Category Archives: Security Testing & Analysis

They’re Watching You! Protecting Yourself From Hidden Cameras

Posted on by

Hidden cameras, spy cameras, nanny cams—whatever you call them, you are under surveillance much more than you may realize. While outdoor perimeter cameras and doorbell cameras are commonplace and have been used for quite some time to monitor property, other nefarious hidden cameras are popping up all over the place. Generally, any camera placed inside…

The post They’re Watching You! Protecting Yourself From Hidden Cameras appeared first on TrustedSec.

Continue reading They’re Watching You! Protecting Yourself From Hidden Cameras→

Update: The Defensive Security Strategy

Posted on by

Original post:  https://www.trustedsec.com/blog/the-defensive-security-strategy-what-strategy/ Massive exposures and attacks, such as recent SolarWinds and Exchange exploit issues, have been common news lately. While the security landscape has advanced and changed, these massive exposures are continuing to occur. The question is why, and how, are they occurring? While common issues are often leveraged, the mentality around them is…

The post Update: The Defensive Security Strategy appeared first on TrustedSec.

Continue reading Update: The Defensive Security Strategy→

Obsidian, Taming a Collective Consciousness

Posted on by

The Problem On August 05, 2021, a member of the Conti ransomware group leaked some of the group’s internal playbooks and technical documentation. Irrespective of any details surrounding the leak or its contents, the event itself prompted a more widespread examination of how teams’ maintain their operational playbooks and documentation. A tweet by Mubix came…

The post Obsidian, Taming a Collective Consciousness appeared first on TrustedSec.

Continue reading Obsidian, Taming a Collective Consciousness→

Introducing iHide – A New Jailbreak Detection Bypass Tool

Posted on by

Today, we are releasing iHide, a new tool for bypassing jailbreak detection in iOS applications. You can install iHide by adding the repo https://repo.kc57.com in Cydia or clicking here on an iOS device with Cydia installed. Additionally, you can check out the code and build/install it yourself if you prefer. Once installed, iHide will add…

The post Introducing iHide – A New Jailbreak Detection Bypass Tool appeared first on TrustedSec.

Continue reading Introducing iHide – A New Jailbreak Detection Bypass Tool→

Oh, Behave! Figuring Out User Behavior

Posted on by

One topic that has always been of interest to me is how users actually use their computers. While TrustedSec does have the ability to understand a system when we encounter it, there are still mysteries around normal user behavior. Understanding user behavior becomes even more important when attempting to defeat next generation of EDRs that…

The post Oh, Behave! Figuring Out User Behavior appeared first on TrustedSec.

Continue reading Oh, Behave! Figuring Out User Behavior→

BITS Persistence for Script Kiddies

Posted on by

Introduction Using and abusing the BITS service is a lot of fun. I can’t believe Windows just gives away this hacker tool for free. But wait, wait, are you telling me that there’s more? Does it come with a free blender? What else can this service do for me? In the last installment, we covered…

The post BITS Persistence for Script Kiddies appeared first on TrustedSec.

Continue reading BITS Persistence for Script Kiddies→

The Backup Paradigm Shift: Moving Toward Attack Response Systems

Posted on by

Black Hawk Down I’m guessing a lot of us in the IT and Security space have experienced the gut wrenching feeling of not receiving that ICMP ping reply you were expecting from a production system, be it a firewall, switch, or server. Was there a recent configuration change that happened prior to the last reboot?…

The post The Backup Paradigm Shift: Moving Toward Attack Response Systems appeared first on TrustedSec.

Continue reading The Backup Paradigm Shift: Moving Toward Attack Response Systems→

Real or Fake? When Your Fraud Notice Looks Like a Phish

Posted on by

So I Received a Phishing Email… I recently received an email indicating my credit card number had potentially been stolen and used for fraud. At this point, I am used to both having my credit card number stolen and receiving messages telling me it’s been stolen when it has not. My attempt to determine whether…

The post Real or Fake? When Your Fraud Notice Looks Like a Phish appeared first on TrustedSec.

Continue reading Real or Fake? When Your Fraud Notice Looks Like a Phish→

Simple Data Exfiltration Through XSS

Posted on by

During a recent engagement, I found a cross-site scripting (XSS) vulnerability in a legal document management application and created a quick and dirty document exfiltration payload. Unfortunately, this discovery and coding happened on the final day of the engagement (*cough* reporting bonus hacking day), and I didn’t have a chance to actually put the exfiltrated…

The post Simple Data Exfiltration Through XSS appeared first on TrustedSec.

Continue reading Simple Data Exfiltration Through XSS→

ADExplorer on Engagements

Posted on by

ADExplorer is a tool I have always had in my backpack. It can be useful for both offensive and defensive purposes, but in this post, I am going to focus more on its offensive use. The tool itself can be found here: https://docs.microsoft.com/en-us/sysinternals/downloads/adexplorer A typical scenario I often face on engagements is that I have…

The post ADExplorer on Engagements appeared first on TrustedSec.

Continue reading ADExplorer on Engagements→