Incident response is a lot like a choose your own adventure exercise. We cover the ground rules and talk about some incidents we’ve helped partners with.
Incident response is a lot like a choose your own adventure exercise. We cover the ground rules and talk about some incidents we’ve helped partners with.
A money mule is someone who moves stolen funds across bank accounts on behalf of cybercriminals. Learn how money mules operate and how you can proactively counteract mule accounts.
Nereus Finance is a lending / borrowing protocol. This allows users to deposit their tokens to earn interest on them and borrow funds from this protocol. Why would somebody want to borrow assets...
The SportDAO is a DAO centered around athletics. There are many collectables in sports that can easily moved to blockchain like playing cards and sneakers. The SportsDAO has its own sDAO tokens as...
Saddle Finance is an automated market maker (AMM) on Ethereum. In particular, they specialize in stable swaps and aim to reduce the slippage of users. The bulk of the code is based on Curve but...
Mt Pelerin is a financial intuition in Switzerland that leverages the blockchain to operate. The smart contract ComplianceRegistry is responsible for stores identity information linked to an...
Curated Intel investigates the challenges surrounding darkweb data leak sites in response to the industry's heavy reliance on bad data supplied by threat actors to make assessments about...
interBTC is a wrapper around Bitcoin on the Polkadot ecosystem. Each interBTC is backed 1 to 1 for Bitcoin. Over-collateralization is when a loan of more money is used to obtain something of...
The delegateCall() function in Solidity is used to share the state between two contracts. The msg.value and msg.sender are shared when using this call. In the context of native contracts or...
While reading blockchain security articles, the author of this post stumbled across this post talking about delegatecall() on a pre-compiled contract causing infinite money creation problems...
1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Exploitable from adjacent network/low attack complexity Vendor: Philips Equipment: Patient Information Center iX (PIC iX) and Efficia CM Series...
Password Manager Pro is a secure vault for storing and managing shared sensitive information such as passwords, documents, and digital identities of enterprises. A user can access the web console...
Tailscale is a mesh VPN service. A network connection is established with Wireguard to one another on demand. To execute the website code for a VPN user, it will use the V8 engine. The security...
Cybersecurity incidents were plentiful in 2022, causing many problems for industrial infrastructure owners and operators. Below we share some of our thoughts on potential developments of 2023,...
We're seeing a rise in Qakbot activity. Here's what you need to know to keep your environments safe.
During an interview, the author of the post once got the question: "What is the most common security vulnerability?" To Lenin's surprise, it was system misconfiguration. With people flocking from...
AWS Appsync is a GraphQL endpoint as a service. There are several different underlying data storage, such Lambda, DynamoDB, RDS and many others. There is also a custom option for this, which...
Back in the day, there was a device called the TV Guardian. The idea was that captions and spoken word with foul language could be removed from a stream in real time using this device. How does...
Recently, the author of this post received an Arcade cabinet as a gift. Different cabinets have emulators for different older consoles, such as NES, Atari and many others. The physical device had...
The PHP info page is used for displaying information about the current installation. Normally, this is considered a low information disclosure finding. A mitigation for Cross Site Scripting (XSS)...
Wiz expands its platform to proactively eliminate attack paths to discovered critical data.
Here's the problem statement: "Retrieve an article from Wikipedia without revealing which article was fetched." Although this seems impossible, the article demonstrates how to do this using...
The Renesas R7F701381 is a microcontroller for safety critical applications. It contains a second core with a lockstep core (runs instructions in parallel) to check the first core. Additionally,...
Transparency, Consent and Control (TCC) is a feature for privacy protection in Apple products. A user has to explicitly allow access to particular folder and files via authentication in order to...
The author completely forgot their SIM pin on their phone. Since they were tired, they forgot the PIN 3 times and had to use the PUK code to unlock the device in order to get it to work again....
Mark of the Web (MOTW) is used on Windows to say if something was downloaded from the internet. For executables, zip files and other things, this is an important thing to mitigate many attack...
The TRACE method is used for debugging applications. When a request is made with this method, it will send the full request with the specified verb and reflect this in the response. The HTTPOnly...
Cache poisoning vulnerabilities are typically complicated and hard to come by. This author found a load of them and put them together in a single post. The first issue is a problem with a load...
Mastodon is an open source alternative to Twitter. With Elon Musk taking over Twitter, many people have flocked to this instead. Gareth decided to take a look at the security of the platform. The...