Hi! Today I’m publishing a new […]

At IncludeSec we of course love to hack things, but we also love to use our skills and insights into security issues to explore innovative solutions, develop tools, and share resources. In this post we share a summary of a recent paper that I published with…

In May 2021, the Biden Administration signed Executive Order (EO) 14028, placing cloud security at the forefront of national security. Federal agencies are at different stages in their digital transformations yet are all facing similar challenges: rapidly…

PerimeterX Cybersecurity Researcher Ben Baryo discovered a skimmer served from recaptcha[.]tech and examined its progression over the course of two years.

In this paper, we identify a new class of optical TEMPEST attacks: recovering sound by analyzing optical emanations from a device’s power indicator LED. We analyze the response of the power indicator LED of various devices to sound and show that there is…

‘dmesg’ (display message) is not a popular Unix/Linux command. However, it provides vital information that can be used for troubleshooting production performance problems.

The Mosque-Cathedral of Córdoba is a chronicle of

In this post I talk about what it means to perform comprehensive Attack Surface Management by leveraging a broad spectrum of OSINT (Open…

A critical vulnerability in Azure's flagship Cosmos DB service affecting thousands of customers. Mitigation requires customers' manual actions.

Static Token And Credential Scanner. Contribute to stacscan/stacs development by creating an account on GitHub.

Enhancing the security audit logging of Harbor with OpenResty - Why and how I achieved the audit logging functionality in Harbor Private Container Registry

Introduction This post describes the work we’ve done on fuzzing the Windows RDP client and server, the challenges of doing so, and some of the results. The Remote Desktop Protocol (RDP) by...

A story of too much access and a false sense of security.

This Pegasus Spyware virus is very dangerous and that spyware multiple ways attacks of that system that saw that article... techflashes.com

Phylum is continually working to improve our author risk analysis to allow users to manage the risk presented by using code written by random strangers on the Internet. The work documented here provides valuable evidence as input into Phylum’s author risk…

DNSTake — A fast tool to check missing hosted DNS zones that can lead to subdomain takeover - GitHub - pwnesia/dnstake: DNSTake — A fast tool to check missing hosted DNS zones that can lead to subd...

A US company, Zimperium, claims that it can protect organisations and individuals from Pegasus although it is not clear if it claims.