Hack with Metasploit: Announcing the UNITED 2017 CTF

Got mad skillz? Want mad skillz? This year at Rapid7s annual UNITED Summit, were hosting a first-of-its-kind Capture the Flag CTF competition. Whether youre a noob to hacking or a grizzled pro, youll emerge from our 25-hour CTF with more knowledge and serious bragging rights. Show off your 1337...

You've Got 0-Day!

Hey all, it feels like its been forever since I wrote a blog post that wasnt about some specific disaster currently consuming the Internet, so I just wanted to drop a note here about how Ill be speaking at UNITED 2017, Rapid7s annual security summit in Boston September 11-14. Specifically, Ill be...

Top Reasons for Graduate Students to Attend UNITED

The countdown is on to Rapid7s annual UNITED Summit in Boston on September 13-14. Rapid7 has partnered with top universities all over the globe to provide students with industry-leading security solutions as part of their coursework, equipping them with hands-on knowledge as they head into the...

IT threat evolution Q2 2017

Targeted attacks and malware campaigns Back to the future: looking for a link between old and new APTs This year's Security Analyst Summit SAS included interesting research findings on several targeted attack campaigns. For example, researchers from Kaspersky Lab and King's College London present...

Amazon Macie and Deep Security

Amazon S3 stores trillions of objects and regularly peaks at millions of requests per second. By any metric, it’s massive. With unparalleled durability and availability, it’s the backbone of AWS’ data services. This morning at the AWS Summit in New York City, AWS launched a new service: Amazon...

IRS Warns Tax Professionals of New Scam to Steal Passwords

The Internal Revenue Service IRS, acting in concert with state tax agencies and the tax industry, has issued an IRS Security Summit Alert for tax professionals to beware of a new phishing email scam. Scam operators often use fraudulent e-mails to entice their targets to reveal login credentials...

IRS Launches 'Don't Take the Bait' Series

As part of its Security Summit effort, the Internal Revenue Service IRS will be launching a new educational series called "Don't Take the Bait" on July 11, 2017. As part of the "Protect Your Clients, Protect Yourself" campaign, this series will provide information about phishing scams targeting t...

AWS Public Sector Summit 2017: Cloud Super Powers and Security

Coalfire recently returned from the Amazon Web Services AWS Public Sector Summit, held in Washington, D.C., which addresses some of the most pressing issues todays leaders face around security, governance and compliance, and more. While Coalfire has attended the show in the past, we were especial...

Mark Dowd on Exploit Mitigation Development

Mark Dowd, fresh off his 2017 Security Analyst Summit keynote, discusses why certain exploit mitigations have been so successful in driving up the cost of exploit development for attackers...

Wallarm is Kairos Society fellow!

Do you know what Kairos Society is? Frankly speaking, we had never heard of it until the beginning of the year. Now we’re amazed at how lucky we are. Here is why. What is Kairos society? Kairos team reached out to us by saying that we’re one of the nominees for Top50 Innovative Companies 2017 —...

Command Execution Through Collection Name

summit is vulnerable to command execution. There is an unsafe eval in summit which allows an attacker to execute arbitrary commands through a malicious collection name. This only happens when using the PouchDB driver...

On Baseband Vulnerabilities, SIEMs, Samsung Tizen and More

Mike Mimoso, Tom Spring, and Chris Brook recap two conferences from last week: Infiltrate Con in Miami and Kaspersky Lab’s Security Analyst Summit in St. Maarten. A baseband vulnerability, SIEMs, vulnerabilities in Samsung’s Tizen operating system, and an IoT honeypot are discussed. Download:...

Travel Routers, NAS Devices Among Easily Hacked IoT Devices

SINT MAARTEN—A researcher only needed 20 minutes last week to explain just how hopelessly broken some of the more popular Internet of Things devices on the market these days are. Jan Hoersch, an IT security consultant at Securai GmbH, a small pen-testing firm based in Munich, described...

Harvest: Login bypass on travel.██████████ aka "Harvest Spring Summit 2017"

Introduction I stumbled upon http://travel.████. It looks like the portal for Harvest Spring Summit 2017 travel planning and announcement. I was able to gain access to this portal and view the travel itineraries of some of the summit's participants. A note on scope I realize this domain is not...

U.S. Trade Group Hacked by Chinese Hackers ahead of Trump-Xi Trade Summit

Researchers have uncovered a Chinese cyber-espionage against the United States ahead of the trade summit on Thursday between US President Donald Trump and China's President Xi Jinping. According to a new report published today by Fidelis Cybersecurity firm, the Chinese APT10 hacking group implant...

Security Analyst Summit 2017 Day Two Recap

SINT MAARTEN—Mike Mimoso and Chris Brook recap the second day of Kaspersky Lab’s Security Analyst Summit, including how a Brazilian bank was compromised, a talk by Swisscom’s Markus Neis, and David Jacoby and Frans Rosen’s Hacking for Humanity talk. Download:...

Security Analyst Summit 2017 Day One Recap

SINT MAARTEN—Mike Mimoso and Chris Brook recap the first day of this year’s Security Analyst Summit, including Mark Dowd’s memory corruption bug keynote, Thomas Rid, Daniel Moore, Juan Andres Guerrero-Saade, and Costin Raiu’s Moonlight Maze talk, ATM hacking, and the Lazarus APT. Download:...

FIVE MINUTES WITH: Judy Piper, Senior Engineering Manager, Akamai's Enterprise & Carrier Division

No matter what else she does in her day, Judy Piper is, first and foremost, a people manager. Her role as a senior engineering manager in the Enterprise business unit is all about empowering others, and her curiosity and fearlessness help her succeed. Judy recently answered a few questions about...

On SAS 2017, the Microsoft IIS Zero Day, and Mirai

Mike Mimoso and Chris Brook preview this year’s Security Analyst Summit and discuss the news of the week, including a Microsoft IIS zero day, a new Mirai variant, and the broadband privacy ruling. Download: ThreatpostNewsWrapMarch312017.mp3 Music by Chris Gonsalves...

Unsafe eval()

Overview Affected versions of summit allow attackers to execute arbitrary commands via collection names when using the PouchDB driver. Recommendation No direct patch is available at this time. Currently, the best option to mitigate the issue is to avoid using the PouchDB driver, as the package...