Undocumented Azure AD APIs could allow access to internal information of any organization that uses Azure AD. Collected details included licensing information, mailbox information, and directory synchronization status.
We explore the third arm of our ThreatOps team—Support—and dive into how the team operates.
What we know about Spring4Shell so far
This year for World Backup Day, we’ve asked our friends and backup/disaster recovery experts at Servosity to share their best “backup” tips.
Take a behind-the-scenes look at what our security researchers do in this Q&A session.
Assessing the security of network equipment.
There was a misconfiguration with Simultaneous Multi-Threading (SMT), also known as Hyper-threading, in GKE Sandbox images, causing nodes to be potentially exposed to side channel attacks such as Microarchitectural Data Sampling (MDS).
Hop behind the proverbial shoulders of one of our ThreatOps analysts and vicariously experience a day in his life.
Intelligence-Driven Attack Surface Management
What is endpoint detection and response (EDR) and why is it important? Dive into what EDR is, its history and what to look for in EDR solutions today.
Learn how to break the silence in cybersecurity culture and promote open communication to enhance your organization's security posture.
The AWS RDS service does not enable secure transport layer security by default, allowing clients to connect insecurely. Additionally, for the more commonly used MySQL and MariaDB RDS engine types, this setting cannot be enabled at all.
Azure Logic Apps use API Connections to authenticate actions to services. Having Contributor access to an Azure Resource Manager (ARM) API Connection would allow someone to create arbitrary role assignments as the connected user. This was supposed to be limited to actions at the Resource Group level, but an attacker could escape to the Subscription or Root level with a path traversal payload. The root cause of this behavior was that such a payload would meet the Swagger API definition, and it w…
Unit 42 researchers disclosed several vulnerabilities and attack techniques in GKE Autopilot to Google, the root cause being insufficient verification of allowlisted workload image names. An attacker with permissions to create a pod could have abused these vulnerabilities to (1) escape their pod and compromise the underlying node, (2) escalate privileges and become full cluster administrators, and (3) covertly persist administrative access through backdoors that are completely invisible to clus…
In this blog, we get candid about our view of today’s security space. Plus, we share all the details on how and why we build security products the Huntress way.
An exposed endpoint in the Azure Automation Service allowed to steal Azure API credentials from other customers
We discovered malicious, targeted advanced persistent threat (APT) activity on a partner's system. Here, we dive into the BABYSHARK malware strain.
Cloud Armor has a documented limitation of 8 KB as the maximum size of web request that it will inspect. The default behavior of Cloud Armor in this case can allow oversized malicious requests to bypass Cloud Armor and directly reach an underlying application. Moreover, Cloud Armor does not warn users of this limitation during policy creation or when configuring rules from within the web UI, and can only find a reference to the 8 KB limit in the [Cloud Armor documentation](https://cloud.google.…
With ransomware attacks on the rise, companies need to take a proactive approach to security. Group-IB has put together a list of actionable tips to help you protect your organization from the ransomware threats in 2022.
Hackers could be outsmarting preventive tools by making trivial changes to default settings. We dive into our research in this blog.
Opsmorph discovered an improper access control vulnerability in authorization logic common in applications built on AWS. The vulnerability means a user with permission to create a new Cognito User Group could fool authorization checks into thinking that the user is in any other existing Cognito User Group in the same User Pool, referred to as user group spoofing. When API Gateway is secured with a Cognito User Pool Authorizer it concatenates group names from the identity token into a comma sepa…
As the importance of cybersecurity insurance grows, we examine how insurance policies have influenced cybersecurity stacks and visa versa.
By misusing the Apiary web service and taking advantage of Apiary's use of IMDSv1, a remote attacker is able to retrieve sensitive information from various endpoints and use it to gain more access and sensitive data of other hosts in the same environment.
Weak points in modern-day corporate email security
When customers attach a CodeBuild project to their VPC, CodeBuild’s build container will apply the same network routing rules as defined in the customer’s VPC Security Group. However, CodeBuild EC2 hosts retained Internet connectivity via AWS's own VPC, thus allowing an attacker to bypass any custom VPC rules the customer had set up, and use CodeBuild for data exfiltration from the targeted environment. AWS later updated the CodeBuild service to block all outbound network access for newly creat…
Learn the latest about our initiative with the Dutch Institute for Vulnerability Disclosure and how you can get involved.
What is managed detection and response (MDR) and why is it so important? Dive into the benefits of MDR services and how it can address critical security gaps.
Cybersecurity analyst's guide on how to use machine learning to show cybercriminals' true colors
See how Huntress Managed Endpoint Detection and Response (EDR) helped combat follow-on attacks against VMware Horizon servers in real-time.
