Diego Samuel Espitia If you own any Apple devices, run to update them On September 13, Apple surprised its users with a system update on iPhone, iWatch, iPad and macOS, something that doesn’t happen very often and less often comes with an...
Víctor José González Arcos DFIR services in a ransomware incident response As we saw in the first post of the series, the IR (incident response) process in case of attacks using ransomware is fundamental, relying on the work of several...
Cristina del Carmen Arroyo Siruela The human factor: a key element of cyber security When it is said that a server needs to be bastioned, cybersecurity personnel have an idea of what it is and what it consists of. But what about securing...
Telefónica Tech Cyber Security Weekly Briefing 11-17 September S.O.V.A. – New Android banking trojan Researchers at Threat Fabric have discovered the existence, at least since the beginning of August, of a new banking trojan for Android which they...
Bernardo Campillo Telefónica Tech at the top of the IoT and Big Data podium Today we want to revisit with you some good news that we received in mid-June, a little before the holiday season in July and August, a little before summer,...
Diego Samuel Espitia PackageDNA Our Development Package Analysis Framework That Made Its Debut at Blackhat After several months of research and development, during the BlackHat USA 2021 Arsenal event, you saw our deep analysis tool for development packages called PackageDNA, in the talk “Scanning...
David García D3FEND, the other side of the ATT&CK coin We are already familiar with the ATT&CK project of the MITRE corporation. It is a de facto standard that helps us to characterise threats based on the techniques and...
ElevenPaths Victory is on your ideas Victory is not always a question of numbers. In order to win, you have to believe in what you do, rely on your team and always be willing to...
Telefónica Tech Cyber Security Weekly Briefing 4-10 September Critical vulnerability in Zoho ADSelfService Plus The company Zoho has issued a security advisory warning of a critical vulnerability in ADSelfService Plus, an enterprise password and login management software. The...
Telefónica Tech ‘Choosing people to whom you can entrust is one of the biggest challenges for entrepreneurs’, Dani Aldea – Altostratus Altostratus is a specialised company in software development and digital transformation processes. Tell us about its beginnings, how did the idea come about? The idea came about in 2009, when...
Florence Broderick Evil FOCA is now Open Source We are really happy to announce that Evil FOCA is now Open Source. We have received lots of comments and feedback about how you are using Evil FOCA, or how...
Florence Broderick How to bypass antiXSS filter in Chrome and Safari (discovered by ElevenPaths) Modern browsers usually have an antiXSS filter, that protects users from some of the consequences of this kind of attacks. Normally, they block cross site scripting execution, so the...
Florence Broderick HookMe, a tool for intercepting communications with API hooking HookMe is a tool for Windows that allows to intercept system processes when calling APIs needed for network connections. The tool, still in beta, was developed by Manuel Fernández (now...
Florence Broderick How does blacklisting work in Java and how to take advantage of it (using whitelisting) Oracle has introduced the notion of whitelisting in its latest version of Java 7 update 40. That is a great step ahead (taken too late) in security for this...
Florence Broderick Quick and dirty shellcode to binary python script https://google-code-prettify.googlecode.com/svn/loader/run_prettify.js If you work with exploits and shellcode, you already know what shellcode is and how to deal with it. Sometimes it comes with exploits in C, Perl, Python…...
