Cybr | Eric | Favorites

Christophe posted an update: https://www.theverge.com/2021/8/27/22644161/microsoft-azure-d […]

Sun, 29 Aug 2021 03:30:32 -0600

https://www.theverge.com/2021/8/27/22644161/microsoft-azure-database-vulnerabilty-chaosdb

theverge.com

Microsoft Azure cloud vulnerability is the ‘worst you can imagine’

Full read / write / delete access was open to several thousand Microsoft Azure customers.

Christophe posted a new post.

Thu, 26 Aug 2021 17:12:19 -0600

How to fix 'does not contain valid cloaked content ' in sqlmap

While working through my Practical Guide to sqlmap for SQL Injections course, I ran into an issue with sqlmap’s included shellcodeexec. There was an error…

Christophe posted an update: https://anchor.fm/cybr/episodes/How-to-get-started-and-breakt […]

Thu, 17 Jun 2021 18:15:35 -0600

https://anchor.fm/cybr/episodes/How-to-get-started-and-breakthrough-in-Bug-Bounty-Hunting-with-Hakluke-e12v4s1/a-a5tl3ga

anchor.fm

How to get started and breakthrough in Bug Bounty Hunting with Hakluke by Cybr Podcast • A podcast on Anchor

Luke Stephens (aka Hakluke) has been a Pentester, Bug Bounty Hunter, and he recently worked at Bugcrowd before striking out on his own. In this episode, I ask him about his role at Bugcrowd (a bug bounty platform), how he … Continue reading

Christophe posted an update: https://9to5mac.com/2021/05/17/huge-eufy-privacy-breach/

Tue, 18 May 2021 20:37:37 -0600

https://9to5mac.com/2021/05/17/huge-eufy-privacy-breach/

9to5mac.com

Eufy privacy breach leaks both live and recorded cam feeds - 9to5Mac

A huge Eufy privacy breach has resulted in both live and recorded camera feeds being shown to complete strangers. We've confirmed ...

Christophe posted a new post.

Thu, 13 May 2021 22:54:03 -0600

Stored XSS vulnerability in image alt attribute to steal cookies (Bug Bounty)

I recently found a stored XSS vulnerability through an image alt attribute. While I can’t share any details about where, I can share details about…

Christophe posted an update: https://www.wired.com/story/vastaamo-psychotherapy-patients-h […]

Thu, 06 May 2021 04:37:46 -0600

https://www.wired.com/story/vastaamo-psychotherapy-patients-hack-data-breach/

wired.com

They Told Their Therapists Everything. Hackers Leaked It All

A mental health startup built its business on easy-to-use technology. Patients joined in droves. Then came a catastrophic data breach.

Christophe posted a new post.

Thu, 22 Apr 2021 17:44:35 -0600

The hacking video YouTube doesn't want you to see

TL;DR: YouTube took down some of our videos, and while we think that it’s an isolated and misguided incident, they can do whatever they want…

Christophe posted an update: https://www.coindesk.com/balancer-labs-bug-bounty-spot-vulnerabilities

Wed, 21 Apr 2021 16:18:51 -0600

https://www.coindesk.com/balancer-labs-bug-bounty-spot-vulnerabilities

coindesk.com

Balancer Labs Offers $2M Bug Bounty to Spot Vulnerabilities - CoinDesk

Balancer Labs will offer 1,000 ETH as part of a new bug bounty, hoping hackers will spot vulnerabilities in its V2 Vault architecture.

Nick posted a new post.

Fri, 16 Apr 2021 16:05:34 -0600

Project: DMZ and Network Hardening Tutorial with Packet Tracer

This tutorial will cover setting up a DMZ architecture as well as some other network security controls. DMZs are demilitarized zones, meaning that they are…

Juan posted a new post.

Tue, 06 Apr 2021 16:42:53 -0600

How to set up and use a WiFi Deauther workshop (Spacehuhn Tech on ESP8266)

A WiFi deauther is used to de-authenticate devices from their WiFi networks for security research, pentesting, and educational purposes. They’re also just all around super…

Christophe posted an update: https://blog.zimperium.com/new-advanced-android-malware-posin […]

Thu, 01 Apr 2021 17:39:38 -0600

https://blog.zimperium.com/new-advanced-android-malware-posing-as-system-update/

blog.zimperium.com

New Advanced Android Malware Posing as “System Update”

Zimperium's zLabs is warning Android users about a sophisticated new malicious app that disguises itself as a System Update application. It is stealing data, messages, images and taking control of Android phones.

Christophe posted an update: https://apnews.com/article/solarwinds-hack-email-top-dhs-offi […]

Mon, 29 Mar 2021 16:59:40 -0600

https://apnews.com/article/solarwinds-hack-email-top-dhs-officials-8bcd4a4eb3be1f8f98244766bae70395

apnews.com

AP sources: SolarWinds hack got emails of top DHS officials

Suspected Russian hackers gained access to email accounts belonging to the Trump administration's head of the Department of Homeland Security and members of the department's cybersecurity staff...

Christophe posted an update: https://twitter.com/engadget/status/1374189918247866398?s=20

Tue, 23 Mar 2021 03:10:48 -0600

https://twitter.com/engadget/status/1374189918247866398?s=20

Microsoft is reportedly 'in the running' to buy Discord for more than $10 billion https://t.co/7Bfd3ks9Ti pic.twitter.com/eYLYFoZAIh

— Engadget (@engadget) March 23, 2021

Christophe posted an update: https://www.pcmag.com/news/acer-falls-victim-to-50-million-ra […]

Mon, 22 Mar 2021 22:14:01 -0600

https://www.pcmag.com/news/acer-falls-victim-to-50-million-ransomware-attack

pcmag.com

Acer Falls Victim to $50 Million Ransomware Attack

Hacker group REvil appears to be the perpetrator behind the breach, which could have been facilitated by a Microsoft Exchange vulnerability.

Christophe posted an update: https://labs.sentinelone.com/new-macos-malware-xcodespy-targe […]

Fri, 19 Mar 2021 03:27:43 -0600

https://labs.sentinelone.com/new-macos-malware-xcodespy-targets-xcode-developers-with-eggshell-backdoor/

labs.sentinelone.com

New macOS malware XcodeSpy Targets Xcode Developers with EggShell Backdoor - SentinelLabs

Targeting software developers is one route to a successful supply chain attack. Now threat actors are going after Apple developers through the Xcode IDE.

Christophe posted an update: An insightful video that explains a little bit of how […]

Fri, 12 Mar 2021 16:56:45 -0700

An insightful video that explains a little bit of how data encryption works in iphones and how law enforcement is sometimes able to break into locked iphones

https://www.youtube.com/watch?v=F7xawqxI260

Christophe posted a new post.

Fri, 19 Feb 2021 19:25:25 -0700

Cybr's Injection Attacks Course Badge Gets Added to NYU Cyber Fellows Program

In addition to our Introduction to Application Security and Cross-Site Scripting badges, we are officially announcing the addition of the Injection Attacks badge to the…

Christophe posted a new post.

Wed, 17 Feb 2021 05:01:43 -0700

Detecting and Terminating Malware in Real-time

For a webinar collaboration with a friend of mine, Ell Marquez, who works at Intezer, we wanted to demonstrate how web application vulnerabilities could be…

Christophe posted an update: https://threatpost.com/wordpress-pop-up-builder-plugin-flaw-p […]

Tue, 02 Feb 2021 03:27:47 -0700

https://threatpost.com/wordpress-pop-up-builder-plugin-flaw-plagues-200k-sites/163500/

threatpost.com

WordPress Pop-Up Builder Plugin Flaw Plagues 200K Sites

The flaw could have let attackers send out custom newsletters and delete newsletter subscribers from 200,000 affected websites.

Christophe posted an update: https://www.theverge.com/2020/12/21/22194183/intel-nvidia-cis […]

Tue, 22 Dec 2020 17:23:58 -0700

https://www.theverge.com/2020/12/21/22194183/intel-nvidia-cisco-government-infected-solarwinds-hack

theverge.com

Big tech companies including Intel, Nvidia, and Cisco were all infected during the SolarWinds hack

There are many reasons why hackers might want to get into a big tech company’s systems.