Carbon Emissions: Oversharing Bug Puts Security Vendor Back in Spotlight

Last week, security firm DirectDefense came under fire for over-hyping claims that Cb Response, a cybersecurity product sold by competitor Carbon Black, was leaking proprietary data from customers who use it. Carbon Black responded that the bug identified by its competitor was a feature, and that...

Coalfire’s Adaptive Penetration Testing at Black Hat Helped Prepare Tomorrow’s Security Talent

What makes a penetration tester highly successful? Most obviously, the technical skills to hack into a network, application, or location comes to mind first, and without those capabilities and the ability to continuously learn, an aspiring pen tester has a tough road ahead of them...

August 16, 2017—KB4034661 (OS Build 14393.1613)

None None...

Carbon Blacking your sensitive data it’s what the agents normally do

But usually without such consequences. In this situation with Carbon Black, I am most interested in the actual reasons of all this media noise. From what point business as usual becomes a scandal. Ok, when you see Carbon Black customer's private files in public access at Virus Total it's a 100%...

csh.rit.edu XSS vulnerability

Open Bug Bounty ID: OBB-278313 Description| Value ---|--- Affected Website:| csh.rit.edu Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Beware of Security by Press Release

On Wednesday, the security industry once again witnessed an all-too-familiar cycle: I call it "security by press release." It goes a bit like this: A security firm releases a report claiming to have unearthed a major flaw in a competitor's product; members of the trade press uncritically republis...

Wolf in sheep's clothing: how to use the Windows icon to display the vulnerability disguise a PE file-vulnerability warning-the black bar safety net

One, Foreword Windows System icon to display the function in the presence of a vulnerability, exploit this vulnerability, the attacker may be from the local host to automatically “borrow“ other commonly used icons, use these icon camouflage PE file, thereby tempting the user to click on such a...

Analisi dei dump di Rousseau (Movimento Cinque Stelle) - Parte I: password

Disclaimer Questo blog post e' scritto da evariste.gal0is ed Antonio Sanso. Entrambi gli autori non hanno nessuna affiliazione politica ed il post ha l'unico scopo di fornire un'analisi tecnica di parte dei dump relativa alle password. Riassunto delle puntate precedenti In data 2 agosto 2017 uno...

Office of the senior threat vulnerability in the wild use analysis-vulnerability warning-the black bar safety net

Office of the senior threat vulnerability background In the advanced threat attack, the hackers remote delivery invasion client the most like the vulnerability is office documents vulnerability in the just-concluded black hat conference, the best client security vulnerabilities award went to...

“The seismic network of the third generation”（CVE-2017-8464 several species using the method and prevention-vulnerability and early warning-the black bar safety net

As early as 6 May 13, Microsoft released patches to fix numbered CVE-2017-8464 vulnerability, a local user or a remote attacker can exploit this vulnerability to generate a specially crafted shortcut, and through a removable device or a remote shared way lead to remote code execution, Dating back...

SSRF, Memcached and other key-value injections in the wild

Back in 2012 we released SSRF a different techniques to exploit Memcached servers and other services with host-based authentication through SSRF. Two years after, in 2014, I presented a Memcached injection techniques at Black Hat USA . There I mentioned that it’s possible to exploit it as a Remot...

On the MalwareTech Arrest, Stamos' Black Hat Keynote and More

Mike Mimoso and Chris Brook discuss the news of the week, including how Marcus Hutchins, aka MalwareTech was arrested in Las Vegas, Alex Stamos’ Black Hat keynote, and this week’s proposed IoT legislation. Download: ThreatpostNewsWrapAugust42017.mp3 Show notes: Wannacry Hero Arrested, One of Two...

First only WiFi worms of the birth: a complete parsing Broadcom WiFi chip Broadpwn vulnerability to and including EXP / to POC-the exploit-warning-the black bar safety net

The past few months, Android and iOS, billions of devices are there have been terrible WiFi remote code execution vulnerability BroadPwn it. Google 7 early release a repair patch, and Apple is in the 7 on 19, released update. While the opening was in full swing the Black Hat 2017 on security...

Black Hat 2017: training, cybersecurity trends and end-point protection

Every year, Black Hat is a highly anticipated event in the cybersecurity community--and Black Hat 2017 certainly did not disappoint! It was yet another year of record traffic, bustling with visitors from the security community that want to strengthen their security skills and postures...

Black Hat USA 2017 Recap

What do you get when you put hackers, gambling, and dogs together? Black Hat USA 2017 …and a random zoo conference happening next door. Last week, we wrapped up another successful trip to Las Vegas for Black Hat. For those of you who couldn’t make it or had too much Vegas fun and need a reminder ...

August 2, 2017 – Morning Cyber Coffee Headlines – “Declaration of Independence” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 2, 2017 - Headlines Carbon Black in the News: Carbon Black Hires Former...

Will The Real Security Community Please Stand Up

Threatpost Op-Ed is a regular feature where experts contribute essays and commentary on what’s happening in security and privacy. Black Hat 2017 was a vocabulary lesson for white-hats, and yes, words matter. Words such as nihilism, empathy and inclusion have to matter, because what you’re doing n...

August 1, 2017 – Morning Cyber Coffee Headlines – “August” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 1, 2017 - Headlines Carbon Black in the News: Carbon Black Appoints Form...

blackteenuploads.com XSS vulnerability

Open Bug Bounty ID: OBB-271218 Description| Value ---|--- Affected Website:| blackteenuploads.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of July 24, 2017

This week, I attended the Black Hat conference in Las Vegas, Nevada. 2017 marked the 20th anniversary of the Black Hat conference. A lot has certainly changed since I started attending back in 2002. I’m sure that many will have their opinions on the central themes that they saw at the conference...