Original security research and analysis from OSec (OccamSec).https://www.osec.com/en-ushttps://www.osec.com/resources/blog/pip-dreams-and-security-schemes-part-ii-the-interpreter-in-the-machine/https://www.osec.com/resources/blog/pip-dreams-and-security-schemes-part-ii-the-interpreter-in-the-machine/A follow-up to the original pip configuration research. pip operates in CI/CD environments with access to private registries, cloud credentials, and build systems. This article challenges the assumption that pip is merely a neutral delivery mechanism, revealing that the tooling itself presents…Thu, 04 Jun 2026 00:00:00 GMTVulnerability ResearchMatt Landershttps://www.osec.com/resources/blog/rotten-apples-returns-macos-codesigning-translocation-revisited/https://www.osec.com/resources/blog/rotten-apples-returns-macos-codesigning-translocation-revisited/In 2021, OSec's vulnerability research team discovered a flaw in amfid that allowed transplanting codesigning entitlements from one binary to another. We called it "Rotten Apples." Apple's M1 release inadvertently patched this specific bug, though Apple never acknowledged it as a vulnerability,…Thu, 07 May 2026 00:00:00 GMTVulnerability ResearchBrandon Duncanhttps://www.osec.com/resources/blog/what-claude-security-gets-right-and-what-it-misses/https://www.osec.com/resources/blog/what-claude-security-gets-right-and-what-it-misses/Anthropic just opened Claude Security to public beta. It scans your codebase, finds vulnerabilities, and writes the patch, all in one sitting, no ticket queue. That's a genuine capability worth taking seriously.Tue, 05 May 2026 00:00:00 GMTAIChristian Kimballhttps://www.osec.com/resources/blog/hollywood-has-always-run-on-fragmentation-ai-is-making-that-everyones-problem/https://www.osec.com/resources/blog/hollywood-has-always-run-on-fragmentation-ai-is-making-that-everyones-problem/It takes a village to make a movie. A very large, geographically distributed, loosely governed village, and most of it has no idea what the rest of it is doing with your data.Tue, 14 Apr 2026 00:00:00 GMTAIMark Stamfordhttps://www.osec.com/resources/blog/cip-003-11-is-here-heres-how-to-comply-without-breaking-your-ot-environment/https://www.osec.com/resources/blog/cip-003-11-is-here-heres-how-to-comply-without-breaking-your-ot-environment/The "low impact" label has always bothered me.Thu, 09 Apr 2026 00:00:00 GMTComplianceChristian Kimballhttps://www.osec.com/resources/blog/test-your-people-not-just-your-filters/https://www.osec.com/resources/blog/test-your-people-not-just-your-filters/Your phishing simulation told you 12% of employees clicked, unfortunately this is mostly meaningless. What could an attacker do next?Tue, 07 Apr 2026 00:00:00 GMTOffensive SecurityCayce Mahonhttps://www.osec.com/resources/blog/nobody-gives-a-s-t-about-cybersecurity-a-postcard-from-the-edge-of-the-industry/https://www.osec.com/resources/blog/nobody-gives-a-s-t-about-cybersecurity-a-postcard-from-the-edge-of-the-industry/As the CEO of a cybersecurity company, I realize that it may seem strange to say that no one really cares about the very thing we sell; bear with me.Mon, 23 Mar 2026 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/the-validation-layer-for-ai-why-verifying-vulnerabilities-matters-as-much-as-finding-them/https://www.osec.com/resources/blog/the-validation-layer-for-ai-why-verifying-vulnerabilities-matters-as-much-as-finding-them/AI has changed what's possible in security testing. Tools powered by LLMs can scan thousands of assets, surface potential vulnerabilities, and generate findings at a scale and speed no human team could match on its own. For enterprises managing complex, distributed environments, that capability…Wed, 18 Mar 2026 00:00:00 GMTAIJimmy Fisherhttps://www.osec.com/resources/blog/the-day-zero-trust-died/https://www.osec.com/resources/blog/the-day-zero-trust-died/Your security stack has a new problem, but you can't see it. Because it doesn't look like a threat. It has valid credentials, authorized access, and a perfectly legitimate reason to be reading your email, touching your databases, and pushing code to production. But it hasn't gone through a security…Mon, 09 Mar 2026 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/wrongfully-accused-ai-and-the-murder-of-cyber-security/https://www.osec.com/resources/blog/wrongfully-accused-ai-and-the-murder-of-cyber-security/On a cold February morning (at least, on the East Coast), the world awoke to a post by AI company Anthropic that their flagship product, Claude, was finding security vulnerabilities at an alarming rate (https://red.anthropic.com/2026/zero-days/). With a headline that provoked both fear ("…growing…Wed, 04 Mar 2026 00:00:00 GMTAIMark Stamfordhttps://www.osec.com/resources/blog/ai-agents-are-already-hacking-you-your-internal-controls-wont-save-you/https://www.osec.com/resources/blog/ai-agents-are-already-hacking-you-your-internal-controls-wont-save-you/Something shifted in September 2025, and most organizations still haven't processed it, and yes, this is talking about AI (and specifically systems relying on LLM's), but bear with us.Tue, 24 Feb 2026 00:00:00 GMTAIJimmy Fisherhttps://www.osec.com/resources/blog/the-10m-distraction-why-50-000-cves-dont-matter-but-3-attack-paths-do/https://www.osec.com/resources/blog/the-10m-distraction-why-50-000-cves-dont-matter-but-3-attack-paths-do/The latest forecast from FIRST is enough to keep any CISO awake: annual CVE disclosures are projected to surpass 50,000 in 2026, with some models predicting a surge as high as 117,000.Mon, 16 Feb 2026 00:00:00 GMTStrategyJimmy Fisherhttps://www.osec.com/resources/blog/ai-security-checklist-2025/https://www.osec.com/resources/blog/ai-security-checklist-2025/Prompt injection involves manipulating LLM behavior through crafted inputs that override system instructions. This includes direct injection (user input) and indirect injection (external data like emails, documents, web pages).Wed, 17 Dec 2025 00:00:00 GMTAIChristian Kimballhttps://www.osec.com/resources/blog/the-sandworm-in-your-dependencies/https://www.osec.com/resources/blog/the-sandworm-in-your-dependencies/In Frank Herbert's Dune, the Shai-Hulud are giant sandworms. They're sources of immense power and constant threat to anyone crossing the desert. The malware campaign that borrowed this name lived up to it: a self-replicating worm that compromised over 500 npm packages, stole credentials from…Mon, 01 Dec 2025 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/why-jlrs-3-5bn-cyber-loss-should-change-how-you-budget-security/https://www.osec.com/resources/blog/why-jlrs-3-5bn-cyber-loss-should-change-how-you-budget-security/Most cyber security spending tends to be the results of one or more of the following analysis:Thu, 25 Sep 2025 00:00:00 GMTStrategyDarren Andersonhttps://www.osec.com/resources/blog/ai-security-tools-use-cases/https://www.osec.com/resources/blog/ai-security-tools-use-cases/The artificial intelligence revolution is in full flow. With the market size for AI in cybersecurity projected to reach $146 billion by 2032, organisations worldwide are adopting AI-powered security tools fast. But underneath the marketing hype and the vendor claims, which AI applications genuinely…Tue, 26 Aug 2025 00:00:00 GMTAIChristian Kimballhttps://www.osec.com/resources/blog/continuous-exposure-management/https://www.osec.com/resources/blog/continuous-exposure-management/For years, point-in-time penetration testing has been the standard for measuring risk. Today's environments move too fast for that alone, and staying ahead takes continuous exposure management.Mon, 25 Aug 2025 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/top-7-cloud-security-trends-every-business-must-know-in-2025/https://www.osec.com/resources/blog/top-7-cloud-security-trends-every-business-must-know-in-2025/The cloud is the foundation for how many modern businesses operate, innovate, and scale. As cloud adoption deepens, so does the complexity of securing it. In 2025, the threats are more nuanced, the environments more fragmented, and the consequences of missteps more immediate.Mon, 28 Jul 2025 00:00:00 GMTStrategyJimmy Fisherhttps://www.osec.com/resources/blog/executive-order-strengthens-u-s-cybersecurity/https://www.osec.com/resources/blog/executive-order-strengthens-u-s-cybersecurity/The cybersecurity landscape just shifted. With the signing of the new Executive Order on U.S. Cybersecurity, government agencies and private companies both face sweeping changes in how they protect their digital assets. The requirements run from quantum-resistant encryption to automated IoT…Wed, 11 Jun 2025 00:00:00 GMTComplianceChristian Kimballhttps://www.osec.com/resources/blog/financial-services-threat-report/https://www.osec.com/resources/blog/financial-services-threat-report/This briefing covers the evolving cyber threats targeting financial services organizations. Our analysis shows attacks against the sector escalating in both sophistication and frequency, with ransomware incidents doubling year-over-year and Q1 2025 already surpassing 2024's total attack volume.Tue, 10 Jun 2025 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/iiot-and-ot-cybersecurity-the-next-battleground-for-cyber-adversaries/https://www.osec.com/resources/blog/iiot-and-ot-cybersecurity-the-next-battleground-for-cyber-adversaries/Operational Technology (OT) and Industrial Internet of Things (IIoT) systems are increasingly becoming prime targets for cyberattacks, signaling a significant shift in OT management and execution. According to the SANS 2023 ICS/OT Cybersecurity Survey, there were 68 attacks with physical…Sun, 16 Feb 2025 00:00:00 GMTThreatsJames Murthahttps://www.osec.com/resources/blog/stop-worrying-about-the-quantum-apocalypse/https://www.osec.com/resources/blog/stop-worrying-about-the-quantum-apocalypse/Basically zero.Tue, 11 Feb 2025 00:00:00 GMTStrategyElliot Kaplanhttps://www.osec.com/resources/blog/security-awareness-training-is-mostly-pointless/https://www.osec.com/resources/blog/security-awareness-training-is-mostly-pointless/Security awareness training has become an annual ritual: assign the modules, run a phishing simulation, log the completion rates, satisfy the auditor. This piece makes the practitioner's case that most of it is theater. It rarely changes what a capable attacker can actually pull off, and it quietly…Sat, 01 Feb 2025 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/threat-led-pen-testing-and-dora/https://www.osec.com/resources/blog/threat-led-pen-testing-and-dora/The Digital Operational Resilience Act (DORA), arriving for January 2025 and introduced by the European Union, aims to strengthen the IT resilience of financial services organizations by setting regulatory requirements for digital security and risk management. DORA places a significant emphasis on…Tue, 03 Dec 2024 00:00:00 GMTComplianceDarren Andersonhttps://www.osec.com/resources/blog/when-chatbots-strike/https://www.osec.com/resources/blog/when-chatbots-strike/From the moment we invented the wheel eons ago, our species has been on a roll, creating and refining tools that eventually carried us to the wondrous technologies we utilize today. With the advent of user-friendly artificial intelligence (AI), as we have seen in applications such as ChatGPT and…Wed, 27 Nov 2024 00:00:00 GMTAIRory Guidryhttps://www.osec.com/resources/blog/cyber-insurance-friend-or-foe/https://www.osec.com/resources/blog/cyber-insurance-friend-or-foe/Just ask yourself: "is saving the cost of the ounce of prevention worth the pounds of cures you'll need when a cyberattack comes?"Tue, 19 Nov 2024 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/enhancing-vulnerability-management-with-incenter-tag-filtering/https://www.osec.com/resources/blog/enhancing-vulnerability-management-with-incenter-tag-filtering/Organizations are drowning in a growing volume of vulnerabilities. Managing them well keeps the business resilient and its daily operations running. Tagging, already built into Incenter, streamlines that work: assign custom or predefined tags to assets, then filter vulnerability information by…Mon, 04 Nov 2024 00:00:00 GMTStrategyChristian Kimballhttps://www.osec.com/resources/blog/cisco-breached-data-posted-on-dark-web-forums/https://www.osec.com/resources/blog/cisco-breached-data-posted-on-dark-web-forums/A confirmed breach at Cisco was disclosed on dark web forums on October 14th by threat actors IntelBroker, "EnergyWeaponUser," and "zjj." The company confirmed the breach occurred on October 6th.Wed, 16 Oct 2024 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/pip-dreams-and-security-schemes-chaos-in-your-configuration-files/https://www.osec.com/resources/blog/pip-dreams-and-security-schemes-chaos-in-your-configuration-files/In the world of Python development, pip is an indispensable tool for managing packages and dependencies. While it simplifies many aspects of package management, there are risks associated with using pip configuration files (pip.conf or pip.ini) that developers and the people who manage systems…Wed, 18 Sep 2024 00:00:00 GMTVulnerability ResearchMatt Landershttps://www.osec.com/resources/blog/microsoft-patch-tuesday-analysis-september-2024/https://www.osec.com/resources/blog/microsoft-patch-tuesday-analysis-september-2024/This month's Patch Tuesday sees 79 fixes for September. Of the issues found, 19 are of a high severity and likelihood of exploitation in the future. In the wild, 4 have been actively exploited by threat actors (with one having been exploited since 2018). The class of vulnerabilities this month are…Wed, 11 Sep 2024 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/patch-tuesday-july/https://www.osec.com/resources/blog/patch-tuesday-july/For July's Patch Tuesday round-up, there were 143 security updates from Microsoft. Of the updates, a majority of the vulnerabilities are categorized as Remote-Code-Execution (RCE), followed by privilege elevation (with one exploited in the wild), and security feature bypasses. On the lower end,…Thu, 11 Jul 2024 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/microsoft-patch-tuesday-analysis-april-2024/https://www.osec.com/resources/blog/microsoft-patch-tuesday-analysis-april-2024/April 9, 2024, Microsoft released their monthly Patch Tuesday security updates, totalling over 150 new Microsoft CVE'S. Below we discuss the vulnerabilities of the highest severity, based on our analysis, as well as two vulnerabilities that are under active exploitation at the moment.Thu, 11 Apr 2024 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/llms-behaving-badly-part-1/https://www.osec.com/resources/blog/llms-behaving-badly-part-1/In this document, the first part of the results of our ongoing research in to LLMs, we examine the potential for large language models to produce malware. Our focus is on open source models as these lend themselves more easily to malicious activities (logging in to ChatGPT and trying to write…Fri, 15 Mar 2024 00:00:00 GMTAIBrandon Duncanhttps://www.osec.com/resources/blog/cost-effective-purple-penetration-testing/https://www.osec.com/resources/blog/cost-effective-purple-penetration-testing/Penetration testing plays a vital role in broader cybersecurity defensive strategies. As threats from bad actors have evolved and increased in frequency, the defensive tactics used by those tasked with thwarting attacks have also changed.Mon, 19 Feb 2024 00:00:00 GMTOffensive SecurityGabe LeBlanchttps://www.osec.com/resources/blog/microsoft-patch-tuesday-analysis-february-2024/https://www.osec.com/resources/blog/microsoft-patch-tuesday-analysis-february-2024/On February 13, 2024, Microsoft released their monthly Patch Tuesday security updates (see here), totaling 73 new Microsoft CVE's, including 2 Zero-day vulnerabilities, and 1 non-Microsoft security update. Below we discuss the vulnerabilities of the highest severity, based on our analysis.Fri, 16 Feb 2024 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/living-off-the-land-an-introduction-to-blending-in-for-red-teams/https://www.osec.com/resources/blog/living-off-the-land-an-introduction-to-blending-in-for-red-teams/Living off the Land (LotL) is a technique used by both red teams, and bad guys. It involves using existing tools, scripts, and resources that are already present in the target environment to achieve the objectives of the engagement. While not a new approach, it started officially being known as…Thu, 25 Jan 2024 00:00:00 GMTOffensive SecurityMatt Landershttps://www.osec.com/resources/blog/unleashing-the-power-of-purple-teaming-with-mitre-attck/https://www.osec.com/resources/blog/unleashing-the-power-of-purple-teaming-with-mitre-attck/MITRE ATT&CK is a globally accessible knowledge base of adversary tactics and techniques based on real-world observations. It is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service…Tue, 16 Jan 2024 00:00:00 GMTOffensive SecurityGabe LeBlanchttps://www.osec.com/resources/blog/indicators-of-compromise-ioc-understanding-identifying-and-utilizing-cyber-threat-indicators/https://www.osec.com/resources/blog/indicators-of-compromise-ioc-understanding-identifying-and-utilizing-cyber-threat-indicators/Organizations face more cyber threats every year. Ransomware, supply chain breaches, the risk of unauthorized access or malicious activity is higher than it has ever been. To detect and respond to these threats, security professionals rely on Indicators of Compromise (IOCs): pieces of forensic data…Mon, 15 Jan 2024 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/osint-in-threat-hunting/https://www.osec.com/resources/blog/osint-in-threat-hunting/Traditional defenses no longer hold up on their own against advanced attacks. Proactive threat hunting has become a core part of modern security work, letting organizations detect and neutralize threats before they do real damage. One of the hunter's sharpest tools is Open Source Intelligence…Sun, 14 Jan 2024 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/whats-up-doc-an-osec-approach-to-the-looney-tunables-bug-cve-2023-4911/https://www.osec.com/resources/blog/whats-up-doc-an-osec-approach-to-the-looney-tunables-bug-cve-2023-4911/The landscape of Linux security is forever evolving, and CVE-2023-4911 marks a watershed moment. This vulnerability, rooted deep in the GNU C Library (glibc), specifically targets the dynamic linker/loader, ld.so. As ld.so is responsible for the launching of every single dynamically linked…Wed, 11 Oct 2023 00:00:00 GMTVulnerability ResearchRory Guidryhttps://www.osec.com/resources/blog/protecting-education-cybersecuritys-vital-mission/https://www.osec.com/resources/blog/protecting-education-cybersecuritys-vital-mission/Cybersecurity is as indispensable today as electricity and running water. Everyone deserves strong security and the right to feel safe, but some industries and institutions are favored over others. Education is a case in point. Despite the essential role it plays in shaping our future, it doesn't…Tue, 05 Sep 2023 00:00:00 GMTStrategyChristian Kimballhttps://www.osec.com/resources/blog/continuous-testing-zero-days/https://www.osec.com/resources/blog/continuous-testing-zero-days/Point-in-time penetration testing has long been the mainstay of our industry. For many of our clients, testing is conducted for a period of weeks at a quarterly or semi-annual cadence. One such client had undergone a four-week engagement before transitioning to continuous penetration testing. While…Thu, 31 Aug 2023 00:00:00 GMTOffensive SecurityMark Stamfordhttps://www.osec.com/resources/blog/a-threat-model-for-space-based-data-centers/https://www.osec.com/resources/blog/a-threat-model-for-space-based-data-centers/As space becomes increasingly commercialized, there is growing interest in establishing data centers and computing infrastructure in space. On-orbit data centers could support future initiatives like space mining, space-based solar power, space tourism, and exploration missions to the Moon, Mars,…Tue, 29 Aug 2023 00:00:00 GMTStrategyMatt Landershttps://www.osec.com/resources/blog/navigating-the-sec-cybersecurity-risk-management-rules/https://www.osec.com/resources/blog/navigating-the-sec-cybersecurity-risk-management-rules/The U.S. Securities and Exchange Commission (SEC) recently proposed rules requiring companies to disclose cybersecurity incidents within four days if deemed material. The intent is sound, but the rigid deadline creates real compliance headaches for chief information security officers (CISOs). As…Thu, 10 Aug 2023 00:00:00 GMTComplianceChristian Kimballhttps://www.osec.com/resources/blog/the-sentry-holding-the-door-open/https://www.osec.com/resources/blog/the-sentry-holding-the-door-open/TLDR: During an engagement our team chained multiple lower-risk vulnerabilities into a serious exploit that captured credentials. Lower-risk issues need to be addressed as part of an overall security strategy, not deferred.Wed, 09 Aug 2023 00:00:00 GMTVulnerability ResearchSpencer Lindgrenhttps://www.osec.com/resources/blog/the_human_touch_in_cybersecurity/https://www.osec.com/resources/blog/the_human_touch_in_cybersecurity/The rise of automated penetration testing tools and services marks a real shift in how we approach cybersecurity. These tools scour networks and systems for vulnerabilities at a level of efficiency and scale that was previously unthinkable. But the deeper we go, the clearer one truth becomes:…Mon, 07 Aug 2023 00:00:00 GMTOffensive SecuritySpencer Lindgrenhttps://www.osec.com/resources/blog/optional-sql-injection/https://www.osec.com/resources/blog/optional-sql-injection/SQL injection remains one of the sharpest threats to web applications. This is a walkthrough of a blind SQL injection vulnerability in a Node.js application, caused by one insecure configuration option in Sequelize, a popular Object-Relational Mapping library. Sequelize's documentation warns about…Thu, 29 Jun 2023 00:00:00 GMTVulnerability ResearchMatt Landershttps://www.osec.com/resources/blog/mastering-fortios-exploitation-no-direct-debugging-required/https://www.osec.com/resources/blog/mastering-fortios-exploitation-no-direct-debugging-required/FortiOS proved to be a simple target when diffing because there is only one main binary, init. Running file on the binary provides some info:Wed, 14 Jun 2023 00:00:00 GMTVulnerability ResearchBrandon Duncanhttps://www.osec.com/resources/blog/unmasking-hidden-dangers-the-critical-need-for-threat-hunting/https://www.osec.com/resources/blog/unmasking-hidden-dangers-the-critical-need-for-threat-hunting/In the endless cat and mouse game of cybersecurity, threat hunting emerges as a formidable ally, proactively uncovering potential security threats before they inflict any harm. This entails an exhaustive and meticulous exploration of an organization's network and systems, on the hunt for red flags…Thu, 08 Jun 2023 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/major-incenter-updates-cover-mobile-api-cloud-and-more/https://www.osec.com/resources/blog/major-incenter-updates-cover-mobile-api-cloud-and-more/OSec's Incenter expands threat exposure and vulnerability identification to include mobile, API, and cloud environments in addition to existing external infrastructure and web application capabilities to deliver the most comprehensive consolidated security platform for Continuous Threat Exposure…Thu, 01 Jun 2023 00:00:00 GMTStrategyJimmy Fisherhttps://www.osec.com/resources/blog/exploit-for-cve-2023-2825/https://www.osec.com/resources/blog/exploit-for-cve-2023-2825/On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition (CE) and Enterprise Edition (EE) version 16.0.0. The vulnerability allows unauthenticated users to read arbitrary files through a path traversal bug. It was discovered…Thu, 25 May 2023 00:00:00 GMTVulnerability ResearchRory Guidryhttps://www.osec.com/resources/blog/getting-root-a-technical-walkthrough/https://www.osec.com/resources/blog/getting-root-a-technical-walkthrough/A good example of what continuous penetration testing turns up. OSec obtained root access on a system by chaining several vulnerabilities identified over time. That gave our team, and would have given attackers, full access to a range of sensitive data.Wed, 22 Mar 2023 00:00:00 GMTVulnerability ResearchChris Frederickhttps://www.osec.com/resources/blog/dont-put-all-your-faith-in-cyber-insurance/https://www.osec.com/resources/blog/dont-put-all-your-faith-in-cyber-insurance/A useful tool, as long as you consider the limitations.Tue, 21 Feb 2023 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/once-you-pop-you-just-cant-stop/https://www.osec.com/resources/blog/once-you-pop-you-just-cant-stop/This is the first release in a miniseries on POP chain development in popular PHP frameworks and software. The research is written to read three ways: as a developer, as an auditor, and as an attacker. It assumes you know PHP fundamentals, but the technical detail is broken down so it stays…Sun, 11 Dec 2022 00:00:00 GMTVulnerability ResearchRory Guidryhttps://www.osec.com/resources/blog/sim-swapping-an-overview/https://www.osec.com/resources/blog/sim-swapping-an-overview/While Sim Swapping has been a threat for nearly 10 years, it has gained in popularity mostly due to an emerging hacking group called Lapsus who have successfully targeted Microsoft, Uber, Samsung, T-Mobile, Nvidia, Ubisoft, Rockstar Games, as well as Brazil's Ministry of Health all since December,…Fri, 11 Nov 2022 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/i-spy-an-lfi/https://www.osec.com/resources/blog/i-spy-an-lfi/PHP Object injection occurs when user input is supplied to unserialize(). The misconception is that using PHP's unserialize() is bad practice when in reality there are plenty of reasons for developers to serialize and unserialize data and it's sometimes unavoidable when running an application that…Mon, 12 Sep 2022 00:00:00 GMTVulnerability ResearchRory Guidryhttps://www.osec.com/resources/blog/wafbypass/https://www.osec.com/resources/blog/wafbypass/If Wargames were remade in 2022, the WOPR would operate behind a Web Application Firewall (WAF). During penetration testing, security teams must identify WAF bypasses quickly rather than spending weeks researching vulnerabilities. This article documents two methods OSec discovered to bypass WAF…Tue, 28 Jun 2022 00:00:00 GMTVulnerability ResearchRory Guidryhttps://www.osec.com/resources/blog/the-move-to-logic-exploitation/https://www.osec.com/resources/blog/the-move-to-logic-exploitation/Logical exploitation is becoming more and more prevalent in place of memory exploitation in face of advancing hardware and software protections. This is most apparent in XNU based operating systems, where hardware and software protections are by far most abundant, but also as a platform agnostic…Wed, 23 Feb 2022 00:00:00 GMTOffensive SecurityBrandon Duncanhttps://www.osec.com/resources/blog/be-better-at-infosec-owasp-london/https://www.osec.com/resources/blog/be-better-at-infosec-owasp-london/OSec CEO Mark Stamford shares some insights he has learned over his career in infosec.Thu, 23 Sep 2021 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/penetration-test-or-red-team/https://www.osec.com/resources/blog/penetration-test-or-red-team/Criminals are highly creative and persistent. It's their job to develop new ways to breach your defenses and steal something of value, and they work hard at it. They are, unfortunately, exceptionally good at their jobs, costing the world more than $1 trillion in 2020 alone.Tue, 17 Aug 2021 00:00:00 GMTOffensive SecurityMark Stamfordhttps://www.osec.com/resources/blog/rotten-apples-macos-codesigning-translocation-vulnerability/https://www.osec.com/resources/blog/rotten-apples-macos-codesigning-translocation-vulnerability/It's a breezy autumn night and I'm doing some research on my Mac while lazily flipping through volume one of "OS Internals" by Johnathan Levin, specifically the chapter on the Mach-O file format. All of a sudden, a thought buds in my mind: "What if I can translocate one code signature blob from…Thu, 29 Jul 2021 00:00:00 GMTVulnerability ResearchBrandon Duncanhttps://www.osec.com/resources/blog/evolving-attacks-on-healthcare-in-2020-and-beyond/https://www.osec.com/resources/blog/evolving-attacks-on-healthcare-in-2020-and-beyond/The COVID-19 pandemic has caused hospital systems' resources to be strained to the breaking point, and in some cases, beyond. Those who manage and use information systems need to take action now.Tue, 19 Jan 2021 00:00:00 GMTThreatsChristian Kimballhttps://www.osec.com/resources/blog/owasp-london-suffolk-chapter-meeting/https://www.osec.com/resources/blog/owasp-london-suffolk-chapter-meeting/On October 8, 2020, OSec participated in a joint OWASP London and OWASP Suffolk meeting.Fri, 09 Oct 2020 00:00:00 GMTStrategyCayce Mahonhttps://www.osec.com/resources/blog/establishing-a-beachhead/https://www.osec.com/resources/blog/establishing-a-beachhead/Establishing a beachhead is an important objective during many of our security assessments. To gain further access into an environment we need to get access to an Internet facing system, which can then be used to pivot into the network. The walkthrough below is a real life example, taken from one…Thu, 30 Jul 2020 00:00:00 GMTOffensive SecurityRudolph Pereirahttps://www.osec.com/resources/blog/what-is-the-future-of-commercial-drone-security/https://www.osec.com/resources/blog/what-is-the-future-of-commercial-drone-security/Commercial drone programmes in the UK are being accelerated by the restrictions of the Coronavirus lockdown: medical PPE drops from mainland UK to the Isle of Wight, essential medicines delivered to doorsteps in Northern Ireland. These trials are early indicators of what could be possible…Thu, 23 Jul 2020 00:00:00 GMTStrategyCayce Mahonhttps://www.osec.com/resources/blog/a-security-strategy-for-the-new-normal/https://www.osec.com/resources/blog/a-security-strategy-for-the-new-normal/During the ongoing COVID-19 outbreak many security professionals have by necessity been operating tactically & in response mode, trying to identify and mitigate the security risks of organisations that have had to move rapidly to remote working. It is right that they do, as the risks are clear &…Wed, 27 May 2020 00:00:00 GMTStrategyRobert Hayeshttps://www.osec.com/resources/blog/more-secure-zoom-use/https://www.osec.com/resources/blog/more-secure-zoom-use/Some organizations have halted their use of Zoom over the security concerns and alerts that arrive almost daily. For many people it is still the only option, and it remains hugely popular for remote meetings. With "Zoombombing" on the rise and so many users reusing meeting IDs, you need to know how…Sat, 11 Apr 2020 00:00:00 GMTStrategyChristian Kimballhttps://www.osec.com/resources/blog/hostage-negotiation-and-cyber-security/https://www.osec.com/resources/blog/hostage-negotiation-and-cyber-security/In one of my past lives, before cyber security came along, I was a hostage negotiator.Wed, 11 Mar 2020 00:00:00 GMTStrategyRobert Hayeshttps://www.osec.com/resources/blog/in-the-race-to-the-cloud-what-could-possibly-go-wrong/https://www.osec.com/resources/blog/in-the-race-to-the-cloud-what-could-possibly-go-wrong/As we are constantly evaluating and refining our methodology for cloud penetration testing in a rapidly changing landscape, with both cloud native and hybrid cloud environments, we sometimes have a hard time placing our approach into established contexts of an on-prem world.Fri, 28 Feb 2020 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/emerging-trends-in-threat-actor-communication-methods/https://www.osec.com/resources/blog/emerging-trends-in-threat-actor-communication-methods/Threat actors are adapting to current intelligence gathering techniques. We are observing the switch from hidden services (i.e. Tor) to conventional communication methods that are used by the general public. Platforms such as Twitter, Facebook, and even Discord (a popular app originally intended…Thu, 02 Jan 2020 00:00:00 GMTThreatsCayce Mahonhttps://www.osec.com/resources/blog/the-industry-guide-to-being-a-successful-bad-actor/https://www.osec.com/resources/blog/the-industry-guide-to-being-a-successful-bad-actor/We thought we would provide a guide to anyone looking to be a bad actor/malicious adversary/evil hacker based on much of what we have been hearing from the security industry at large.Thu, 14 Nov 2019 00:00:00 GMTThreatsMark Stamfordhttps://www.osec.com/resources/blog/tales-from-the-red-team-crypt-episode-1/https://www.osec.com/resources/blog/tales-from-the-red-team-crypt-episode-1/Welcome to The Red Team Crypt, where we keep the most riveting testing stories. Join me, the Crypt Keeper, through this week's episode. Not everything is as it seems, and you know what they say when you assume…Wed, 30 Oct 2019 00:00:00 GMTOffensive SecurityDavin Batemanhttps://www.osec.com/resources/blog/everyone-can-be-taught-new-tricks-considerations-for-application-pen-tests/https://www.osec.com/resources/blog/everyone-can-be-taught-new-tricks-considerations-for-application-pen-tests/Application security is one of the areas that we put a great deal of our consulting efforts into and we perform many web application penetration tests (WAPT). Overtime, we've seen a shift in the technical landscape and I wanted to write up something for others to chew on.Tue, 01 Oct 2019 00:00:00 GMTOffensive SecurityCayce Mahonhttps://www.osec.com/resources/blog/lessons-learned-from-healthcare-security-assessments/https://www.osec.com/resources/blog/lessons-learned-from-healthcare-security-assessments/With cyber attack tactics and targets evolving rapidly, healthcare providers must assess how their cybersecurity (or lack thereof) will affect their patients and the integrity of their facility.Fri, 13 Sep 2019 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/linkedin-pwnage-why-we-cant-all-be-friends/https://www.osec.com/resources/blog/linkedin-pwnage-why-we-cant-all-be-friends/Last July an article appeared on the outline entitled "How to Beat LinkedIn: The Game", it's an entertaining read regardless of how you feel about LinkedIn. Ever since reading it, we've been thinking about writing up something on how we have used LinkedIn during our work.Fri, 30 Aug 2019 00:00:00 GMTThreatsMark Stamfordhttps://www.osec.com/resources/blog/do-better-penetration-tests-for-buyers-and-testers/https://www.osec.com/resources/blog/do-better-penetration-tests-for-buyers-and-testers/We do lots of penetration tests. Along the way, we've learned a few things worth sharing to get more out of penetration testing. There are caveats, of course. Specific situations need specific answers. But some generalizations hold in most cases.Sun, 30 Jun 2019 00:00:00 GMTOffensive SecurityMark Stamfordhttps://www.osec.com/resources/blog/ma-cybersecurity/https://www.osec.com/resources/blog/ma-cybersecurity/Articles appear almost daily detailing yet another significant merger or acquisition, a trend common across sectors and geographies. Also growing are the number of de-mergers and spin-outs, with new entities being created from a larger parent organisation. Over the last couple of years, I have…Tue, 16 Apr 2019 00:00:00 GMTStrategyMark Stamfordhttps://www.osec.com/resources/blog/lessons-learned-from-working-with-media-companies/https://www.osec.com/resources/blog/lessons-learned-from-working-with-media-companies/OSec has delivered security assessment and management services to a range of media companies. Below are some of the common issues discovered during these engagements and how we helped solve them. Media companies are high value targets and often the focus of determined adversaries.Thu, 14 Mar 2019 00:00:00 GMTStrategyMark Stamford