Blog

Pass the hash is a technique used to steal credentials and enable lateral movement within a target network. In Windows networks, the challenge-response model used by NTLM security is abused to enable a malicious user to authenticate as a valid domain user without knowing their password.  Even though Kerberos has replaced NTLM as the preferred authenticationRead more

A critical vulnerability in vCenter Server could allow an unauthenticated attacker to execute arbitrary code on the server that hosts vCenter and so take over the system. vCenter Server is used by IT Admins to manage VMware installations and the virtual machines that run in the VMware environment.  The vulnerability (CVE-2021-21972) in a plug-in usedRead more

A new whitepaper from Microsoft highlights the risks of software supply chain attacks for organisations that pull package dependencies from public repositories like npm, RubyGems and PIP. A dependency confusion attack or supply chain substitution attack occurs when a software installer script is tricked into pulling a malicious code file from a public repository insteadRead more

Web shell attacks have doubled over the last 6 months according to Microsoft’s Detection And Response Team.  But, what are Web Shell Attacks and how can you defend against them? In a recent blog post, Microsoft’s DART detailed the rise in Web Shell Attacks that have been uncovered in Windows Defender telemetry- growing from anRead more

In the February 2021 Patch Tuesday security update Microsoft fixed 56 flaws, one zero-day vulnerability and two remote code execution vulnerabilities in the Windows Fax Service.  That’s right, someone can send you a fax and take over your Windows system. While you might be tempted to think: ‘who sends faxes these days?’ that is theRead more

The SHAREit app has over a billion users on Android – and it can be exploited to steal user’s data or run malicious code on the device. A new report from Trend Micro details the vulnerabilities in the SHAREit app, which is one of the most popular downloads from the Google Play Store. According toRead more

A hacker tried to poison the water supply in Oldsmar, Florida by dumping caustic soda into the water by adjusting the SCADA system in control of the water treatment plant. On Friday 5th February, an operator at the water plant noticed the mouse on his screen moving and accessing the control system software for theRead more

37,000 Plex Media servers exposed to the internet are being abused in DDOS attacks according to a new security report. Plex Media Server is a personal media library and streaming platform available on Windows, Mac and Linux platforms.  One of the attractions of Plex is the ability to stream your local media library to remoteRead more

The NAT Slipstreaming2.0 attack exploits the standard support for VOIP routing in NAT routers/firewalls to expose all devices on the internal network to attack from the internet. A new variant of the NAT Slipstreaming attack has been published which extends the attack to abuse the H.323 protocol used by VOIP devices to manage call forwarding. Read more

This week both SonicWall and Cisco have released patches for critical vulnerabilities in their networking products. SonicWall zero day The SonicWall vulnerability (CVE-2021-20016) is a zero-day under active attack – in fact it was used to breach SonicWall’s own network in January according to their security advisory.  The flaw affects SonicWall SMA 100 series devicesRead more