Specialist Security Blog

A blog providing opinion, advice and research surrounding specialist information, security threats and challenges from 7Safe's technical experts.

  • Penetration tester at work

    PoSH SQL

    Feb 12, 2016

    Many pentesters struggle to integrate PowerShell + SQL into their engagements in a secure manner. 7Safe’s Owen Sheering shows how it should be done.
  • hacksight

    Zero-day protection

    Nov 13, 2015

    At 7Safe our experts are keen to share their latest learnings and findings. Will Hunt, one of our key Penetration Testers and Digital Forensics Consultants, has taken time to discover insecure service binary vulnerabilities in the software referenced below from three different vendors..
  • Android Robot sleeping

    Stagefright: 99% of Android phones vulnerable while "owner is asleep"

    Jul 31, 2015

    A serious vulnerability has recently been discovered, by Joshua J. Drake Vice President of platform research and exploitation at Zimperium zLabs, in Android that could allow malware hidden inside a modified media file to be sent via MMS to your device knowing only your phone number.
  • hacksight

    ‘Redirect to SMB vulnerability’: Return of the credential stealer

    May 12, 2015

    Hackers always have a targeted interest in credentials. Just like a burglar would prefer to have a key to a house, credentials provide them easy access to systems. Quite often, a seemingly innocent way of working can be tweaked slightly to be used in a nefarious way. This also applies to a vulnerability called “Redirect to SMB”, which is a variation on an old attack.
  • 1831

    Impact on SSL from the revised PCI DSS v3.1 Standard on organisations handling cardholder data

    Apr 27, 2015

    The recently announced updates to the PCI DSS standard result in all versions of the SSL protocol and early versions of the TLS protocol (TLS v1.0) no longer meeting the PCI SSC’s definition of “strong cryptography”. Organisations handling cardholder data must seek to be compliant with these revised standards and will be required to make changes to their IT infrastructures by discontinuing the use of SSL and TLS v1.0 and moving to more suitable options by 30 June 2016. The suitable options at present are the recent versions of TLS giving preference to the latest version of TLS, v1.2 as a long term solution.
  • Depositphotos_35312097_s

    How the ‘FREAK’ attack is affecting our devices

    Apr 08, 2015

    It looks like the security mechanisms commonly used by our web browsers are not done with getting bad press. The “Transport Layer Security (TLS)” technology and its predecessor, “Secure Sockets Layer (SSL)”, are cryptographic mechanisms designed to provide communications security over a computer network and are used literally everywhere. Recently, a group of cryptographers at INRIA, Microsoft Research and IMDEA discovered a new bug affecting this technology which is now known as the “FREAK” attack (Factoring RSA Export Keys). Devices shown to be affected by FREAK include iPhones, Android devices and Macs running OS X.
  • Depositphotos_53301819_s

    Norway’s Digi.no reveals the use of “IMSI catchers” set up to gather sensitive information

    Jan 06, 2015

    Our head of penetration testing, Aleksander Gorkowienko, along with Norway-based colleague Øyvind Stensby has had an article published online by Digi.no that looks at the use of IMSI catchers set up to provide unknown third-party sensitive information. This follows on from an article by Aftenposten, Norway's largest newspaper, about the discovery that members of the [...]
  • Poodle

    POODLE: A new vulnerability in SSLv3

    Oct 07, 2014

    In October 2014, an OpenSSL vulnerability relating to Secure Socket Layer (SSL) was discovered by Bodo Moeller, Thai Duong and Krzysztof Kotowicz of Google Security. SSL is the standard security technology for establishing encrypted communications between a web browser and a web site, and ensures that the transmitted data remains private. It is used in a variety of websites, including online shopping and many other sites which processes your personal details. This issue only affects SSLv3, which has so far been widely considered secure.
  • shutterstock_208077409

    LinkedIn Breach Commentary

    Jun 08, 2012

    On 6 June 2012, LinkedIn confirmed the reports that it had been subject to a large-scale password compromise, with. hackers posting a file online that contained millions of “encrypted” passwords. Why “encrypted” in quotes? This posting explains why and, in doing so, how passwords can be safely stored.
  • hacksight

    Hacking Oracle From the Web: Part 2

    Oct 28, 2011

    The first sequel of this paper was released in 2010 and it discussed the privileges needed to execute OS code when exploiting a SQL Injection in a web application which has an Oracle back-end. This paper examines new techniques to execute multiple statements via SQL Injection. No special privileges are needed to use these techniques [...]
Previous Page
Next Page