It can be difficult to demonstrate the value of cybersecurity when your stack is doing its job. Here is how you can show the hidden value of cybersecurity.
A new attack vector enables hackers to more easily compromise users with malicious Microsoft Office documents.
Continuing our blog series on defense evasion, this blog dives into some practical, real-world examples of defense evasion in action.
While testing rate-limiter protection, The researcher noticed that when forcing HTTP/1 requests and injecting a space after `X-Forwarded-For` he was able to override this specific header, letting him impersonate any IP. Any internal header could have beem overridden, also the one that should not be exposed/forwarded by the client, such as `CloudFront-Viewer-Country-Region` or any other `CloudFront` enhanced header. This special security issue was affecting all AWS users with that a specific set…
Learn how The Huntress Managed Security Platform is built to equip SMBs with the ability to swiftly and accurately mitigate threats.
Read about our latest addition, API, and how it enables MSPs and IT administrators to monitor, manage and maintain their cybersecurity stack how they want.
Assessing the cyber security threat to UK organisations using Enterprise Connected Devices.
Key findings from the 5th year of the Active Cyber Defence (ACD) programme.
This blog shows how to catch an adversary moving from machine to machine, how to terminate this movement and how to evict the adversary from your network.
Azure Synapse Analytics and Azure Data Factory were vulnerable to cross-tenant access and code execution. This was made possible via a combination of (1) a shell injection RCE vulnerability in the integration runtime, (2) credentials for multiple customers stored on a shared host and (3) an insecure management server API.
We recap some of the lessons we have learned over the past year thanks to the Colonial Pipeline attack.
This report outlines the risks associated with the use of official and third party app stores.
An introduction to defense evasion as an attack tactic. Read on to explore what defense evasion is and why it’s important to understand how it’s used.
Two malicious versions were created of packages previously used by AWS. The packages were officially authored and maintained by AWS before they were removed by their legitimate author, and once the packages were removed, their names became available and the two packages were then populated with malicious code. If AWS-deployed software had any dependencies on these packages, this would have led to a dependency confusion attack.
A chain of critical vulnerabilities was discovered in Azure Database for PostgreSQL Flexible Server, allowing unauthorized read access to other customers’ PostgreSQL databases, thus bypassing tenant isolation. If exploited, a malicious actor could have replicated and gained read access to Azure PostgreSQL Flexible Server customer databases.
Sometimes hackers can be overly confident in their malware. Take a journey with us through a malware sample that contains no obfuscation whatsoever.
A technical analysis of a new variant of the SparrowDoor malware.
The Amazon SSM Agent (used for managing EC2 instances via Amazon Systems Manager) created a world-writable sudoers file, which would have allowed local attackers to inject Sudo rules and escalate privileges to root. This could occur in certain situations involving a race condition.
AWS's hotpatches for Log4shell worked as intended but introduced new container escape vulnerabilities.
Russian-speaking ransomware gang OldGremlin resumes attacks in Russia
A comprehensive guide to the NIST cybersecurity framework, its five main functions and how you can use the NIST framework to improve your cybersecurity posture.
The AWS VPN Client application is affected by an arbitrary file write as SYSTEM, which can lead to privilege escalation and an information disclosure vulnerability that allows the user's Net-NTLMv2 hash to be leaked via a UNC path in a VPN configuration file.
Learn why Huntress is built to complement—not complicate—our partners’ daily operations and deliver on our mission to secure the 99%.
A vulnerability was discovered in the Aurora PostgreSQL log_fdw extension for Amazon Relational Database Service (RDS), allowing an attacker to read files on the EC2 host and obtain credentials for an internal AWS service.
Fake giveaways hit bitcoiners again. Now on YouTube
Undocumented Azure AD APIs could allow access to internal information of any organization that uses Azure AD. Collected details included licensing information, mailbox information, and directory synchronization status.
We explore the third arm of our ThreatOps team—Support—and dive into how the team operates.
What we know about Spring4Shell so far
This year for World Backup Day, we’ve asked our friends and backup/disaster recovery experts at Servosity to share their best “backup” tips.
Take a behind-the-scenes look at what our security researchers do in this Q&A session.
