The Interior Department OIG clearly had some fun hacking the agency’s Wi-Fi networks

While multibillion-dollar companies hire expensive outside experts to conduct elaborate mock-raids on their networks, federal agencies tend to rely on their inspectors general for that. But a new report from the Department of Interior’s watchdog would make any crack team of corporate security-testers proud. To test the hundreds of wireless security networks at the DOI, inspector general (IG) investigators surreptitiously used cheap hacking tools from publicly accessible areas to intercept and decrypt communications in multiple bureaus at the sprawling department. They found systematic weakness in the department’s security that a malicious hacker could have exploited to steal data. “The department’s failure to securely configure wireless networks has put its wireless and internal networks at high risk of compromise,” IG investigators said in a report published Wednesday. The IG’s mock attacks — which weren’t noticed by either physical security guards or IT staff — were “highly successful,” the watchdog said. In one instance, […]

The post The Interior Department OIG clearly had some fun hacking the agency’s Wi-Fi networks appeared first on CyberScoop.

Continue reading The Interior Department OIG clearly had some fun hacking the agency’s Wi-Fi networks

Beacon Object File ADVENTURES: Some Zerologon, SMBGhost, and Situational Awareness

Cobalt Strike can use PowerShell, .NET, and Reflective DLLs for its post-exploitation features. This is the weaponization problem set. How to take things, developed outside the tool, and create a path to use them in the tool. One of the newest weaponization options in Cobalt Strike are Beacon Object Files. A Beacon Object File is […] Continue reading Beacon Object File ADVENTURES: Some Zerologon, SMBGhost, and Situational Awareness

RedCommander: Open source tool for red teaming exercises

GuidePoint Security released a new open source tool that enables a red team to easily build out the necessary infrastructure. The RedCommander tool solves a major challenge for red teams around the installation and operationalization of infrastructure … Continue reading RedCommander: Open source tool for red teaming exercises

RedCommander: Open source tool for red teaming exercises

GuidePoint Security released a new open source tool that enables a red team to easily build out the necessary infrastructure. The RedCommander tool solves a major challenge for red teams around the installation and operationalization of infrastructure … Continue reading RedCommander: Open source tool for red teaming exercises

This Week in Security: Bluetooth Hacking, NEC Phones, and Malicious Tor Nodes

One of the fun things about vulnerability research is that there are so many places for bugs to hide. Modern devices have multiple processors, bits of radio hardware, and millions of lines of code. When [Veronica Kovah] of Dark Mentor LLC decided to start vulnerability research on the Bluetooth Low …read more

Continue reading This Week in Security: Bluetooth Hacking, NEC Phones, and Malicious Tor Nodes

DeimosC2: Open source tool to manage post-exploitation issues

TEAMARES launched DeimosC2, addressing the market need for a cross-compatible, open source Command and Control (C2) tool for managing compromised machines that includes mobile support. Offensive security teams often need access to a cost-effective, eas… Continue reading DeimosC2: Open source tool to manage post-exploitation issues

Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WEEK 94’ (Via the Archive)

via the respected information security capabilities of Robert M. Lee & the superlative illustration talents of Jeff Haas at Little Bobby Comics.

Permalink
The post Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WE… Continue reading Robert M. Lee’s & Jeff Haas’ Little Bobby Comics – ‘WEEK 94’ (Via the Archive)

Hackaday Links: July 19, 2020

Care to flex your ethical hacker muscles? The Defense Advanced Research Projects Agency, better known as DARPA, is running its first-ever bug-bounty program. The event is called “Finding Exploits to Thwart Tampering”, or FETT — get it? Bounty hunter? Fett? — and is designed to stress-test security hardware developed through …read more

Continue reading Hackaday Links: July 19, 2020

Video: Bad As You Want To Be – Adversary Emulation Basics

Watch Now to Amp Up Your Red Team!
Video and Slide Deck from EH-Net Live! May 2020
OK… so your infrastructure is pretty much locked down, your SOC is solid, you do regular pentests and even leveled up your organization’s capabilities to inc… Continue reading Video: Bad As You Want To Be – Adversary Emulation Basics