We developed a method to detect certificate files that do not contain a real certificate. Trojanized certificates like these are often not detected by AV and IDS. Fake certificates containing a Win…

The Emotet botnet reputation precedes it; historically aggressive and malicious, today it has evolved and incorporated a number of advancements to create a m...

This is a post about injecting carriage return and line feed characters into a internal API call. I wrote this up a year ago as a Gist on…

**TL;DR**: A hacker broke into a few of Reddit’s systems and managed to access some user data, including some current email addresses and a 2007...

Unfortunately, generic IP cameras are notorious for their poor security practices. Most of the time, the manufacturer’s don’t force secure passwords, and mor...

Implementing a Trusted Third-Party System for Secure Shell

A post describing how to escape the MacOS sandbox from within Office

8 years, 12,000 customers, and over 700 extremely talented and dedicated team members later, we’ve made our mark on the industry, helping to make security easy and effective for all, and earning the love of our customers, partners, and community. I could…

TL;DR Bucket upload policies are a convenient way to upload data to a bucket directly from the client. Going through the rules in upload policies and the logic related to some file-access scenarios we show how full bucket object listings were exposed with…

On July 31st , just after getting back to the office from my talk at RSA Asia 2018 about how cyber criminals use cryptocurrencies for their malicious activities, I noticed a huge surge of CoinHive in Brazil. After a quick...

This blog post documents the experiment of our Security Researcher Ziyahan Abeniz in exploiting a Microsoft Edge browser vulnerability. Proof of Exploit video included.

Development of large complex projects is impossible without the use of programming techniques and tools helping to monitor the quality of…

Unfortunately, generic IP cameras are notorious for their poor security practices. Most of the time, the manufacturer’s don’t force secure passwords, and mor...