Community Feature - @1ce7eaCurated Intelligence member Robin Dimyan has shared his methodology behind developing an Early Warning System (EWS) using Cyber Threat Intelligence. The blog poses the...
Curve is a popular Automated Market Maker (AMM) that uses a Liquidity Pool (LP) to get the funds. Many contracts interact with Curve to find out the going rate of a token. The get_virtual_price()...
Dropbox disclosed a security breach where attackers stole 130 code repositories from one of its GitHub accounts by using credentials obtained from phishing Dropbox employees. The breach was...
On 2022-11-01, an incident was reported, involving an unknown actor, gaining initial access via End-user compromise, targeting GitHub to achieve Data exfiltration.
We're excited to announce the general availability of the Huntress macOS agent! And don't worry – Persistent Footholds are just the beginning.
Memory corruption vulnerabilities are absolutely everywhere in modern exploit development. Something like 80% of bugs are memory corruption. This post goes into making the XNU (iOS & Mac backbone)...
Jupyter Notebooks is an interactive computing platform while VS Code is a text editor. Somebody wrote an extension for Jupyter Notebooks to work with VS code. In the past, there was an XSS...
Cisco Jabber is a video conferencing service, similar to Zoom. For instant messaging, it uses a protocol called XMPP over XML. Within XMPP, there are short snippets of XML called stanzas that are...
Huntress has validated an initial report for an authentication bypass and sensitive file leak present in the Java framework “ZK”, used within the ConnectWise R1Soft software Server Backup Manager SE.
io_uring is a new subsystem in the Linux kernel used for speedy IO operations. In particular, the program may need to do privilege transitions many times via syscalls. Instead, a series of IO...
In glibc 2.34, the hooks used for debugging malloc were completely removed from the run time configurations. Since these were commonly used for getting code execution, the author of the post...
On November 1st, 2022, the OpenSSL Project disclosed High severity vulnerabilities CVE-2022-3786 and CVE-2022-3602, affecting deployments of OpenSSL 3.0.0–3.0.6. Learn how to effectively manage...
During an internal assessment, I performed an NTLM relay and ended up owning the NT AUTHORITY\SYSTEM account of the Windows server. Looking at the users connected on the same server, I knew that a...
We’ve been seeing some misinformation being spread around with regards to the Huntress technology stack/capabilities we possess today. We’re here to provide clarity.
Three major hacks took place in a single day, resulting in millions of dollars being stolen. The first vulnerability was in Rabby Swap. The contracts router function had the function...
On 2022-10-26, a research was reported, involving , gaining initial access via Software misconfig, while using Misconfigured GitHub Runner abuse, targeting GitHub to achieve None.
On 2022-10-26, a research was reported, involving , gaining initial access via Software misconfig, while using Public exposure abuse, targeting Elasticsearch to achieve Data exfiltration.
A recent vulnerability in PHP seemed like a good test for variant analysis in other systems. The vulnerability is an integer truncation and sign conversion bug that via an implicitly converts the...
The authors of this post spent a bunch of time trying to find vulnerabilities in popular PDF readers. This post is an out of bounds read in Adobe Acrobat but there should be more articles to come....
Supply chain attacks are very common within package managers, such as node package manager (npm). Malware commonly uses the npm scripts, such as postinstall, preinstall and other methods. In order...
The author of this post noticed a new piece of functionality in Github: LaTeX support. This support was given in Markdown through the library MathJax. Since the combining of many different...
Each instance of Jira Align (some Atlassian product) is deployed within an AWS EC2 environment. The endpoint ManageJiraConnectors has a parameter called txtAPIURL to which the URL pointed to a...
The post How to Play Competitive Backdoors & Breaches w/ Jason Blanchard (1-Hour) appeared first on Black Hills Information Security, Inc..
Read our webinar recap to learn what Henry Washburn of Huntress and Ian Alexander of Syncro outlined to help MSPs protect SMBs from cybersecurity threats.
New Wiz capabilities protect containerized applications by bringing deep cloud context and visibility to quickly identify and prioritize risks across containers, Kubernetes and cloud environments...
Analysis of months-long MajikPOS and Treasure Hunter campaign that infected dozens of terminals
KubeCon 2022 will be full of great presentations and content. Here's our take on the conference sessions (apart from our own) that you shouldn't miss, whether you're onsite or attending virtually.
In modern technology-intensive production, IT and large-scale digitalization, and therefore new cybersecurity technologies, are essential to remaining competitive, reducing costs associated with...
Hancom Office is an alternative version of Office used in South Korea. Docx files are mostly just XML documents. Instead of sharing the bug then the crash, the authors show the crash with the...
The online version of Microsoft Office is used to view various Microsoft type documents. The GET request to /op/view.aspx had a Server-Side Request Forgery (SSRF) vulnerability. They learned this...