Application Security This Week for April 25

A fun tool that finds weak Active Directory passwords, and then notifies the user.

https://github.com/AdrianVollmer/Crack-O-Matic

 

Signal pwned Cellebrite with pure Moxie.

https://signal.org/blog/cellebrite-vulnerabilities/

 

Sad news, Dan Kaminsky has left us.  He was known for his extraordinary research into DNS cache poisoning, but most importantly, he was a great person. He will be missed.

https://en.wikipedia.org/wiki/Dan_Kaminsky

 

S

Application Security This Week for April 18

Pwn2Own had some interesting browser vulnerability results:

https://www.zerodayinitiative.com/blog/2021/4/2/pwn2own-2021-schedule-and-live-results

 

Reddit (A social network) has started a bug bounty program:

https://www.reddit.com/r/redditsecurity/comments/mqse9a/announcing_reddits_public_bug_bounty_program/?sort=qa

I am user #63 on that site, and thee oldest active member who isn't an admin, so I might give it a shot.

 

A good person wrote a list for semgrep that searches for secrets in public repos (or really any code) using some really well written filters.  Check it out:

https://r2c.dev/blog/2021/dont-leak-your-secrets/

 

Hope everyone has a secure week!

Application Security This Week for April 11

Surprisingly good article from the BBC about firmware attacks

https://www.bbc.com/news/business-56671419

 

Some really interesting code related to the Windows RPC attack

https://iamelli0t.github.io/2021/04/10/RPC-Bypass-CFG.html

 

One of my favorite topics - insecure API endpoints - presented at BSides

https://blog.assetnote.io/2021/04/05/contextual-content-discovery/

 

Have a secure week, everyone.

Bill Sempf

Husband. Father. Pentester. Secure software composer. Brewer. Lockpicker. Ninja. Insurrectionist. Lumberjack. All words that have been used to describe me recently. I help people write more secure software.

 

 

profile for Bill Sempf on Stack Exchange, a network of free, community-driven Q&A sites

MonthList