December 20, 2023 at 04:59PM Black Hat Europe 2023, held in London from December 4 to 7, saw over 3,600 attendees from 118 countries. The event showcased the latest in information security through 40 Briefings, four days of technical Trainings, 50 Sponsored Sessions, and 54 in-person tool demos. Top sponsors included Axonius, Bionic, KnowBe4, and … Read more
December 12, 2023 at 09:28AM Former Uber CISO Joe Sullivan disclosed details of the 2016 data breach at Black Hat Europe, reflecting on his firing and legal issues. The breach compromised 57 million accounts, and a $100,000 payment to attackers was considered a bug bounty. Sullivan emphasizes the importance of personal protections for security professionals … Read more
December 9, 2023 at 11:20AM Researchers presented the AutoSpill attack, targeting Android password managers during the autofill process. It exploits weaknesses in WebView controls, potentially leaking account credentials to the invoking app. Multiple password managers were found susceptible, with vendors taking steps to address the issue. The attack highlights the need for improved security measures … Read more
December 8, 2023 at 03:54PM Black Hat Europe 2023 predicts that escalating cyberattacks may force governments to impose tighter regulations. Jeff Moss believes a tipping point will prompt action, similar to the Sarbanes Oxley Act post-Enron. Ex-Uber CISO Joe Sullivan emphasizes the need for balanced accountability in regulation and suggests a regulatory approach could enhance … Read more
December 6, 2023 at 03:51PM Researchers uncovered a vulnerability, called “AutoSpill,” in popular Android password managers that could allow malicious apps to steal credentials through WebView’s autofill feature. Despite raising awareness and contacting affected parties, some password managers and Google have yet to effectively address the issue. The researchers suggest that passkeys could ultimately resolve … Read more
December 6, 2023 at 02:48PM At the Black Hat Europe 2023 event, Ollie Whitehouse of the NCSC stated that current cybersecurity is inadequate to counter advanced threats. He criticized security vendors for creating closed ecosystems with up-charges for better security and lacking transparency, especially regarding SaaS vulnerabilities. He advocated for basic security improvements and greater … Read more
December 6, 2023 at 11:41AM At Black Hat Europe 2023, a team from Microsoft, GitHub, and Banco Santander unveiled open source tools to detect weak cryptography, urging updates for quantum computing security. Their study found widespread use of outdated algorithms like RSA and SHA-1 in open source projects. The tools enable developers to assess and … Read more
December 1, 2023 at 03:15PM Security experts have found vulnerabilities in major firmware vendors’ UEFI systems, named “LogoFail,” which could allow attackers to deliver bootkits through unsecured BIOS image parsers, affecting many consumer and enterprise devices. This threat is undetectable by current security measures and impacts major IBVs and brands across x86 and ARM platforms. … Read more
November 30, 2023 at 01:46PM Over a decade after the Stuxnet attack, PLCs remain vulnerable due to users not implementing security controls or firmware updates. Researchers bypassed Siemens’ protocol obfuscation, exposing risks in legacy systems. Siemens advises upgrading to newer firmware with TLS and applying stronger security protocols. Meeting Takeaways: 1. Vulnerability to Stuxnet: – … Read more
November 17, 2023 at 09:02AM At Black Hat Europe, senior staff engineer Allyn Stott from Airbnb will discuss the need for a proactive approach in detecting and responding to modern attackers. Stott emphasizes the importance of involving the entire organization and aligning skill sets during the design and development phase. He suggests considering third-party security … Read more