Changes in the ISO 27001: 2022 Revision Overview The new version of the ISO 27001:2022 standard was released in October 2022, following the release of the revised ISO 27002:2022 guidance in February 2022. Organisations have 3 years to transition from ISO 27001:2013 to ISO 27001:2022, with the deadline being October 2025. Many organisations are […]
Category: researchblog
PCI DSS 4: Self-Assessment Questionnaire Changes
PCI DSS v4.0 introduced some changes to each of the self-assessment questionnaires (SAQs). There is no change to the list of self-assessment questionnaires, and they have broadly the same eligibility criteria. Below is a summary table showing the SAQs and the number of requirements for each of the related PCI DSS versions. Although it seems […]
How to Conduct a Risk Assessment
Risk management is at the heart of information security and should be at the forefront of an organisation’s information security program. The term risk management covers all the activities associated with identifying, quantifying, and addressing the risks associated with threats and vulnerabilities. In security a risk is defined as the potential for negative impact on […]
Simple 2FA Moodle Plugin: From 2FA Bypass to Account Takeover
Author: Flaviu Popescu – Technical Consultant Introduction There are times as a penetration tester that you find something unique. It may not be unique in the field of cyber security but unique to the tester themselves. This was one of those times. During testing on a web application, a couple of interesting discoveries were made. […]
Phoenix Contact AXC F 2152 Denial of Service Vulnerability
Author: Oliver Carrigan – OT Security Consultant Introduction The Phoenix Contact AXC F 2152 is a Linux based industrial controller used within harsh industrial environments to control industrial processes such as manufacturing lines and building management systems. The controller was seen to be vulnerable to a restart vulnerability (CVE-2021-34570) which would allow an unauthenticated attacker […]
Spoofing Microsoft Outlook Contact
Author: Mike Manzotti – Senior Consultant
As part of a red team assessment, I discovered a bug affecting the latest version of Microsoft Outlook for Microsoft 365 (which was version 16.0.13801.20240 32 bit and 64-bit at the time of the discovery).
Multiple Vulnerabilities in Vivotek Camera
Author: Mike Manzotti – Senior Consultant
In a recent security engagement Vivotek Camera IT9388-HT (firmware version: 0100p) was found to be vulnerable to arbitrary file download (CVE-2020-11949) and remote command execution (CVE-2020-11950).
A Brief Story of a Red Team Security Assessment (2/2)
Author: Wesley Renshaw – Lead Consultant
The second article in our two part blog series giving you a behind the scenes look into how we conduct a Red Team Security Assessment.
A Brief Story of a Red Team Security Assessment (1/2)
Author: Wesley Renshaw – Lead Consultant
Our latest two-part blog series takes an in-depth look at a Red Team security assessment. This blog article provides technical details of our process giving you an insight on how we work.
Insecure Mobile Apps Can Lead to AWS Account Compromise
Author: Mike Manzotti – Senior Consultant
Nowadays the number mobile apps available on market stores such as Google Play or Apple’s App Store are constantly increasing. This fast-paced industry does not always consider cyber security a priority, especially when deadlines are tight, and often it is an afterthought.
In this blog I will guide you through part of a mobile app penetration test that allowed me to fully compromise an AWS account, which amongst other assets, included a WordPress website hosted on a EC2 instance.