ntlm, security, red team — 03 July 2018 Love letters from the red team: from e-mail to NTLM hashes with Microsoft Outlook Introduction A few months ago Will Dormann of CERT/CC published a blog post [1] describing a technique where an adversary could abuse Microsoft Outlook together with OLE objects, a feature of Microsoft Windows since its early days, to force...
blockchain, solidity, smart contract, audit, security — 30 March 2018 Jury.Online smart contract security audit Introduction This blog post presents the results of a security audit of a smart contract performed by Blaze Information Security, and made public on behalf of the client Jury.Online. This post contains the very same information and findings present...
security, smart contract, blockchain, audit, solidity — 26 February 2018 ANNI tokens smart contract security audit Introduction This blog post presents the results of a security audit of a smart contract performed by Blaze Information Security, and made public on behalf of the client Array.io (formerly known as Annihilat.io). This post contains the very...
security, tools, fuzzing — 10 June 2017 Fuzzing proprietary protocols with Scapy, radamsa and a handful of PCAPs Introduction As security consultants, we act as hired guns by our clients to perform black-box security testing of applications. Oftentimes we have to assess the security of applications that use their own proprietary schemes for communication, instead of relying on...
security, gsm, bladerf, yatebts — 12 September 2016 Practical attacks against GSM networks (Part 1/3): Impersonation Introduction The Global System for Mobile Communications (GSM) is a mobile technology and the most popular standard for mobile phones worldwide. Originally known as Groupe Spécial Mobile, the GSM came through the CEPT (Conférence des Administrations Européenes des Postes et...
tools, burp, security — 29 June 2016 Turning Burp Scanner vulnerabilities into Splunk events Introduction Splunk is a fully featured, powerful platform for collecting, searching, monitoring and analyzing machine data. It is widely used by Security Operation Centre (SOC) teams to provide advanced security event monitoring, threat analytics, incident response and cyber threat management....
survey, security, webappsec — 30 May 2016 A survey on the usage of HTTP security headers in Brazil and Estonia Introduction In the recent years a number of security-oriented client-side controls for web browsers appeared in the scene in form of security headers. These headers can be used to improve the security of the user experience when interacting with a...
