Blog

Flash is well-known to people within the cyber security industry to have a long history of security vulnerabilities as well as functionality flaws. However, it is impossible to completely uninstall Flash, as the plugin has been integrated in both Internet Explorer and Microsoft Edge, which are core applications that come with Windows builds. Therefore, the purpose of this blog post is to provide possible solutions for organisations to minimize the risks of having Flash. Continue reading

In a recent penetration test of a Moodle instance, a review of the installed plugins revealed several security issues in a plugin that has not been updated for several years. Continue reading

I've been a PCI Qualified Security Assessor (QSA) for PCI DSS requirements for some years, and I have detailed some of the more common mistakes I encounter whenever discussing PCI DSS with organisations, be they business owners, website developers Continue reading

In a recent external network engagement, which had a fairly large number of external services, I found a Jira login page available on the client's external network. Continue reading

In a recent internal network penetration test I found a slightly less conventional route to get domain administrator privileges. Continue reading

Much as they may wish to do otherwise, organisations may need to install the Java Runtime Environment (JRE) so users have the Java Plugin they need for required web-sites, and/or run installed Java applications provided as JAR files. Continue reading

In a recent penetration test ResourceLink version 20.0.2.1 was found to be vulnerable to local file inclusion (LFI). Continue reading

Internal penetration tests, as approached by Dionach, are a good exercise to assess the security of the internal networks of our clients. Continue reading

When deciding whether or not to install iOS 12, many iPhone and iPad users will be primarily concerned with the "flashier" features: Memojis, group FaceTime calls, performance improvement Continue reading

Most antivirus systems today use signature-based detection in order to identify given binaries as malware. Continue reading