In 2023 we, the training team within Orange Cyberdefense and specifically Ulrich Swart, Matthew Hughes and myself, attempted to do something a little different for Black Hat with regards to our in...
Let's take a look at how Wiz designed the agentless workload scanner to be modular and scalable, and what security measures Wiz takes to protect sensitive customer data.
Unit 42 researchers identified a campaign dubbed EleKtra-Leak, which performs automated targeting of exposed identity and access management (IAM) credentials within public GitHub repositories.
This CTF challenge was a series of 6 challenges pertaining to AArch64 privilege escalation, which is similar to ARM64. The main differences are removal of Thumb instructions and doubling the...
SPARKN is a web3 protocol for people to post a problem where somebody can come up with a solution for them. This is really generally but the intent of the protocol. The ProxyFactory contract...
Osmosis is a very popular decentralized exchange running on the Cosmos SDK. The authors of this post were looking at the math within this blockchain when they stumbled across an issue. When...
After publishing my blog post about running P4wnP1 on an LTE modem, where I explained how to install Linux and P4wnP1 on an actual LTE modem for sneaky USB attacks, and then trying and failing to...
Part 2 dives into the world of LKMs (Loadable Kernel Modules) and kernel-space rootkits to explore what LKMs are, how attackers abuse them, and how to detect them.
Open Zeppelin has created a large amount of contracts that are used by every EVM contract. This twitter threat is talking about several of the 'footguns' or easy ways to mess up. ERC-7201 is a...
In its 2023 Frost Radar™ analysis, Frost & Sullivan identified the top companies in the Global Cloud Workload Protection Platform (CWPP) market. Wiz is honored to be included on the list!
Scudo is a hardened heap allocator that has the goal of preventing heap-based vulnerability classes. It is the default allocator for Android now-a-days. This article breaks down how the allocator...
The threat actor gained access to Okta’s environment, and figured out that Okta was storing unsanitized HAR files (recordings of browser activity) that customers were sharing with the Okta support...
Wiz recently talked with security expert Clint Gibler about the many uses of AI in the cybersecurity space.
Wiz is proud to announce the opening of its data center in Mumbai, India
Google's Threat Analysis Group analyzes recent state-sponsored campaigns exploiting the WinRAR vulnerability, CVE-2023-38831.
Kaspersky experts discovered several detections of malware from the MATA cluster, previously attributed to the Lazarus group, compromising defense contractor companies in Eastern Europe.
Qubitstrike is a cryptojacking campaing targeting exposed Jupyter Notebooks, as they may allow to execute commands remotely. After obtaining a shell on the remote host, the shell script executes a...
Platypus Finance has joined the leaderboard for a second time! The smart contracts had been audited. However, they recently added some new functionality, which got them pwned. The attack was from...
The Apple Security Engineering and Architecture Research (SEAR) team made everyone aware of a vulnerability in the WebP image library that was being used actively in the wild by NSO Group...
Protect your Google Cloud identities with Wiz's new Google Workspace identity modeling and identify suspicious activity in Google Workspace with new threat detection rules
BackgroundThe Curated Intelligence community is a group of analysts from around the world that tracks the latest updates on the threat landscape. The latest situation Curated Intel has been...
Telsa uses auth.tesla.com as an SSO provider for external customers. For internal employees, they uses sso.telsa.com as an iDP. Using auth.tesla.com, they user realized it is possible to create...
Price oracles are providing the price of a specific asset; this can either be on-chain or off-chain data powering this. AMMs, loan providers and more use this to provide proper prices. Integrating...
In .NET, the ViewState parameter contains information about the state of a users session. This is serialized in the __VIEWSTATE parameter, which is sent on every request the user sends. People...
phpPgAdmin is a PHP plugin for interacting Postgres databases via PHP. When a user logs in, there is verification that the beginning and end of the string have a single quote. Or, if it doesn't...
MyBB is a bulletin board application. It has a special template functionality that allows for simple PHP eval execution. However, it has a regex to ensure that anything besides variable access is...
An 0-day in the HTTP/2 specification was discovered that leads to Denial of Service (DoS) attacks. Cloudflare, being a CDN with a major DDoS prevention system, was on the forefront of this. They...
Arm TrustZone is a Trusted Execution Environment (TEE) which runs two operating systems: a secure world and a non-secure world. For instance, a cryptographic service could be on the secure world....
Sui is a layer 1 blockchain is famous for its speed and concurrency. By being architected in this way and using Rust under the hood, it hits incredible speeds. The tldr; of the vulnerability is a...
Baseboard Management Controllers (BMC) are used for the remote monitoring of systems. Typically, this is a specialized chip on a server on a different wired connection than the server. It can be...