Cybersecurity Insights

Cyber Health: Lessons for Cybersecurity from COVID-19

Cybersecurity Trends and Insights

Much has been written about how COVID-19 has impacted cybersecurity during 2020, from heightened cybersecurity threats to foundationally challenging business […]

“What Could Possibly Go Wrong?” Attending MDIC’s Threat Modeling Bootcamp

Cybersecurity Trends and Insights

Last week, the Medical Device Innovation Consortium (MDIC) held the first of two planned bootcamps where medical device manufacturers, health […]

Threats and Solutions to Wide Body Area Networks

Architecture and Design, Threats and Vulnerabilities

The healthcare industry is under continuous attack with cybercriminals targeting poorly controlled medical devices (Schiano, Sharman, and McClean, 2018). In […]

New for 2022 – Draft Premarket Submission Guidance for Cybersecurity in Medical Devices

Compliance and Regulation

With very little fanfare and nary a whiff of warning, earlier this month the Food and Drug Administration (FDA) has […]

Compromising Azure Managed Identities with REST API

Testing, Threats and Vulnerabilities

As more organizations move to Azure it’s important to pay attention to Azure managed identity abuse. It is possible to […]

Abusing AWS Metadata Service

Testing, Threats and Vulnerabilities

AWS EC2 has a feature called the Instance Metadata Service (official documentation). This enables any EC2 instance to access a […]

Basics of Embedded Devices

Architecture and Design, Assessments

We perform a wide variety of embedded device assessments. While each device is unique, most tend to follow a pattern […]

3 Reasons Your Adaptive Authentication is Too Dumb to Protect You

Architecture and Design

Traditional authentication methods were set up for consistency. Whether your account is being accessed from your home computer or from […]

Abusing Qualcomm EDL Mode for Device Capture

Testing, Threats and Vulnerabilities, Uncategorized

EDL acquisitions are one of many ways you can bypass passcodes and gain physical access to many Android devices with […]

Bootrom versus Bootloader

Testing, Uncategorized

Bootrom Bootrom (or Boot ROM) is a small piece of mask ROM or write-protected flash embedded inside the processor chip. […]

Download a public website via git errors 33

Testing, Threats and Vulnerabilities, Uncategorized

Are you using Git? Do you publicly disclose .git files on your webroot? If developers clone directly into the webroot […]

iOS Secure Development Guide

Architecture and Design

iOS Security This guide is a collection of the most common vulnerabilities found in iOS applications. The focus is on […]

Letting Mobile Users Do What They Want Might be Your Best BYOD Security Strategy

Strategy

I’ve watched the Bring Your Own Device (BYOD) trend from a unique position: enterprises with highly sensitive data have hired […]

SIM Card Forensics

Incident Response

The SIM (subscriber identity module) is a fundamental component of cellular phones. It’s also known as an integrated circuit card […]

Your phone’s status bar is tracking you

Threats and Vulnerabilities

As of today, any application on the Apple iOS mobile platform can determine your location and uniquely fingerprint your mobile […]