Browse All

A security researcher describes their year-long study of machine learning and AI fundamentals, with the goal of understanding how to build and then attack ML systems. The post outlines their learning approach, courses, and materials for others interested in starting adversarial machine learning (attacking ML systems).

A security researcher will present on Shadowbunny, a technique that misuses virtual machines (software that simulates a computer) during lateral movement (when an attacker spreads from one compromised system to another). The presentation will also discuss threat hunting (searching for signs of attacks) and detection methods to identify this technique.

Race conditions in ACL (access control list, the rules that determine who can access files) application occur when a system creates a sensitive file but there is a time gap before permissions are applied to protect it, potentially allowing attackers to access the file during that window. This type of vulnerability exploits the timing between file creation and permission lockdown to expose sensitive information.

This article discusses how to measure the maturity and effectiveness of security testing programs, particularly red teaming (simulated attacks to find vulnerabilities). The author suggests using existing frameworks like CMMI (Capability Maturity Model Integration, a system developed by Carnegie Mellon University that rates how well-organized software processes are on a scale of one to five) that can be adapted to evaluate offensive security programs.

A researcher created a tool that uses Firefox's debugging API (a set of commands for controlling Firefox remotely) to extract cookies (small files that store login information and preferences) from the browser, which is useful when an attacker doesn't have administrator access or user credentials. The tool works by connecting to Firefox's debug server, sending JavaScript commands to access the Services.cookies.cookies array, and retrieving the results, though it requires the debugging feature to be manually enabled first.

Firefox includes a built-in remote debugging feature that allows attackers to access authentication tokens and cookies from a compromised system. By default, Firefox disables this feature, but malware can enable it by modifying configuration files (user.js or prefs.js) to set specific debugging preferences and remove security prompts that would alert the user.

Port-proxying is a Windows technique that allows a process listening on one network interface (such as localhost, which is only accessible locally) to be exposed on a different network interface. This is useful for scenarios like making a local-only service accessible remotely, forwarding traffic between two network interfaces, or pivoting (moving through a network to access other systems).

A researcher discovered a persistent XSS (cross-site scripting, where an attacker injects malicious code into a web page that runs in other users' browsers) vulnerability in the AWS Console several years ago. The post documents how they found the bug, the techniques they used, and Amazon's response to the discovery.

This is a brief announcement that a security blog called 'Embrace the Red' was ranked as the 10th top penetration testing blog by Feedspot (a blog aggregation service). The blog focuses on offensive security engineering, penetration testing (simulating attacks to find vulnerabilities), and red teaming (groups that act as mock attackers to test defenses).

This article explains how to use built-in OS search features (Windows Search indexing and macOS Spotlight) to quickly hunt for credentials that may be stored in plain text on machines. Rather than manually searching through files, administrators and security teams can query the OS index via command line using PowerShell scripts on Windows or the mdfind command on macOS, which is much faster and can also search binary files.

The Shadowbunny technique uses virtual machines (VMs, software that emulates a complete computer within another computer) during lateral movement (spreading from one compromised system to others) to hide attackers' presence and avoid security detection tools. Real-world attackers, including those behind Ragnar Locker Ransomware (malicious software that encrypts files for extortion), have already employed this method, making it important for security professionals to understand how to detect it.

A security bug jail is a development practice where system owners cannot work on new features if their system has more than a set number of active security vulnerabilities (for example, a limit of 3). This approach prevents security debt (accumulated unfixed flaws) from growing uncontrollably over time by forcing teams to prioritize fixing existing security issues before adding new functionality.