As the importance of cybersecurity insurance grows, we examine how insurance policies have influenced cybersecurity stacks and visa versa.
By misusing the Apiary web service and taking advantage of Apiary's use of IMDSv1, a remote attacker is able to retrieve sensitive information from various endpoints and use it to gain more access and sensitive data of other hosts in the same environment.
Weak points in modern-day corporate email security
When customers attach a CodeBuild project to their VPC, CodeBuild’s build container will apply the same network routing rules as defined in the customer’s VPC Security Group. However, CodeBuild EC2 hosts retained Internet connectivity via AWS's own VPC, thus allowing an attacker to bypass any custom VPC rules the customer had set up, and use CodeBuild for data exfiltration from the targeted environment. AWS later updated the CodeBuild service to block all outbound network access for newly creat…
Learn the latest about our initiative with the Dutch Institute for Vulnerability Disclosure and how you can get involved.
What is managed detection and response (MDR) and why is it so important? Dive into the benefits of MDR services and how it can address critical security gaps.
Cybersecurity analyst's guide on how to use machine learning to show cybercriminals' true colors
See how Huntress Managed Endpoint Detection and Response (EDR) helped combat follow-on attacks against VMware Horizon servers in real-time.
Dima Kumets explains why he wanted to make his way back to the world of MSP security—and how he ended up as a Principal Product Manager at Huntress.
What cybersecurity trends will we see in this new year? In this blog, we share some hot takes and predictions for 2022.
Huntress is monitoring an incident in which VMware Horizon Servers are being hit with Cobalt Strike. Read our up-to-date blog to learn more.
Read about the exciting new updates to our Ransomware Canaries service.
Read access of host of AWS internal Cloudformation service via XXE SSRF. The level of access with the compromised IAM role from there is unclear.
Compromise of internal AWS Glue service to assume the glue role in any AWS account that used glue.
We believe it’s time for MSP vendors to level up cybersecurity community efforts, so we’re taking the first step with a $100,000 contribution to DIVD.
Use of the AI services on AWS allows customer data to be moved outside of the regions it is used in and potentially shared with third-parties. Note: This issue is outside the scope of this database's usual criteria for inclusion, but has been kept for historic reasons, as it was included in the original CSP Security Mistakes dataset.
We recap some of the cybersecurity trends and events in 2021 to prepare for the new year.
A vulnerability in Google Cloud Platform's Identity-Aware Proxy (IAP) allowed attackers to bypass authentication and access IAP-secured web applications. The exploit involved creating a malicious IAP-secured app using the target's OAuth client ID, configuring query parameter-based routing to capture redirect tokens, and using these tokens to hijack authorized sessions.
Dataflow worker nodes ran an unauthenticated Java Management Extensions (JMX) service that under certain circumstances would be exposed to the Internet, thus allowing unauthenticated remote code execution (RCE) as root in an unprivileged container. The impact of the vulnerability depended on which service account qA assigned to Dataflow worker nodes (by default, that would be the Google Compute Engine default service account, which has the project-wide Editor role assigned).
A vulnerability was discovered in Cloud Shell that enabled command injection and remote shell access. The "Open in Cloud Shell" functionality allowed a user to provide values for both the "git_repo" and "go_get_repo" parameters, which would clone the target repo in the user's environment. While "git_repo" was validated against a list of trusted repos, "go_get_repo" was not. Therefore, an attacker could have supplied a trusted repository as "git_repo" and an arbitrary command in the "go_get_repo…
Group-IB's recommendations to mitigate this vulnerability and protect your organization.
AWS added an excessive s3:getObject permission to AWSSupportServiceRolePolicy IAM policy used by AWS Support teams, and removed it a day later.
Our partners at United Systems and F1 Solutions talk about their respective journeys with our Managed Microsoft Defender solution.
Here's how to meet the Texas HB 3834 compliance requirement for a cybersecurity awareness training program for all contractors and employees.
We recap our December 2021 episode of Tradecraft Tuesday where we dive into the Log4Shell vulnerability.
Learn how to make security awareness training enjoyable and effective by ditching fear, uncertainty, and doubt (FUD) in the Huntress Blog.
Our team is currently investigating CVE-2021-44228, a critical vulnerability that’s affecting a Java logging package.
Read about how our team investigated CVE-2021-44228, a critical vulnerability that was affecting a Java logging package.
