 released – Heartbleed edition
    No content preview  ( 7 min )
    The why behind web application penetration test prerequisites
    NCC Group explains why pen test prerequisites are essential for accurate, efficient, and secure web application assessments.  ( 7 min )
    Tool Release: iOS Secure State Preservation
    No content preview  ( 7 min )
    Technical Advisory: Gaining root access on Sumpple S610 IP Camera via Telnet; and Unprotected client and server data transmission between Android and IOS clients
    No content preview  ( 9 min )
    SOC maturity & capability
    No content preview  ( 7 min )
    Intent Fuzzer
    No content preview  ( 7 min )
    Freddy: An extension for automatically identifying deserialisation issues in Java and .NET applications
    No content preview  ( 7 min )
    Non-stack Based Exploitation of Buffer Overrun Vulnerabilities on Windows NT 2000 XP
    No content preview  ( 6 min )
    Public Report – go-cose Security Assessment
    No content preview  ( 7 min )
    The Shellcoder’s Handbook: Discovering and Exploiting Security Holes, 2nd Edition
    No content preview  ( 7 min )
    Low Cost Attacks on Smart Cards – The Electromagnetic Side-Channel
    No content preview  ( 7 min )
    Securing the continuous integration process
    No content preview  ( 7 min )
    Technical Advisory – New York State Excelsior Pass Vaccine Passport Credential Forgery
    No content preview  ( 8 min )
    E-mail Spoofing and CDONTS.NEWMAIL
    E-mail Spoofing and CDONTS.NEWMAIL  ( 7 min )
    Technical Advisory: SQL Injection and Reflected Cross-Site Scripting (XSS) Vulnerabilities in Oracle Communications Diameter Signaling Router (CVE-2020-14787, CVE-2020-14788)
    No content preview  ( 8 min )
    Payment Card Industry Data Security Standard (PCI DSS) A Navigation and Explanation of Changes from v2.0 to v3.0
    No content preview  ( 6 min )
    Symantec Message Filter Session Hijacking via session
    No content preview  ( 6 min )
    Slotting Security into Corporate Development
    No content preview  ( 7 min )
    Forensic Readiness in Container Environments
    No content preview  ( 10 min )
    Public Report – Solana Program Library ZK-Token Security Assessment
    No content preview  ( 7 min )
    Public Report – Keyfork Implementation Review
    No content preview  ( 7 min )
    They Ought to Know Better: Exploiting Security Gateways via their Web Interfaces
    No content preview  ( 6 min )
    Technical Advisory – KwikTag Web Admin Authentication Bypass
    No content preview  ( 8 min )
    SysPWN – VR for Pwn2Own
    No content preview  ( 7 min )
    Oracle 11g TNS listener remote Invalid Pointer Read
    No content preview  ( 6 min )
    Chainspotting 2: The Unofficial Sequel to the 2018 Talk "Chainspotting" - OffensiveCon 2025
    No content preview  ( 7 min )
    Secure Application Development on Facebook
    No content preview  ( 6 min )
    From CSV to CMD to qwerty
    No content preview  ( 11 min )
    Writing Exploits for Win32 Systems from Scratch
    No content preview  ( 54 min )
    Technical Advisory – Multiple vulnerabilities in Nuki smart locks (CVE-2022-32509, CVE-2022-32504, CVE-2022-32502, CVE-2022-32507, CVE-2022-32503, CVE-2022-32510, CVE-2022-32506, CVE-2022-32508, CVE-2022-32505)
    Learn about multiple CVEs affecting Nuki Smart Locks and how to mitigate security risks for connected home devices.  ( 21 min )
    LTair:  The LTE Air Interface Tool
    No content preview  ( 11 min )
    WebLogic Plugin HTTP Injection via Encoded URLs
    This technical advisory details how encoded URLs can be used to inject malicious HTTP headers in Oracle WebLogic Plug-in environments.  ( 12 min )
    The Sorry State of Aftermarket Head Unit Security
    No content preview  ( 16 min )
    Making New Connections – Leveraging Cisco AnyConnect Client to Drop and Run Payloads
    No content preview  ( 12 min )
    The Challenges of Fuzzing 5G Protocols
    No content preview  ( 16 min )
    Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Arbitrary File Deletion
    No content preview  ( 10 min )
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 8: Development of Prototype #4 – Building on Takaesu’s Approach with Focus on XSS
    No content preview  ( 10 min )
    Avoiding Pitfalls Developing with Electron
    No content preview  ( 11 min )
    Public Report - Google Confidential Space Security Assessment
    No content preview
    Zcash Cryptography and Code Review
    No content preview
    Mallory: Transparent TCP and UDP Proxy
    No content preview
    GSM/GPRS Traffic Interception for Penetration Testing Engagements
    No content preview
    CERT C Secure Coding Standard
    No content preview
    TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access
    No content preview
    Third party assurance
    No content preview
    WSSiP: A Websocket Manipulation Proxy
    No content preview
    5 MCP Security Tips
    No content preview
    Symantec Messaging Gateway SSH with backdoor user account + privilege escalation to root due to very old Kernel
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Juplink RX4-1800 WiFi Router (CVE-2022-37413, CVE-2022-37414)
    No content preview
    Xen SMEP (and SMAP) Bypass
    No content preview
    NCC Group’s Exploit Development Capability: Why and What
    No content preview
    Technical Advisory: Nexpose Hard‐coded Java Key Store Passphrase Allows Decryption of Stored Credentials
    No content preview
    VMware Workstation Guest-to-Host Escape Exploit Development
    No content preview
    Conference Talks – December 2021
    No content preview
    Public Report – VPN by Google One: Technical Security & Privacy Assessment
    No content preview
    Multiple Shell Metacharacter Injections in AFFLIB
    No content preview
    Tool Release – Collaborator++
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Nagios XI
    No content preview
    Weak Passwords Led to (SafePay) Ransomware…Yet Again
    No content preview
    Thin Clients: Slim Security
    No content preview
    Tor Browser Research Report Released
    No content preview
    Testing Two-Factor Authentication
    No content preview
    Defending Your Directory: An Expert Guide to Fortifying Active Directory Against LDAP Injection Threats
    No content preview
    WebSense content filter bypass when deployed in conjunction with Cisco filtering devices
    No content preview
    Public Report – Lantern and Replica Security Assessment
    No content preview
    Technical Advisory: Bypassing Workflows Protection Mechanisms – Remote Code Execution on SharePoint
    No content preview
    Constant-Time Data Processing At a Secret Offset, Privacy and QUIC
    No content preview
    The Pentesters Guide to Akamai
    No content preview
    Tool Release – ScoutSuite 5.12.0
    No content preview
    Cisco ASA series part three: Debugging Cisco ASA firmware
    No content preview
    SQL Server Security
    No content preview
    CVE-2018-8611 Exploiting Windows KTM Part 4/5 – From race win to kernel read and write primitive
    No content preview
    Blind Exploitation of Stack Overflow Vulnerabilities
    No content preview
    Public Report: WhatsApp Contacts Security Assessment
    No content preview
    Technical Advisory – Nullsoft Scriptable Installer System (NSIS) – Insecure Temporary Directory Usage
    No content preview
    Technical Advisory – HTC IQRD Android Permission Leakage
    No content preview
    CVE-2018-8611 Exploiting Windows KTM Part 3/5 – Triggering the race condition and debugging tricks
    No content preview
    Technical Advisory: Xiaomi 13 Pro Code Execution via GetApps DOM Cross-Site Scripting (XSS)
    No content preview
    Detecting and Hunting for the Malicious NetFilter Driver
    No content preview
    Shaking The Foundation of An Online Collaboration Tool: Microsoft 365 Top 5 Attacks vs the CIS Microsoft 365 Foundation Benchmark
    No content preview
    Multiple Vulnerabilities in MailEnable
    No content preview
    The Dark Side: How Threat Actors Leverage AnyDesk for Malicious Activities
    No content preview
    PMKID Attacks: Debunking the 802.11r Myth
    No content preview
    Technical Advisory – Arbitrary Signature Forgery in Stark Bank ECDSA Libraries (CVE-2021-43572, CVE-2021-43570, CVE-2021-43569, CVE-2021-43568, CVE-2021-43571)
    No content preview
    Zulu
    No content preview
    FPGAs: Security Through Obscurity?
    No content preview
    Auditing K3s Clusters
    No content preview
    Oracle Forensics Part 1: Dissecting the Redo Logs
    No content preview
    Supply Chain Security Begins with Secure Software Development
    No content preview
    There’s Another Hole In Your SoC: Unisoc ROM Vulnerabilities
    No content preview
    Technical Advisory: containerd – containerd-shim API Exposed to Host Network Containers (CVE-2020-15257)
    No content preview
    Post-exploiting a compromised etcd – Full control over the cluster and its nodes
    No content preview
    Technical Advisory – ParcelTrack sends all pasteboard data to ParcelTrack’s servers on startup
    No content preview
    earlyremoval, in the Conservatory, with the Wrench: Exploring Ghidra’s decompiler internals to make automatic P-Code analysis scripts
    No content preview
    iOS Application Security: The Definitive Guide for Hackers and Developers
    No content preview
    Stopping Automated Attack Tools
    No content preview
    VoIP Security Methodology and Results
    No content preview
    Secure Coding Rules for Java LiveLessons, Part 1
    No content preview
    Machine Learning 101: The Integrity of Image (Mis)Classification?
    No content preview
    Defending Your Directory: An Expert Guide to Mitigating Pass-the-Hash Attacks in Active Directory
    No content preview
    Wubes: Leveraging the Windows 10 Sandbox for Arbitrary Processes
    No content preview
    44Con2013Game
    No content preview
    Tool Update – ruby-trace: A Low-Level Tracer for Ruby
    No content preview
    Technical Advisory: Multiple Vulnerabilities in Ricoh Printers
    No content preview
    Real World Cryptography Conference 2023 – Part I
    No content preview
    Technical Advisory: Unauthenticated SQL Injection in Lansweeper
    No content preview
    Tis the Season to Be…
    No content preview
    U plug, we play
    No content preview
    White Paper: An Introduction to Authenticated Encryption
    No content preview
    Technical Advisory: Espressif Systems - ESP32 BluFi Reference Application Vulnerabilities
    No content preview
    Public Report – WhatsApp Auditable Key Directory (AKD) Implementation Review
    No content preview
    Public Report – Qredo Apache Milagro MPC Cryptographic Assessment
    No content preview
    SecureBigIP
    No content preview
    AWS Inventory: A tool for mapping AWS resources
    No content preview
    Public Report – Aleo snarkVM Implementation Review
    No content preview
    Public Report – Pixel 4/4XL and Pixel 4a ioXt Audit
    No content preview
    Tool Release – ScoutSuite 5.11.0
    No content preview
    Rise of the Sensors: Securing LoRaWAN Networks
    No content preview
    Local network compromise despite good patching
    No content preview
    The Next C Language Standard (C23)
    No content preview
    On Almost Signing Android Builds
    No content preview
    Username enumeration techniques and their value
    No content preview
    SETTLERS OF NETLINK: Exploiting a limited UAF in nf_tables (CVE-2022-32250)
    No content preview
    Technical Advisory: PDFTron JavaScript URLs Allowed in WebViewer UI (CVE-2021-39307)
    No content preview
    Public Report – AWS Nitro System API & Security Claims
    No content preview
    Tool – Windows Executable Memory Page Delta Reporter
    No content preview
    Tool Release: Code Query (cq)
    No content preview
    Embedded Device Security Certifications
    No content preview
    Technical Advisory: Cross-Site Scripting in Umbraco Rich Text Display
    No content preview
    Private sector cyber resilience and the role of data diodes
    No content preview
    Python Class Informer: an IDAPython plugin for viewing run-time type information (RTTI)
    No content preview
    Exploiting MS15-061 Use-After-Free Windows Kernel Vulnerability
    No content preview
    Public Report: eBPF Verifier Code Review
    No content preview
    The factoring dead: Preparing for the cryptopocalypse
    No content preview
    Adobe flash sandbox bypass to navigate to local drives
    No content preview
    Handy guide to a new Fivehands ransomware variant
    No content preview
    BrokenPrint: A Netgear stack overflow
    No content preview
    Streamlining Global Automotive Cybersecurity Governance to Accelerate Innovation, Assurance, and Compliance
    No content preview
    Using AWS and Azure for Cost Effective Log Ingestion with Data Processing Pipelines for SIEMs
    No content preview
    Blue Coat BCAAA Remote Code Execution Vulnerability
    No content preview
    Public Report – O(1) Labs Mina Client SDK, Signature Library and Base Components Cryptography and Implementation Review
    No content preview
    Technical Advisory – Shop app sends pasteboard data to Shopify’s servers
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Unauthenticated Stored XSS
    No content preview
    The Case of Missing File Extensions
    No content preview
    eBPF Adventures: Fiddling with the Linux Kernel and Unix Domain Sockets
    No content preview
    House
    No content preview
    TPM Genie
    No content preview
    Using graph databases to assess the security of thingernets based on the thingabilities and thingertivity of things
    No content preview
    Building Systems from Commercial Components
    No content preview
    Detecting and Protecting when Remote Desktop Protocol (RDP) is open to the Internet
    No content preview
    Unauthenticated XML eXternal Entity (XXE) vulnerability
    No content preview
    An Engineer’s View: Operational Technology
    No content preview
    NCLoader
    No content preview
    Treat your points as cash
    No content preview
    SysAid Helpdesk Pro – Blind SQL Injection
    No content preview
    There’s A Hole In Your SoC: Glitching The MediaTek BootROM
    No content preview
    Disabling Office Macros to Reduce Malware Infections
    No content preview
    Android Malware Vultur Expands Its Wingspan
    No content preview
    Technical Advisory – VMware Tools Multiple Vulnerabilities
    No content preview
    Building Security In: Software Penetration Testing
    No content preview
    A Census of Deployed Pulse Connect Secure (PCS) Versions
    No content preview
    Public Report – AWS Nitro System API & Security Claims Spanish
    No content preview
    Technical Advisory: Reflected Cross-Site Scripting (XSS) vulnerability in Jenkins Delivery Pipeline plugin
    No content preview
    Windows Phone 7 Application Security Survey
    No content preview
    Shining the Light on Black Basta
    No content preview
    Popping Blisters for research: An overview of past payloads and exploring recent developments
    No content preview
    Tool Release – Project Kubescout: Adding Kubernetes Support to Scout Suite
    No content preview
    Technical Advisory: SMB Hash Hijacking and User Tracking in MS Outlook
    No content preview
    Tattler
    No content preview
    Technical Advisory – Multiple Vulnerabilities in PandoraFMS Enterprise
    No content preview
    Public Report – Protocol Labs Groth16 Proof Aggregation: Cryptography and Implementation Review
    No content preview
    Technical Advisory – Kwikset/Weiser BLE Proximity Authentication in Kevo Smart Locks Vulnerable to Relay Attacks
    No content preview
    iSEC’s Analysis of Microsoft’s SDL and its ROI
    No content preview
    Social Engineering Penetration Testing
    No content preview
    Public Report – WhatsApp End-to-End Encrypted Backups Security Assessment
    No content preview
    Unmasking Lorenz Ransomware: A Dive into Recent Tactics, Techniques and Procedures
    No content preview
    Autonomous AI Agents: A hidden Risk in Insecure smolagents “CodeAgent” Usage
    No content preview
    Tool Release – insject: A Linux Namespace Injector
    No content preview
    Past, Present and Future of Effective C
    No content preview
    Technical Advisory: Insufficient Proxyman HelperTool XPC Validation
    No content preview
    Technical Advisory: Pulse Connect Secure – RCE via Uncontrolled Archive Extraction – CVE-2021-22937 (Patch Bypass)
    No content preview
    Tool Release – Socks Over RDP
    No content preview
    HDMI – Hacking Displays Made Interesting
    No content preview
    Trusted Gateway
    No content preview
    Windows 2000 Format String Vulnerabilities
    No content preview
    Whitepaper – HTTP Digest Integrity: Another look, in light of recent attacks
    No content preview
    Technical Advisory: Bypassing Microsoft XOML Workflows Protection Mechanisms using Deserialisation of Untrusted Data
    No content preview
    Zcash Overwinter Consensus and Sapling Cryptography Review
    No content preview
    Mallory and Me: Setting up a Mobile Mallory Gateway
    No content preview
    Tool Release – Enumerating Docker Registries with go-pillage-registries
    No content preview
    CVE-2018-8611 Exploiting Windows KTM Part 2/5 – Patch analysis and basic triggering
    No content preview
    Open Banking: Security considerations & potential risks
    No content preview
    Windows DACL Enum Project
    No content preview
    Analyzing Secure AI Architectures
    No content preview
    Shooting Yourself in the .flags – Jailbreaking the Sonos Era 100
    No content preview
    Tool Release: Cartographer
    No content preview
    Tool Release: Code Credential Scanner (ccs)
    No content preview
    Whitepaper – Hardware-Backed Heist: Extracting ECDSA Keys from Qualcomm’s TrustZone
    No content preview
    Proxying PyRIT for fun and profit
    No content preview
    NCC Group’s 2022 & 2023 Research Report
    No content preview
    Research Insights Volume 3 – How are we breaking in: Mobile Security
    No content preview
    The Update Framework (TUF) Security Assessment
    No content preview
    TLSPretense — SSL/TLS Client Testing Framework
    No content preview
    Real World Cryptography Conference 2024
    No content preview
    The 9 Lives of Bleichenbacher’s CAT: New Cache ATtacks on TLS Implementations
    No content preview
    Tool Release: DIBF Tool Suite
    No content preview
    Writing Small Shellcode
    No content preview
    Public Report – VPN by Google One Security Assessment
    No content preview
    Whitepaper – Double Fetch Vulnerabilities in C and C++
    No content preview
    The CERT® C Coding Standard, Second Edition: 98 Rules for Developing Safe, Reliable, and Secure Systems
    No content preview
    Threat Intelligence: Benefits for the Enterprise
    No content preview
    Online Casino Roulette – A guideline for penetration testers and security researchers
    No content preview
    Aurora Response Recommendations
    No content preview
    Kerberos Resource-Based Constrained Delegation: When an Image Change Leads to a Privilege Escalation
    No content preview
    Professional C Programming LiveLessons, (Video Training) Part I: Writing Robust, Secure, Reliable Code
    No content preview
    Adventures in the land of BumbleBee – a new malicious loader
    No content preview
    Inter-Protocol Exploitation
    No content preview
    Technical Advisory: Multiple Vulnerabilities in Lexmark Printers
    No content preview
    Using SharePoint as a Phishing Platform
    No content preview
    Technical Advisory: Unauthenticated Remote Command Execution through Multiple Vulnerabilities in Virgin Media Hub 3.0
    No content preview
    RomHack – Revving Up: The Journey to Pwn2Own Automotive 2024
    No content preview
    Technical Advisory – Pulse Connect Secure – RCE via Template Injection (CVE-2020-8243)
    No content preview
    The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses
    No content preview
    Nine years of bugs at NCC Group
    No content preview
    Oracle Forensics Part 6: Examining Undo Segments, Flashback and the Oracle Recycle Bin
    No content preview
    Windows 10 USB Mass Storage driver arbitrary code execution in kernel mode
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 10: Efficacy Demonstration, Project Conclusion and Next Steps
    No content preview
    VeChain JavaScript SDK Cryptography and Security Review
    No content preview
    Technical Advisory: Dell SupportAssist Local Privilege Escalation (CVE-2021-21518)
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 2: Going off on a Tangent – AI/ML Applications in Social Engineering
    No content preview
    xcavator
    No content preview
    Reverse engineering and decrypting CyberArk vault credential files
    No content preview
    Phishing Stories
    No content preview
    Technical Advisory: Code Execution by Unsafe Resource Handling in Multiple Microsoft Products
    No content preview
    The Development of a Telco Attack Testing Tool
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Victure WR1200 WiFi Router (CVE-2021-43282, CVE-2021-43283, CVE-2021-43284)
    No content preview
    Technical Advisory – Linksys WRT160NL – Authenticated Command Injection (CVE-2021-25310)
    No content preview
    Trust in the Internet Survey
    No content preview
    The Database Hacker’s Handbook
    No content preview
    Oracle Java Installer Adds a System Path Which is Writable by All
    No content preview
    iSEC reviews SecureDrop
    No content preview
    Tool Release: Magisk Module – Conscrypt Trust User Certs
    No content preview
    Public Report – Security Review of RSA Blind Signatures with Public Metadata
    No content preview
    Technical Advisory – New York State Excelsior Pass Vaccine Passport Scanner App Sends Data to a Third Party not Specified in Privacy Policy
    No content preview
    Technical Advisory: Stored and Reflected XSS Vulnerability in Nagios Log Server (CVE-2021-35478,CVE-2021-35479)
    No content preview
    Tool Release – Winstrument: An Instrumentation Framework for Windows Application Assessments
    No content preview
    Pip3line – The Swiss Army Knife of Byte Manipulation
    No content preview
    Optimizing Pairing-Based Cryptography: Montgomery Multiplication in Assembly
    No content preview
    Toner Deaf – Printing your next persistence (Hexacon 2022)
    No content preview
    Understanding cyber risk management vs uncertainty with confidence in 2017
    No content preview
    Puckungfu 2: Another NETGEAR WAN Command Injection
    No content preview
    Padding the struct: How a compiler optimization can disclose stack memory
    No content preview
    Technical Advisory: Intel Driver Support & Assistance – Local Privilege Escalation
    No content preview
    Wheel of Fortune Outcome Prediction – Taking the Luck out of Gambling
    No content preview
    Masquerade: You Downloaded ScreenConnect not Grok AI!
    No content preview
    Oracle E-Business Suite Pre-Auth SQLi with DBA Privileges
    No content preview
    Tool Release – ICPin, an integrity-check and anti-debug detection pintool
    No content preview
    Fix Bounty
    No content preview
    Samsung Galaxy S24 Pwn2Own Ireland 2024
    No content preview
    Multiple Cisco CSS / ACE Client Certificate and HTTP Header
    No content preview
    NCC Group’s Juan Garrido named to Microsoft’s MSRC Office Security Researcher Leaderboard
    No content preview
    Security of Things: An Implementer’s Guide to Cyber Security for Internet of Things Devices and Beyond
    No content preview
    How Microsoft Office knows a document came from the Internet and might be dangerous
    No content preview
    Technical Advisory – Bomgar Remote Support – Local Privilege Escalation
    No content preview
    Technical Advisory: Mosquitto Broker DoS through a Memory Leak vulnerability
    No content preview
    Trust in the New Internet Survey
    No content preview
    NETGEAR Routers: A Playground for Hackers?
    No content preview
    RIFT: Citrix ADC Vulnerabilities CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 Intelligence
    No content preview
    Voice Impersonation and DeepFake Vishing in Realtime
    No content preview
    Potential false redirection of web site content in Internet in SAP NetWeaver web applications
    No content preview
    Jenkins Plugins and Core Technical Summary Advisory
    No content preview
    Technical Advisory – ICTFAX 7-4 – Indirect Object Reference
    No content preview
    Game Security
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 6: Development of Prototype #2 – Creating a SQLi PoC
    No content preview
    Public Report – Penumbra Labs Decaf377 Implementation and Poseidon Parameter Selection Review
    No content preview
    pySimReader
    No content preview
    Remote Exploitation of Microsoft Office DLL Hijacking (MS15-132) via Browsers
    No content preview
    Samba _netr_ServerPasswordSet Expoitability Analysis
    No content preview
    Bit51 Better Security WP Security Plugin – Unauthenticated Stored XSS to RCE
    No content preview
    The Future of C Code Review
    No content preview
    Whitepaper – Project Triforce: Run AFL On Everything (2017)
    No content preview
    Modernizing Legacy Systems: Software Technologies, Engineering Processes, and Business Practices
    No content preview
    Technical Advisory – Authenticated SQL Injection in SOAP Request in Broadcom CA Network Flow Analysis (CVE-2021-44050)
    No content preview
    State of DNS Rebinding in 2023
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 5: Development of Prototype #1 – Text Processing and Semantic Relationships
    No content preview
    Public Report – Zcash Zebra Security Assessment
    No content preview
    Symantec PC Anywhere Remote Code Extecution
    No content preview
    Technical Advisory – Tesla BLE Phone-as-a-Key Passive Entry Vulnerable to Relay Attacks
    No content preview
    Cisco ASA series part eight: Exploiting the CVE-2016-1287 heap overflow over IKEv1
    No content preview
    Software Verification and Analysis Using Z3
    No content preview
    10 real-world stories of how we’ve compromised CI/CD pipelines
    No content preview
    44CON Workshop – How to assess and secure iOS apps
    No content preview
    Log4Shell: Reconnaissance and post exploitation network detection
    No content preview
    Paradoxical Compression with Verifiable Delay Functions
    No content preview
    Symantec Messaging Gateway – Authenticated arbritary file download
    No content preview
    Technical Advisory: IP Office Stored Cross Site Scripting (XSS) Vulnerability
    No content preview
    BLEBoy
    No content preview
    Technical Advisory: Adobe ColdFusion RMI Registry.bind() Deserialisation RCE
    No content preview
    Choosing the Right MCU for Your Embedded Device — Desired Security Features of Microcontrollers
    No content preview
    Absolute Security
    No content preview
    RM3 – Curiosities of the wildest banking malware
    No content preview
    Sysinternals SDelete: When Secure Delete Fails
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Arbitrary file download is possible with a crafted URL, when logged in as any user
    No content preview
    Order Details Screens and PII
    No content preview
    Technical Advisory – macOS Installer Local Root Privilege Escalation (CVE-2020-9817)
    No content preview
    The facts about BadUSB
    No content preview
    Violating the Virtual Channel – RDP Testing
    No content preview
    Mining data from Cobalt Strike beacons
    No content preview
    Solaris 11 USB hubclass
    No content preview
    USB under the bonnet: Implications of USB security vulnerabilities in vehicle systems
    No content preview
    Multiple security vulnerabilities in SAP NetWeaver BSP Logon
    No content preview
    Whitepaper – A Tour of Curve 25519 in Erlang
    No content preview
    Salesforce Security with Remote Working
    No content preview
    tcpprox
    No content preview
    RIFT: F5 CVE-2020-5902 and Citrix CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 honeypot data release
    No content preview
    Hacking Appliances: Ironic exploits in security products
    No content preview
    Peeling back the layers on defence in depth…knowing your onions
    No content preview
    Technical Advisory – FUJITSU CentricStor Control Center <= V8.1 – Unauthenticated Command Injection ( CVE-2022-31794 and CVE-2022-31795)
    No content preview
    Technical Advisory – Open5GS Stack Buffer Overflow During PFCP Session Establishment on UPF (CVE-2021-41794)
    No content preview
    Tool Release: Redirecting traffic with dnsRedir.py
    No content preview
    Conference Talks – January 2020
    No content preview
    Project Triforce: Run AFL on Everything!
    No content preview
    Announcing the Cryptopals Guided Tour Video 17: Padding Oracles!
    No content preview
    The Demise of Signature Based Antivirus
    No content preview
    Technical Advisory – IBM WebSphere Commerce: Encrypted URL Parameter Vulnerable to Padding Oracle Attacks
    No content preview
    Remote Code Execution on Western Digital PR4100 NAS (CVE-2022-23121)
    No content preview
    Research Insights Volume 2 – Defensive Trends
    No content preview
    Technical advisory: CVE-2017-8592 – XMLHttpRequest in IE followed 307 redirections with additional or customised headers
    No content preview
    Defending Your Directory: An Expert Guide to Fortifying Active Directory Certificate Services (ADCS) Against Exploitation
    No content preview
    Tool Release: YoNTMA
    No content preview
    Sign over Your Hashes – Stealing NetNTLM Hashes via Outlook Signatures
    No content preview
    Secure Coding in C and C++
    No content preview
    Rise of the machines: Machine Learning & its cyber security applications
    No content preview
    RokRat Analysis
    No content preview
    WebRATS
    No content preview
    Rustproofing Linux (Part 4/4 Shared Memory)
    No content preview
    Technical Advisory – Multiple HTML Injection Vulnerabilities in KaiOS Pre-installed Mobile Applications
    No content preview
    Oracle Gridengine sgepasswd Buffer Overflow
    No content preview
    Preparing for Cyber Battleships – Electronic Chart Display and Information System Security
    No content preview
    Technical Advisory: Sonos Era 100 Secure Boot Bypass Through Unchecked setenv() call
    No content preview
    Tool Release – ScoutSuite 5.10
    No content preview
    Windows USB RNDIS driver kernel pool overflow
    No content preview
    Replicating CVEs with KLEE
    No content preview
    Tool Release: Introducing opinel: Scout2’s favorite tool
    No content preview
    vlan-hopping
    No content preview
    Rustproofing Linux (Part 3/4 Integer Overflows)
    No content preview
    Vulnerabilities Found In Geofencing Apps
    No content preview
    WSBang
    No content preview
    YoNTMA
    No content preview
    Technical Advisory – Multiple Vulnerabilities in Trendnet TEW-831DR WiFi Router (CVE-2022-30325, CVE-2022-30326, CVE-2022-30327, CVE-2022-30328, CVE-2022-30329)
    No content preview
    Public Report: XMTP MLS Implementation Review
    No content preview
    Technical advisory: Remote shell commands execution in ttyd
    No content preview
    The Myth of Twelve More Bytes: Security on the Post-Scarcity Internet
    No content preview
    Conference Talks – August 2020
    No content preview
    Tool Release: Sinking U-Boots with Depthcharge
    No content preview
    SmarterMail – Stored XSS in emails
    No content preview
    Microsoft Internet Explorer CMarkup Use-After-Free
    No content preview
    NCC Con Europe 2016
    No content preview
    Squiz CMS File Path Traversal
    No content preview
    Technical advisory: “ROHNP”- key extraction side channel in multiple crypto libraries
    No content preview
    Remote Directory Traversal and File Retrieval
    No content preview
    Security Compliance as an Engineering Discipline
    No content preview
    Testing Infrastructure-as-Code Using Dynamic Tooling
    No content preview
    umap
    No content preview
    Whitepaper – Coinbugs: Enumerating Common Blockchain Implementation-Level Vulnerabilities
    No content preview
    Research Insights Volume 4 – Sector Focus: Maritime Sector
    No content preview
    Ruxcon 2013 – Introspy Presentation Slides
    No content preview
    Symantec Messaging Gateway Out of band stored XSS delivered by email
    No content preview
    HITBAMS – Your Not so “Home” Office – Soho Hacking at Pwn2Own
    No content preview
    Research Insights Volume 5 – Sector Focus: Automotive
    No content preview
    Technical Advisory – Apple macOS XAR – Arbitrary File Write (CVE-2022-22582)
    No content preview
    Understanding Ransomware
    No content preview
    ZigTools: An Open Source 802.15.4 Framework
    No content preview
    Technical Advisory: Adobe ColdFusion Object Deserialisation RCE
    No content preview
    Tool Release – shouganaiyo-loader: A Tool to Force JVM Attaches
    No content preview
    Tool Release: Exploring SSL Pinning on iOS
    No content preview
    TPM Genie: Interposer Attacks Against the Trusted Platform Module Serial Bus
    No content preview
    Threat Actors: exploiting the pandemic
    No content preview
    Sobelow: Static analysis for the Phoenix Framework
    No content preview
    WindowsJobLock
    No content preview
    Getting Shell with XAMLX Files
    No content preview
    Technical Advisory: Mitel MiVoice 5330e Memory Corruption Flaw
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Session hijacking (and bypassing client-side session timeouts)
    No content preview
    SecureCisco
    No content preview
    The SSL Conservatory
    No content preview
    Nagios XI Network Monitor Stored and Reflected XSS
    No content preview
    Toxic Tokens: Using UUIDs for Authorization is Dangerous (even if they’re cryptographically random)
    No content preview
    Mobile World Congress – Mobile Internet of Things
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 4: Architecture and Design
    No content preview
    Social Engineering
    No content preview
    The role of security research in improving cyber security
    No content preview
    Tool Release – ScoutSuite 5.8.0
    No content preview
    How cryptography is used to monitor the spread of COVID-19
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Active session tokens of other users are disclosed within the UI
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Unauthenticated File Upload Path Traversal (CVE-2021-20040)
    No content preview
    USB attacks need physical access right? Not any more…
    No content preview
    Research Insights Volume 6: Common Issues with Environment Breakouts
    No content preview
    Tool Release – Monkey365
    No content preview
    Whitepaper – A Heap of Trouble: Breaking the Linux Kernel SLOB Allocator
    No content preview
    Machine Learning 103: Exploring LLM Code Generation
    No content preview
    Practical SME security on a shoestring
    No content preview
    Ransomware: How vulnerable is your system?
    No content preview
    Logs, Logs, the Audit Trail – Features of a Successful Log Management Solution
    No content preview
    SSLyze v0.8
    No content preview
    Striking Back at Retired Cobalt Strike: A look at a legacy vulnerability
    No content preview
    Tool Release – Principal Mapper v1.1.0 Update
    No content preview
    Microsoft’s SQL Server vs. Oracle’s RDBMS
    No content preview
    NCC Group Research at Black Hat USA 2021 and DEF CON 29
    No content preview
    On Multiplications with Unsaturated Limbs
    No content preview
    Securing PL/SQL Applications with DBMS_ASSERT
    No content preview
    An Adventure in Contingency Debugging: Ruby IO#read/IO#write Considered Harmful
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Password hashes can be recovered from a system backup and easily cracked
    No content preview
    Tales of Windows detection opportunities for an implant framework
    No content preview
    Technical Advisory: Authentication Bypass in libSSH
    No content preview
    Much Ado About Hardware Implants
    No content preview
    New Attack Vectors and a Vulnerability Dissection of MS03-007
    No content preview
    Technical Advisory: Pulse Connect Secure – Arbitrary File Read via Logon Message (CVE-2020-8255)
    No content preview
    Pentesting V. Red Teaming V. Bug Bounty
    No content preview
    Proxy Re-Encryption Protocol: IronCore Public Report
    No content preview
    Tool Release – Socks Over RDP Now Works With Citrix
    No content preview
    Webinar: 4 Secrets to a Robust Incident Response Plan
    No content preview
    Real World Cryptography Conference 2021: A Virtual Experience
    No content preview
    Smart Contracts Inside SGX Enclaves: Common Security Bug Patterns
    No content preview
    Tool Release: Calculating SQL Permissions
    No content preview
    Adobe Acrobat Reader XML Forms Data Format Buffer Overflow
    No content preview
    SecureIE.ActiveX
    No content preview
    Shellshock Advisory
    No content preview
    When a Trusted Site in Internet Explorer was Anything But
    No content preview
    Oracle 11g TNS listener remote Null Pointer Dereference
    No content preview
    Technical Advisory – SonicWall SMA 100 Series – Post-Authentication Remote Command Execution (CVE-2021-20044)
    No content preview
    Technical Advisory – NULL Pointer Derefence in McAfee Drive Encryption (CVE-2021-23893)
    No content preview
    OS X 10.6.6 Camera Raw Library Memory Corruption
    No content preview
    Technical Advisory – NXP i.MX SDP_READ_DISABLE Fuse Bypass (CVE-2022-45163)
    No content preview
    Windows Firewall Hook Enumeration
    No content preview
    Increased exploitation of Oracle GlassFish Server Administration Console Remote Authentication Bypass
    No content preview
    SysAid Helpdesk blind SQL injection
    No content preview
    The Automotive Threat Modeling Template
    No content preview
    Accessing Private Fields Outside of Classes in Java
    No content preview
    More Advanced SQL Injection
    No content preview
    Securing Teradata Database
    No content preview
    Software Security Austerity Security Debt in Modern Software Development
    No content preview
    Technical Advisory: Multiple Vulnerabilities in HP Printers
    No content preview
    Smuggling HTA files in Internet Explorer/Edge
    No content preview
    Technical Advisory – IBM TAM: Remote Directory Traversal and File Retrieval via web server plug-in
    No content preview
    Tool Release: iOS SSL Kill Switch v0.5 Released
    No content preview
    Ruling the rules
    No content preview
    Secure Session Management With Cookies for Web Applications
    No content preview
    SSLyze v0.7 Released
    No content preview
    Why AI Will Not Fully Replace Humans for Web Penetration Testing
    No content preview
    Rigging the Vote: Uniqueness in Verifiable Random Functions
    No content preview
    Software-Based Fault Injection Countermeasures (Part 2/3)
    No content preview
    Technical Advisory – Linux RDS Protocol Local Privilege Escalation
    No content preview
    NCC Group’s Upcoming Trainings at Black Hat USA 2021
    No content preview
    Research Insights Volume 1 – Sector Focus: Financial Services
    No content preview
    Updated: Technical Advisory and Proofs of Concept – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552)
    No content preview
    How to Backdoor Diffie-Hellman
    No content preview
    Public Report: Aleo snarkOS Implementation and Consensus Mechanism Review
    No content preview
    Securing Google Cloud Platform – Ten best practices
    No content preview
    Technical Advisory – ExpressLRS vulnerabilities allow for hijack of control link
    No content preview
    Public cloud
    No content preview
    Symantec Messaging Gateway – Addition of a backdoor adminstrator via CSRF
    No content preview
    TANDBERG Video Communication Server Authentication Bypass
    No content preview
    HDMI Ethernet Channel
    No content preview
    Managing PowerShell in a modern corporate environment
    No content preview
    NCC Group placed first in global 5G Cyber Security Hack competition
    No content preview
    Symantec Backup Exec 2012 Backup/Restore Data Traverses Memory with Weak ACLs
    No content preview
    Ragweed
    No content preview
    Samba on the BlackBerry PlayBook
    No content preview
    Security Considerations of zk-SNARK Parameter Multi-Party Computation
    No content preview
    typofinder
    No content preview
    Reviewing Verifiable Random Functions
    No content preview
    Technical Advisory – Apple HFS+ Information Disclosure Vulnerability
    No content preview
    iOS SSL Killswitch
    No content preview
    Managing Cyber Risk in the Supply Chain
    No content preview
    SIAM AG23: Algebraic Geometry with Friends
    No content preview
    Improving your Network and Application Assurance Strategy in an environment of increasing 0day vulnerabilities
    No content preview
    Oracle Retail Integration Bus Manager Directory Traversal
    No content preview
    Porting the Misfortune Cookie Exploit: A Look into Router Exploitation Using the TD-8817
    No content preview
    Some Notes About the Xen XSA-122 Bug
    No content preview
    Microsoft SQL Server Passwords
    No content preview
    IAX Voice Over-IP Security
    No content preview
    Fuzzbox
    No content preview
    Login Service Security
    No content preview
    MSSQL Lateral Movement
    No content preview
    Nagios XI Network Monitor – Stored and Reflective XSS
    No content preview
    Non Obvious PE Parsers – The .NET runtime – Part 1
    No content preview
    Paper: Thematic for Success in Real-World Offensive Cyber Operations – How to make threat actors work harder and fail more often
    No content preview
    Alternative Approaches for Fault Injection Countermeasures (Part 3/3)
    No content preview
    NCC Con Europe 2022 – Pwn2Own Austin Presentations
    No content preview
    Protecting stored cardholder data (an unofficial supplement to PCI DSS V3.0)
    No content preview
    Whitepaper: Recognizing and Preventing TOCTOU
    No content preview
    Machine learning from idea to reality: a PowerShell case study
    No content preview
    metasploitavevasion
    No content preview
    A Back-to-Front TrueCrypt Recovery Story: The Plaintext is the Ciphertext
    No content preview
    Hacking Displays Made Interesting
    No content preview
    Lessons learned from 50 USB bugs
    No content preview
    Mergers & Acquisitions (M&A) cyber security due diligence
    No content preview
    tybocer
    No content preview
    Password and brute-force mitigation policies
    No content preview
    Post-quantum cryptography overview
    No content preview
    Real World Cryptography Conference 2022
    No content preview
    USB keyboards by post – use of embedded keystroke injectors to bypass autorun restrictions on modern desktop operating systems
    No content preview
    Spectre on a Television
    No content preview
    PhanTap (Phantom Tap): Making networks spookier one packet at a time
    No content preview
    Mature Security Testing Framework
    No content preview
    OS X Lion USB Hub Class Descriptor Arbitrary Code Execution
    No content preview
    Tool Release – ScoutSuite 5.13.0
    No content preview
    A New Flying Kitten?
    No content preview
    NX Server for Linux Arbitrary Files can be read with root privileges
    No content preview
    Variations in Exploit methods between Linux and Windows
    No content preview
    Optimum Routers: Researching Managed Routers
    No content preview
    McAfee Email and Web Security Appliance Password hashes can be recovered from a system backup and easily cracked
    No content preview
    NIST Selects Post-Quantum Algorithms for Standardization
    No content preview
    Microsoft announces the WMIC command is being retired, Long Live PowerShell
    No content preview
    Technical Advisory: Citrix Workspace / Receiver Remote Code Execution Vulnerability
    No content preview
    On Linux’s Random Number Generation
    No content preview
    The death of USB autorun and the rise of the USB keyboard
    No content preview
    UK government cyber security guidelines for connected & autonomous vehicles
    No content preview
    Tool Release: SSLyze v0.8 released
    No content preview
    Optimizing Pairing-Based Cryptography: Montgomery Arithmetic in Rust
    No content preview
    Practical Machine Learning for Random (Filename) Detection
    No content preview
    McAfee Email and Web Security Appliance Any logged-in user can bypass controls to reset passwords of other administrators
    No content preview
    G-Scout
    No content preview
    An Adaptive-Ciphertext Attack Against “I ⊕ C” Block Cipher Modes With an Oracle
    No content preview
    Multiple Format String Injections in AFFLIB
    No content preview
    Premium Security Content Gateway
    No content preview
    Machine Learning 104: Breaking AES With Power Side-Channels
    No content preview
    Shell Arithmetic Expansion and Evaluation Abuse
    No content preview
    Integrating DigitalOcean into ScoutSuite
    No content preview
    Lumension Device Control (formerly Sanctuary) remote memory corruption
    No content preview
    Technical Advisory – Jitsi Meet Electron – Limited Certificate Validation Bypass (CVE-2020-27161)
    No content preview
    Owning the Virgin Media Hub 3.0: The perfect place for a backdoor
    No content preview
    Singularity of Origin
    No content preview
    Public Report – Confidential Space Security Review
    No content preview
    The Phishing Guide: Understanding & Preventing Phishing Attacks
    No content preview
    Testing HTTP/2 only web services
    No content preview
    Getting per-user Conditional Access MFA status in Azure
    No content preview
    McAfee Email and Web Security Appliance v5.6 – Any logged-in user can bypass controls to reset passwords of other administrators
    No content preview
    Mobile & web browser credential management: Security implications, attack cases & mitigations
    No content preview
    Forensic Fuzzing Tools
    No content preview
    iOS certificate pinning code updated for iOS 7
    No content preview
    Intel BIOS Advisory – Memory Corruption in HID Drivers
    No content preview
    HTTP Profiler
    No content preview
    Ghost Vulnerability (CVE-2015-0235)
    No content preview
    FrisbeeLite
    No content preview
    Some Musings on Common (eBPF) Linux Tracing Bugs
    No content preview
    iSEC Partners Releases SSLyze
    No content preview
    Intent Sniffer
    No content preview
    Heartbleed (CVE-2014-0160) Advisory
    No content preview
    Samba Andx Request Remote Code Execution
    No content preview
    Hackproofing MySQL
    No content preview
    Immunity Debugger Buffer Overflow
    No content preview
    Gizmo
    No content preview
    Fuzzing the Easy Way Using Zulu
    No content preview
    Overview of Modern Memory Security Concerns
    No content preview
    Project Bishop: Clustering Web Pages
    No content preview
    lapith
    No content preview
    Investigating Potential Security Vulnerability Manifestation through Various Analyses & Inferences Regarding Internet RFCs (and how RFC Security might be Improved)
    No content preview
    Security Code Review With ChatGPT
    No content preview
    Fuzzing USB devices using Frisbee Lite
    No content preview
    Fuzzing the Easy Way Using Zulu (1)
    No content preview
    Public Report – Google Privacy Sandbox Aggregation Service and Coordinator
    No content preview
    Implementing and Detecting a PCI Rootkit
    No content preview
    Hiccupy
    No content preview
    Hacking a web application
    No content preview
    Package Play
    No content preview
    Public Report – IOV Labs powHSM Security Assessment
    No content preview
    Jackson Deserialization Vulnerabilities
    No content preview
    SAML Pummel
    No content preview
    Introspy for Android
    No content preview
    Hackproofing Oracle Application Server
    No content preview
    Flubot: the evolution of a notorious Android Banking Malware
    No content preview
    Public Report – Filecoin Bellman and BLS Signatures Cryptographic Review
    No content preview
    Interfaces.d to RCE
    No content preview
    Improving Your Embedded Linux Security Posture With Yocto
    No content preview
    Kubernetes Security: Consider Your Threat Model
    No content preview
    iSEC audit of MediaWiki
    No content preview
    How to protect yourself & your organisation from phishing attacks
    No content preview
    Ghidra nanoMIPS ISA module
    No content preview
    NCC Group co-signs the Electronic Frontier Foundation’s Statement on DMCA Use Against Security Researchers
    No content preview
    Readable Thrift (1)
    No content preview
    Inter-Protocol Communication
    No content preview
    Quantum Cryptography – A Study Into Present Technologies and Future Applications
    No content preview
    Premium Practical Law Content Gateway
    No content preview
    Introducing Azucar
    No content preview
    Impress Pages CMS Remote Code Execution
    No content preview
    Oracle Forensics Part 7 Using the Oracle System Change Number in Forensic Investigations
    No content preview
    Properly Signed Certificates on CPE Devices
    No content preview
    Public Report – Confidential Mode for Hyperdisk – DEK Protection Analysis
    No content preview
    iOS 7 arbitrary code execution in kernel mode
    No content preview
    Man-in-the-Middling Non-Proxy Aware Wi-Fi Devices with a Pineapple
    No content preview
    Oracle Passwords and OraBrute
    No content preview
    How much training should staff have on cyber security?
    No content preview
    Mobile apps and security by design
    No content preview
    Public Report – Dell Secured Component Verification
    No content preview
    Jailbreak, updated and open-sourced
    No content preview
    Flash security restrictions bypass: File upload by URLRequest
    No content preview
    IODIDE
    No content preview
    How to Spot and Prevent an Eclipse Attack
    No content preview
    HIDDEN COBRA Volgmer: A Technical Analysis
    No content preview
    Intel® Software Guard Extensions (SGX): A Researcher’s Primer
    No content preview
    hostresolver
    No content preview
    Reverse, Reveal, Recover: Windows Defender Quarantine Forensics
    No content preview
    Discovering Smart Contract Vulnerabilities with GOATCasino
    No content preview
    Conference Talks – February 2020
    No content preview
    Public Report – Electric Coin Company NU3 Specification and Blossom Implementation Audit
    No content preview
    Public Report - Security Risks of AI Hardware for Personal and Edge Computing Devices
    No content preview
    IG Learner Walkthrough
    No content preview
    Security Tips For Your AI Cloud Infrastructure
    No content preview
    ABSTRACT SHIMMER (CVE-2020-15257): Host Networking is root-Equivalent, Again
    No content preview
    Technical Advisory: Multiple Vulnerabilities in MailEnable
    No content preview
    When Security Gets in the Way: PenTesting Mobile Apps That Use Certificate Pinning
    No content preview
    Technical Advisory: Multiple Vulnerabilities in SmarterMail
    No content preview
    How I did not get a shell
    No content preview
    The economics of defensive security
    No content preview
    5G security – how to minimise the threats to a 5G network
    No content preview
    Denial of Service in Parsing a URL by ierutil.dll
    No content preview
    Medium Risk Vulnerability in Symantec Enterprise Security Management
    No content preview
    Defending Your Directory: An Expert Guide to Combating Kerberoasting in Active Directory
    No content preview
    Public Report – AWS Nitro System API & Security Claims French
    No content preview
    On the malicious use of large language models like GPT-3
    No content preview
    Medical Devices: A Hardware Security Perspective
    No content preview
    Technical Advisory: Multiple Vulnerabilities in Xerox Printers
    No content preview
    Hardware Security By Design: ESP32 Guidance
    No content preview
    Understanding and Hardening Linux Containers
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 3: Understanding Existing Approaches and Attempts
    No content preview
    Exposing Vulnerabilities in Media Software
    No content preview
    Tool Release: tcpprox
    No content preview
    Using Semgrep with Jupyter Notebook files
    No content preview
    Dangers of Kubernetes IAM Integrations
    No content preview
    CVE-2018-8611 Exploiting Windows KTM Part 5/5 – Vulnerability detection and a better read/write primitive
    No content preview
    Weak Randomness Part I – Linear Congruential Random Number Generators
    No content preview
    Webinar – PCI Version 3.0: Are you ready?
    No content preview
    Phish Supper: An Incident Responder’s Bread and Butter
    No content preview
    Assessing IIS Configuration Remotely
    No content preview
    44CON - Charging Ahead: Exploiting an EV Charger Controller at Pwn2Own Automotive 2024
    No content preview
    Machine Learning 102: Attacking Facial Authentication with Poisoned Data
    No content preview
    Vaccine Misinformation Part 1: Misinformation Attacks as a Cyber Kill Chain
    No content preview
    Technical Advisory: Code Execution by Viewing Resource Files in .NET Reflector
    No content preview
    Technical Advisory: Adobe ColdFusion WDDX Deserialization Gadgets
    No content preview
    Real World Cryptography Conference 2023 – Part II
    No content preview
    Puckungfu: A NETGEAR WAN Command Injection
    No content preview
    Sobelow Update
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 7: Development of Prototype #3 – Adventures in Anomaly Detection
    No content preview
    Technical Advisory – Multiple Vulnerabilities in U-Boot (CVE-2022-30790, CVE-2022-30552)
    No content preview
    Whitepaper: CA Alternative
    No content preview
    Windows remote desktop memory corruptoin leading to RCE on XPSP3
    No content preview
    Technical Advisory: OS Command Injection in Silver Peak EdgeConnect Appliances (CVE-2020-12148, CVE-2020-12149)
    No content preview
    NCC Group’s 2021 Annual Research Report
    No content preview
    CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 2
    No content preview
    Nameless and shameless: Ransomware Encryption via BitLocker
    No content preview
    The Importance of a Cryptographic Review
    No content preview
    Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs
    No content preview
    Car Parking Apps Vulnerable To Hacks
    No content preview
    Analyzing AI Application Threat Models
    No content preview
    Cryptopals: Exploiting CBC Padding Oracles
    No content preview
    Immortalising 20 Years of Epic Research
    No content preview
    Detecting Rclone – An Effective Tool for Exfiltration
    No content preview
    BlackHat USA 2024 - Listen-Up: Sonos Over-The-Air Remote Kernel Exploitation and Covert Wiretap
    No content preview
    Public Report – Penumbra Labs R1CS Implementation Review
    No content preview
    To dock or not to dock, that is the question: Using laptop docking stations as hardware-based attack platforms
    No content preview
    Why IoT Security Matters
    No content preview
    Exploring DeepFake Capabilities & Mitigation Strategies with University College London
    No content preview
    Technical Advisory – play-pac4j Authentication rule bypass
    No content preview
    Tool Release: Announcing the Release of RtspFuzzer
    No content preview
    Back in Black: Unlocking a LockBit 3.0 Ransomware Attack
    No content preview
    Analyzing a PJL directory traversal vulnerability – exploiting the Lexmark MC3224i printer (part 2)
    No content preview
    Oracle Forensics Part 2: Locating Dropped Objects
    No content preview
    Cracking Mifare Classic 1K: RFID, Charlie Cards, and Free Subway Rides
    No content preview
    Tool Release – Carnivore: Microsoft External Assessment Tool
    No content preview
    The Pharming Guide – Understanding and preventing DNS related attacks by phishers
    No content preview
    Weaknesses and Best Practices of Public Key Kerberos with Smart Cards
    No content preview
    Project Ava: On the Matter of Using Machine Learning for Web Application Security Testing – Part 1: Understanding the Basics and What Platforms and Frameworks Are Available
    No content preview
    NCC Group WhitepaperUnderstanding and HardeningLinux ContainersJune 29, 2016 – Version 1.1
    No content preview
    iOS 7 tool updates
    No content preview
    Lights, Camera, HACKED! An insight into the world of popular IP Cameras
    No content preview
    Public Report – AWS Nitro System API & Security Claims German
    No content preview
    PRTG Network Monitor Command injection
    No content preview
    Understanding Microsoft Word OLE Exploit Primitives
    No content preview
    Technical Advisory – Lansweeper Privilege Escalation via CSRF Using HTTP Method Interchange (CVE-2020-13658)
    No content preview
    Technical Advisory: Multiple Vulnerabilities in ManageEngine Desktop Central
    No content preview
    Shining New Light on an Old ROM Vulnerability: Secure Boot Bypass via DCD and CSF Tampering on NXP i.MX Devices
    No content preview
    Public Report – RustCrypto AES/GCM and ChaCha20+Poly1305 Implementation Review
    No content preview
    Technical Advisory – SonicWall Global Management System (GMS) & Analytics – Multiple Critical Vulnerabilities
    No content preview
    OCP S.A.F.E. How-to
    No content preview
    NCC Group Connected Health Whitepaper July 2019
    No content preview
    Deception Engineering: exploring the use of Windows Service Canaries against ransomware
    No content preview
    An offensive guide to the Authorization Code grant
    Discover NCC Group’s offensive security perspective on Authorization Code Grant vulnerabilities and mitigations.  ( 14 min )
    RSA Conference – Mobile Threat War Room
    No content preview  ( 6 min )
    Research Insights Volume 7: Exploitation Advancements
    No content preview  ( 7 min )
    Which database is more secure? Oracle vs. Microsoft
    No content preview  ( 7 min )
    Stepping Stones – A Red Team Activity Hub
    No content preview  ( 9 min )
    NCC Group Malware Technical Note
    No content preview  ( 6 min )
    Black Hat 2013 – Femtocell Presentation Slides, Videos and App
    Explore NCC Group’s femtocell attack research presented at Black Hat 2013, including downloadable resources.  ( 8 min )
    White Paper: Browser Extension Password Managers
    No content preview  ( 7 min )
    Technical Advisory – Apple XAR – Arbitrary File Write (CVE-2021-30833)
    No content preview  ( 8 min )
    Hunting SQL Injection Bugs
    No content preview  ( 6 min )
    Integrity destroying malicious code for financial or geopolitical gain: A vision of the future?
    No content preview  ( 7 min )
    A few notes on usefully exploiting libstagefright on Android 5.x
    No content preview  ( 8 min )
    Understanding Ransomware: Impact, Evolution and Defensive Strategies
    No content preview  ( 7 min )
    LeaPFRogging PFR Implementations
    Explore NCC Group’s insights on leapfrogging PFR implementations to improve security and streamline processes.  ( 12 min )
    An Illustrated Guide to Elliptic Curve Cryptography Validation
    No content preview  ( 16 min )
    EasyDA – Easy Windows Domain Access Script
    No content preview
    Decoder Improved Burp Suite Plugin
    No content preview
    Conference Talks – September 2021
    No content preview
    Exploiting the win32k!xxxEnableWndSBArrows use-after-free (CVE-2015-0057) bug on both 32-bit and 64-bit
    No content preview
    Emissary Panda – A potential new malicious tool
    No content preview
    Dissecting social engineering attacks
    No content preview
    Derusbi: A Case Study in Rapid Capability Development
    No content preview
    CVE-2019-1405 and CVE-2019-1322 – Elevation to SYSTEM via the UPnP Device Host Service and the Update Orchestrator Service
    No content preview
    Combating Java Deserialisation Vulnerabilities with Look-Ahead Object Input Streams (LAOIS)
    No content preview
    Erlang Security 101
    No content preview
    Double-odd Elliptic Curves
    No content preview
    Distributed Ledger (Blockchain) Security and Quantum Computing Implications
    No content preview
    Decoding network data from a Gh0st RAT variant
    No content preview
    Database Security Brief: The Oracle Critical Patch Update for April 2007
    No content preview
    Firmware Rootkits: The Threat to the Enterprise
    No content preview
    Exploiting CVE-2014-0282 (1)
    No content preview
    Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm
    No content preview
    Deep Dive into Real-World Kubernetes Threats
    No content preview
    Chafer backdoor analysis
    No content preview
    Ethics in Security Testing
    No content preview
    Enumerating System Management Interrupts
    No content preview
    Don’t throw a hissy fit; defend against Medusa
    No content preview
    DNS Pinning and Web Proxies
    No content preview
    Detecting Karakurt – an extortion focused threat actor
    No content preview
    Decrypting OpenSSH sessions for fun and profit
    No content preview
    eBook – Planning a robust incident response process
    No content preview
    Disclosure Policy
    No content preview
    D0nut encrypt me, I have a wife and no backups
    No content preview
    Cyber red-teaming business-critical systems while managing operational risk
    No content preview
    Common Flaws of Distributed Identity and Authentication Systems
    No content preview
    Exploring Overfitting Risks in Large Language Models
    No content preview
    easyda
    No content preview
    dotnetpefuzzing
    No content preview
    Does TypeScript Offer Security Improvements Over JavaScript?
    No content preview
    Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study
    No content preview
    Endpoint connectivity
    No content preview
    Encryption at rest: Not the panacea to data protection
    No content preview
    Dynamic Linq Injection Remote Code Execution Vulnerability (CVE-2023-32571)
    No content preview
    Detection Engineering for Kubernetes clusters
    No content preview
    Critical Risk Vulnerability in Ingres (Pointer Overwrite 1)
    No content preview
    Content Security Policies and Popular CMS Systems
    No content preview
    External Enumeration and Exploitation of Email and Web Security Solutions
    No content preview
    Elephant in the Boardroom Survey 2016
    No content preview
    DIBF – Updated
    No content preview
    DeLux Edition: Getting root privileges on the eLux Thin Client OS
    No content preview
    Early CCS Attack Analysis
    No content preview
    Domestic IoT Nightmares: Smart Doorbells
    No content preview
    Database Servers on Windows XP and the unintended consequences of simple file sharing
    No content preview
    Five Essential Machine Learning Security Papers
    No content preview
    Microsoft Office Memory Corruption Vulnerability
    No content preview
    firstexecution
    No content preview
    File Fuzzers
    No content preview
    Faster Modular Inversion and Legendre Symbol, and an X25519 Speed Record
    No content preview
    Finding the weak link in binaries
    No content preview
    Exporting non-exportable RSA keys
    No content preview
    Exploiting Security Gateways Via Web Interfaces
    No content preview
    Exploiting CVE-2014-0282
    No content preview
    Extractor
    No content preview
    Exploiting Noisy Oracles with Bayesian Inference
    No content preview
    Exploit the Fuzz – Exploiting Vulnerabilities in 5G Core Networks
    No content preview
    Extending a Thinkst Canary to become an interactive honeypot
    No content preview
    Exploiting Samba CVE-2015-0240 on Ubuntu 12.04 and Debian 7 32-bit
    No content preview
    Exploiting Rich Content
    No content preview
    Exploiting PL/SQL Injection Flaws with only CREATE SESSION Privileges
    No content preview
    Exception Handling and Data Integrity in Salesforce
    No content preview
    Enterprise-scale seamless onboarding and deployment of Azure Sentinel using Lighthouse for multi-tenant environments
    No content preview
    Fat-Finger
    No content preview
    Extracting the Payload from a CVE-2014-1761 RTF Document
    No content preview
    Exploring Verifiable Random Functions in Code
    No content preview
    Estimating the Bit Security of Pairing-Friendly Curves
    No content preview
    EDIDFuzzer
    No content preview
    Faux Disk Encryption: Realities of Secure Storage On Mobile Devices
    No content preview
    Exploring Prompt Injection Attacks
    No content preview
    Exploring macOS Calendar Alerts: Part 2 – Exfiltrating data (CVE-2020-3882)
    No content preview
    Exploring macOS Calendar Alerts: Part 1 – Attempting to execute code
    No content preview
    Exploit mitigations: keeping up with evolving and complex software/hardware
    No content preview
    Experiments in Extending Thinkst Canary – Part 1
    No content preview
    EternalGlue part one: Rebuilding NotPetya to assess real-world resilience
    No content preview
    LAPSUS$: Recent techniques, tactics and procedures
    No content preview
    Technical Advisory – SerComm h500s – Authenticated Remote Command Execution (CVE-2021-44080)
    No content preview
    Public Report – Threshold ECDSA Cryptography Review
    No content preview
    The Password is Dead, Long Live the Password!
    No content preview
    Latest threats to the connected car & intelligent transport ecosystem
    No content preview
    An adventure in PoEKmon NeutriGo land
    No content preview
    Pumping Iron on the Musl Heap – Real World CVE-2022-24834 Exploitation on an Alpine mallocng Heap
    No content preview
    Working with the Open Technology Fund
    No content preview
    Incremental Machine Learning by Example: Detecting Suspicious Activity with Zeek Data Streams, River, and JA3 Hashes
    No content preview
    An Introduction to Fault Injection (Part 1/3)
    No content preview
    An Analysis of Mobile Geofencing App Security
    No content preview
    Impact of DNS over HTTPS (DoH) on DNS Rebinding Attacks
    No content preview
    NCC Group’s 2020 Annual Research Report
    No content preview
    Drones: Detect, Identify, Intercept, and Hijack
    No content preview
    Technical Advisory – Ollama DNS Rebinding Attack (CVE-2024-28224)
    No content preview
    Tool Release – Reliably-checked String Library Binding
    No content preview
    Launching the first in our series of Research Insights
    No content preview
    Practical Considerations of Right-to-Repair Legislation
    No content preview  ( 17 min )
    A Look At Some Real-World Obfuscation Techniques
    No content preview  ( 17 min )
    Finding and Exploiting .NET Remoting over HTTP using Deserialisation
    No content preview  ( 12 min )
    Technical Advisory – Multiple Vulnerabilities in Connectize G6 AC2100 Dual Band Gigabit WiFi Router (CVE-2023-24046, CVE-2023-24047, CVE-2023-24048, CVE-2023-24049, CVE-2023-24050, CVE-2023-24051, CVE-2023-24052)
    No content preview  ( 20 min )
    Fake CAPTCHA led to LUMMA
    Discover the social engineering behind fake CAPTCHA attacks. Learn how Lumma malware infects systems and what defenses can stop it.  ( 9 min )
    Spectre and Meltdown: What you Need to Know
    No content preview  ( 12 min )
    Mitigating the top 10 security threats to GCP using the CIS Google Cloud Platform Foundation Benchmark
    No content preview  ( 12 min )
    Technical Advisory – libraptor – XXE in RDF/XML File Interpretation
    A technical breakdown of the XXE vulnerability in libraptor’s RDF/XML interpretation and its impact on downstream applications.  ( 10 min )
    Technical Advisory – Hash Denial-of-Service Attack in Multiple QUIC Implementations
    No content preview  ( 14 min )
    Whitepaper: Perfect Forward Security
    No content preview  ( 7 min )
    RIFT: Analysing a Lazarus Shellcode Execution Method
    No content preview  ( 9 min )
    CVE-2021-31956 Exploiting the Windows Kernel (NTFS with WNF) – Part 1
    No content preview  ( 32 min )
    Stepping Insyde System Management Mode
    No content preview  ( 17 min )
    Metastealer – filling the Racoon void
    No content preview  ( 10 min )
    A WarCon 2017 Presentation: Cisco ASA – Exploiting the IKEv1 Heap Overflow – CVE-2016-1287
    No content preview  ( 7 min )
    Understanding the root cause of F5 Networks K52145254: TMUI RCE vulnerability CVE-2020-5902
    No content preview  ( 10 min )
    Detecting and Hunting for the PetitPotam NTLM Relay Attack
    No content preview  ( 9 min )
    Technical Advisory – Multiple Vulnerabilities in Faronics Insight (CVE-2023-28344, CVE-2023-28345, CVE-2023-28346, CVE-2023-28347, CVE-2023-28348, CVE-2023-28349, CVE-2023-28350, CVE-2023-28351, CVE-2023-28352, CVE-2023-28353)
    No content preview  ( 24 min )
    Rustproofing Linux (Part 2/4 Race Conditions)
    No content preview  ( 14 min )
    Vulnerability Overview: Ghost (CVE-2015-0235)
    No content preview  ( 9 min )
    So long and thanks for all the 0day
    No content preview  ( 21 min )
    Detecting Mimikatz with Busylight
    No content preview  ( 10 min )
    Technical Advisory – OpenJDK – Weak Parsing Logic in java.net.InetAddress and Related Classes
    No content preview  ( 17 min )
    A Primer On Slowable Encoders
    No content preview  ( 12 min )
    Technical Advisory – Multiple Vulnerabilities in the Galaxy App Store (CVE-2023-21433, CVE-2023-21434)
    No content preview  ( 10 min )
    Technical Advisory – SonicWall SMA 100 Series – Multiple Unauthenticated Heap-based and Stack-based Buffer Overflow (CVE-2021-20045)
    No content preview  ( 9 min )
    How To Spot a Penetration Tester in Your Network (and Catch the Real Bad Guys at the Same Time)
    This guide reveals techniques to detect penetration testers and uncover genuine threats during security assessments.  ( 13 min )
    Technical Advisory – U-Boot – Unchecked Download Size and Direction in USB DFU (CVE-2022-2347)
    No content preview  ( 10 min )
    Helping Engineering Teams Tackle Security Debt in Embedded Systems: U-Boot Configuration Auditing Introduced in Depthcharge v0.2.0
    No content preview  ( 14 min )
    Public Report – Zendoo Proof Verifier Cryptography Review
    No content preview  ( 7 min )
    Announcing the Cryptopals Guided Tour Video 18: Implement CTR
    No content preview  ( 8 min )
    StreamDivert: Relaying (specific) network connections
    No content preview  ( 9 min )
    Bypassing software update package encryption – extracting the Lexmark MC3224i printer firmware (part 1)
    No content preview  ( 25 min )
    Exploring the Security & Privacy of Canada’s Digital Proof of Vaccination Programs
    Understand the security challenges and privacy concerns of Canada’s digital vaccination systems and how to mitigate potential threats.  ( 30 min )
    Matty McMattface: Security implications, mitigations & testing strategies for biometric facial recognition systems
    No content preview  ( 7 min )
    Symantec Messaging Gateway Arbitrary file download is possible with a crafted URL (authenticated)
    Learn how a crafted URL can exploit Symantec Messaging Gateway for arbitrary file downloads and how to mitigate this risk.  ( 7 min )
    Self-Driving Cars- The future is now…
    No content preview  ( 7 min )
    Secure Coding in C and C++, 2nd Edition
    No content preview  ( 6 min )
    Xen HYPERVISOR_xen_version stack memory revelation
    No content preview  ( 6 min )
    Adobe Flash Player Cross Domain Policy Bypass
    No content preview  ( 6 min )
    Ricochet Security Assessment Public Report
    No content preview  ( 6 min )
    HTML5 Security The Modern Web Browser Perspective
    No content preview  ( 6 min )
    Insomnihack - Pioneering Zero Days at Pwn2Own Automotive 2024
    No content preview  ( 7 min )
    Sniffle: A Sniffer for Bluetooth 5
    No content preview  ( 7 min )
    Threat Profiling Microsoft SQL Server
    No content preview  ( 6 min )
    NCC CON Europe 2017
    No content preview  ( 7 min )
    Auditing Enterprise Class Applications and Secure Containers on Android
    No content preview  ( 6 min )
    Technical Advisory: Shell Injection in MacVim mvim URI Handler
    No content preview  ( 7 min )
    Windows DACLs & Why There Is Still Room for Interest
    No content preview  ( 8 min )
    OffensiveCon 2023 – Exploit Engineering – Attacking the Linux Kernel
    No content preview  ( 7 min )
    A Rendezvous with System Management Interrupts
    No content preview  ( 9 min )
    Understanding Microsoft Word OLE Exploit Primitives: Exploiting CVE-2015-1642 Microsoft Office CTaskSymbol Use-After-Free Vulnerability
    No content preview  ( 7 min )
    Technical Advisory: Condeon CMS
    No content preview  ( 8 min )
    Where You Inject Matters: The Role-Specific Impact of Prompt Injection Attacks on OpenAI models
    No content preview  ( 8 min )
    Public Report – Zcash NU5 Cryptography Review
    No content preview  ( 7 min )
    Non-flood/non-volumetric Distributed Denial of Service (DDoS)
    No content preview  ( 7 min )
    Oracle Retail Invoice Manager SQL Injection
    No content preview  ( 6 min )
    McAfee Email and Web Security Appliance Reflective XSS allowing an attacker to gain session tokens
    No content preview  ( 6 min )
    Symantec Messaging Gateway – Out of band stored XSS via email
    No content preview  ( 6 min )
    IETF Draft: Indicators of Compromise and Their Role in Attack and Defen[c|s]e
    No content preview  ( 7 min )
    Symantec Backup Exec 2012 – Persistent XSS Vulnerability Affecting Custom Reports
    No content preview  ( 7 min )
    Passive Information Gathering – The Analysis of Leaked Network Security Information
    No content preview  ( 7 min )
    Whitepaper – Exploring the Security of KaiOS Mobile Applications
    No content preview  ( 7 min )
    Tool Release: Blackbox Android App Analysis with Introspy
    No content preview  ( 7 min )
    Technical Advisory: Command Injection
    No content preview  ( 7 min )
    How organisations can properly configure SSL services to ensure the integrity and confidentiality of data in transit
    No content preview  ( 7 min )
    Revealing Embedded Fingerprints: Deriving intelligence from USB stack interactions
    No content preview  ( 6 min )
    White Paper: Login Service Security
    No content preview  ( 7 min )
    Medium Risk Vulnerability in Symantec Network Access Control
    No content preview  ( 6 min )
    Windows Remote Desktop Memory Corruption Leading to RCE on XPSP3
    No content preview  ( 8 min )
    Kivlad
    No content preview  ( 7 min )
    Introducing idb-Simplified Blackbox iOS App Pentesting
    No content preview  ( 6 min )
    Public Report – Entropy/Rust Cryptography Review
    No content preview  ( 7 min )
    port-scan-automation
    No content preview  ( 7 min )
    Chrome Password Manager Cross Origin Weakness
    Explore how a cross-origin flaw in Chrome’s password manager could allow attackers to steal credentials via embedded content.  ( 8 min )
    Symantec Messaging Gateway – Unauthorised SSH access
    No content preview  ( 6 min )
    Harnessing GPUs Building Better Browser Based Botnets
    No content preview  ( 6 min )
    iOS Instrumentation Without Jailbreak
    No content preview
    How will GDPR impact your communications?
    No content preview
    Public Report – Coda Cryptographic Review
    No content preview
    Jailbreak
    No content preview
    Going “AUTH the Rails” on a Crazy Train
    No content preview
    An Introduction to Heap overflows on AIX 5.3L
    No content preview  ( 6 min )
    Heartbleed OpenSSL vulnerability
    Learn the impact of Heartbleed on OpenSSL and how NCC Group helps secure systems against this critical flaw.  ( 9 min )
    Analysis of the Linux backdoor used in freenode IRC network compromise
    No content preview  ( 12 min )
    Lessons learned from 50 bugs: Common USB driver vulnerabilities
    No content preview  ( 7 min )
    Adventures in Windows Driver Development: Part 1
    Dive into the fundamentals of Windows driver development with NCC Group’s hands-on exploration of kernel-mode programming.  ( 13 min )
    Announcing the AWS blog post series
    No content preview
    Android SSL Bypass
    No content preview
    Analysis of Boomerang Differential Trials via a SAT-Based Constraint Solver URSA
    No content preview
    An Introduction to Ultrasound Security Research
    No content preview
    EAP-TLS: The most secure option?
    No content preview
    Research Paper – Machine Learning for Static Malware Analysis, with University College London
    No content preview
    Public Report – Electric Coin Company NU4 Cryptographic Specification and Implementation Review
    No content preview
    Implementing the Castryck-Decru SIDH Key Recovery Attack in SageMath
    No content preview
    Conference Talks – February/March 2021
    No content preview
    Pairing over BLS12-381, Part 1: Fields
    No content preview
    SMACK, SKIP-TLS & FREAK SSL/TLS Vulnerabilities
    Discover how these SSL/TLS flaws allow attackers to bypass encryption, impersonate servers, and intercept sensitive data.  ( 10 min )
    Technical Advisory – BLE Proximity Authentication Vulnerable to Relay Attacks
    No content preview  ( 10 min )
    SCOMplicated? – Decrypting SCOM “RunAs” credentials
    No content preview  ( 10 min )
    Secure Device Manufacturing: Supply Chain Security Resilience
    No content preview  ( 7 min )
    Readable Thrift
    No content preview  ( 10 min )
    On the Use of Pedersen Commitments for Confidential Payments
    No content preview  ( 12 min )
    Shellshock Bash Vulnerability
    No content preview  ( 8 min )
    Writing Robust Yara Detection Rules for Heartbleed
    Explore NCC Group’s approach to writing effective YARA rules for detecting Heartbleed in OpenSSL implementations.  ( 11 min )
    Pairing over BLS12-381, Part 2: Curves
    A technical look at the curve foundations of BLS12-381 and their importance in pairing-based cryptography.  ( 15 min )
    SAML XML Injection
    No content preview  ( 14 min )
    TA505: A Brief History Of Their Time
    No content preview  ( 14 min )
    NCC Group researchers named amongst MSRC’s Most Valuable Security Researchers in 2020
    No content preview  ( 8 min )
    Technical Advisory – Authorization Bypass Allows for Pinboard Corruption
    Explore how a flaw in access control could allow unauthorized users to corrupt Pinboard data and compromise integrity.  ( 8 min )
    Secure Messaging for Normal People
    No content preview  ( 7 min )
    Oracle Forensics Part 4: Live Response
    No content preview  ( 7 min )
    Pointer Sequence Reverser (PSR)
    No content preview  ( 7 min )
    TANDBERG Video Communication Server Arbitrary File Retrieval
    No content preview  ( 7 min )
    PeachFarmer
    No content preview  ( 7 min )
    Pip3line
    No content preview  ( 6 min )
    Research Report – Zephyr and MCUboot Security Assessment
    No content preview  ( 8 min )
    PDF Form Filling and Flattening Tool Buffer Overflow
    Explore how a buffer overflow vulnerability in a PDF form filling and flattening tool could lead to memory corruption and security risks.  ( 8 min )
    Symantec Backup Exec 2012 – OS version and service pack information leak
    No content preview  ( 7 min )
    Security of Things: An Implementers’ Guide to Cyber-Security for Internet of Things Devices and Beyond
    No content preview  ( 7 min )
    Security Best Practice: Host Naming & URL Conventions
    No content preview  ( 7 min )
    Technical Advisory – FreePBX – Multiple Authenticated SQL Injections in UCP application
    No content preview  ( 8 min )
    Technical Advisory – Arbitrary File Read in Dell Wyse Management Suite (CVE-2021-21586, CVE-2021-21587)
    No content preview  ( 8 min )
    State-of-the-art email risk
    No content preview  ( 7 min )
    Maritime Cyber Security: Threats and Opportunities
    No content preview  ( 6 min )
    Setting a New Standard for Kubernetes Deployments
    No content preview  ( 9 min )
    SSL checklist for pentesters
    No content preview  ( 6 min )
    Ransomware: what organisations can do to survive
    No content preview  ( 6 min )
    Memory Scanning for the Masses
    No content preview  ( 9 min )
    RtspFuzzer
    No content preview  ( 6 min )
    OSX afpserver remote code execution
    No content preview  ( 6 min )
    Oracle Forensics Part 3: Isolating Evidence of Attacks Against the Authentication Mechanism
    No content preview  ( 7 min )
    Secure Device Provisioning Best Practices: Heavy Truck Edition
    No content preview  ( 7 min )
    Technical Advisory – Apple iOS / OSX: Foundation NSXMLParser XXE Vulnerability
    Explore how a flaw in Apple’s NSXMLParser could allow XML External Entity (XXE) attacks on iOS and macOS systems.  ( 9 min )
    scenester
    No content preview  ( 6 min )
    Technical Advisory – ARM MbedOS USB Mass Storage Driver Memory Corruption
    No content preview  ( 10 min )
    SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store
    No content preview  ( 14 min )
    Second-Order Code Injection Attacks
    No content preview  ( 6 min )
    Symantec Messaging Gateway – Unauthenticated detailed version disclosure
    No content preview  ( 6 min )
    Oracle Hyperion 11 Directory Traversal
    No content preview  ( 7 min )
    Perfect Forward Security
    No content preview  ( 6 min )
    McAfee Email and Web Security Appliance Session hijacking and bypassing client-side session timeouts
    No content preview  ( 6 min )
    Return of the hidden number problem
    No content preview  ( 7 min )
    Technical Advisory – Coda Filesystem Kernel Memory Disclosure
    This technical advisory details a kernel memory disclosure issue in the Coda filesystem and its potential impact.  ( 9 min )
    Technical Advisory – Sunhillo SureLine Unauthenticated OS Command Injection (CVE-2021-36380)
    No content preview  ( 8 min )
    Poison Ivy string decryption
    Explore how NCC Group reverse-engineers Poison Ivy’s string obfuscation to uncover hidden commands and payloads.  ( 8 min )
    Oracle Forensics Part 5: Finding Evidence of Data Theft in the Absence of Auditing
    No content preview  ( 7 min )
    Technical Advisory – Garuda Linux Insecure User Creation (CVE-2021-3784)
    No content preview  ( 8 min )
    Technical Advisory – SonicWall SMA 100 Series – Heap-Based Buffer Overflow (CVE-2021-20043)
    No content preview  ( 8 min )
    Story of a Hundred Vulnerable Jenkins Plugins
    Explore the security risks in Jenkins plugins, how vulnerabilities were found, and steps to strengthen CI/CD security.  ( 14 min )

  • Open

    Technical Advisory: Tesla Telematics Control Unit - ADB Auth Bypass
    Technical Advisory: Tesla Telematics Control Unit - ADB Auth Bypass  ( 12 min )

  • Open

    Public Report: Meta Whatsapp message summarization service
    No content preview  ( 7 min )

  • Open

    Adventures in EM Side-channel Attacks
    Adventures in EM Side-channel Attacks Eucleak  ( 7 min )

  • Open

    TANDBERG Video Communication Server Static SSH Host KeysN
    Explore how hardcoded SSH host keys in Tandberg Video Communication Server could expose systems to impersonation and MITM attacks.  ( 9 min )

  • Open

    Crack the Riddle, Secure the Oasis: Core NetWars Version 11 is Here
    A blog about SANS Institute's new Core NetWars Version 11  ( 12 min )

  • Open

    The Cost Savings of Fixing Security Flaws in Development
    No content preview  ( 7 min )

  • Open

    A New Approach to Proving Cybersecurity Value (That Isn’t ROI)
    In this blog, we are excited to announce our white paper on Return on Mitigation (RoM), a framework we designed to quantify the financial impact of security programs in a way that speaks to business leaders.  ( 6 min )
    Celebrating 10 Years of Partnership: Snap and HackerOne Reach $1M in Bounties
    At Snap, security is more than a priority—it’s a core mission. Over the past decade, Snap has partnered with HackerOne to build and sustain a robust bug bounty program. This collaboration has led to major milestones, including paying security researchers over $1M in bounties. To celebrate this achievement and their 10-year partnership, we spoke with Jim Higgins, Snap's Chief Information Security Officer, Vinay Prabhushankar, Snap’s Security Engineering Manager, and Ilana Arbisser, Snap’s Privacy Engineer.

  • Open

    Women@ Kicks Off the Year with a Vision Board Event
    No content preview  ( 4 min )

  • Open

    Gain Actionable, Data-backed Insights with HackerOne Recommendations
    What if your security program could self-optimize: analyze trends, identify weak points, and proactively propose actionable steps to strengthen defenses? With HackerOne Recommendations, it can.  ( 5 min )

  • Open

    Welcome, Hackbots: How AI Is Shaping the Future of Vulnerability Discovery
    What are Hackbots and how are they impacting vulnerability discovery and the researcher community?  ( 6 min )

  • Open

    DORA Compliance Is Here: What Financial Entities Should Know
    The new DORA regulation: everything your organization needs to know about its impact and how to comply.  ( 5 min )
2026-09-01T02:36:28.283Z osmosfeed 1.15.1