APT29, a/k/a Cozy Bear, has been utilizing a technique called domain fronting in order to secure backdoor access to targets for nearly two years running, experts said Monday. The nation stateRead More →
Short Bytes: The DIY tech inventor NODE has created a handheld all-in-one computer that runs Linux. It’s made using the new Raspberry Pi Zero W, some 3D printed parts, and anRead More →
Recently I started playing with the awesome PowerUpSQL tool by guys at NetSPI. I was interested in the ability to attack an Active Directory (AD) environment using access to aRead More →
A new technique named DoubleAgent, discovered by security researchers from Cybellum, allows an attacker to hijack security products and make them take malicious actions. The DoubleAgent attack was uncovered afterRead More →
“I just want my money,” one of the hackers said. A hacker or group of hackers is apparently trying to extort Apple over alleged access to a large cache ofRead More →
Law enforcement agencies across the world are targeting the dark web. Whether that’s through undercover buys of illegal weapons, or deploying malware to catch suspected pedophiles, cops have spent theRead More →
A security researcher has detailed a way to log into any account on the same computer, even without knowing its password. The trick works on all Windows versions, doesn’t requireRead More →
Some Ubiquiti network device models can be hacked thanks to an unpatched vulnerability, allowing attackers to gain control over the device, or use it as a pivot point in theRead More →
WhatsApp and Telegram have patched their respective web clients against a common security flaw discovered by researchers from Israeli firm Check Point, a security issue that would have allowed anRead More →
Don’t assume you can trust the hardware sensors in your phone and other connected devices, researchers warn. Researchers have shown that a malicious music file can trick an accelerometer intoRead More →
In a research paper published at the end of February, a team of five scientists from the Graz University of Technology has described a novel method of leaking data fromRead More →
The Android Security Bulletin for March 2017 contains a bugfix for a unique security flaw exploitable via the headphones audio connector that could be leveraged to leak data from theRead More →
For many years, MAC Address Randomization was slated as the next big thing for protecting user privacy on the modern Internet. The standard, which works by deploying a new MACRead More →
Shorebreak Security penetration testers discovered seven serious vulnerabilities in the dnaLIMS web application during the course of a blackbox penetration test for a customer. Shorebreak notified the vendor, who appears toRead More →
Last month at the RSA 2017 conference, we ran a live demo of Cylance’s UEFI Ransomware proof of concept at our ‘Hacking Exposed Next-Gen’ talk. In the demo, we targetedRead More →
Sometimes at Exploitee.rs, we look for fun devices to hack and sometimes the devices find us. Today we’re going to talk about a recent time where we found ourselves inRead More →
A new service launched on the Dark Web this week simplifies the process of tricking victims whose card details have been exposed into revealing their card’s PIN. The service, whichRead More →
Delivered by “secure” Word doc, pure PowerShell malware fetches commands from DNS TXT records. Researchers at Cisco’s Talos threat research group are publishing research today on a targeted attack deliveredRead More →
Zscaler has fixed persistent XSS vulnerabilities affecting Zscaler Cloud management software that allow logged attackers to hack coworkers. Serious cross-site scripting (XSS) flaws in the Zscaler Cloud management software could be exploitedRead More →
A few words about caching and reactions Websites often tend to use web cache functionality (for example over a CDN, a load balancer, or simply a reverse proxy). The purposeRead More →
