Cyberis Blog

Reassuringly clear thinking.

  • Penetration testing
  • Tools and techniques

The Overlooked Control: Cache-Control in Mobile App Security

In the realm of mobile application development, attention often gravitates towards high-profile security vulnerabilities like SQL injection, business logic flaws, or weak access controls. However, one crucial aspect that often slips under the radar is the proper implementation of cache-control settings, especially when handling Network API requests. While seemingly innocuous, neglecting cache control can open a Pandora's box of security risks, a fact often overshadowed by more sensational security findings.

Read more
  • Red teaming

"Assumed Compromise" Assessments: A Guide

In red teaming, defining the business objectives of the exercise early is essential to driving the best value realisation from the exercise. Each attack simulation involves a bespoke scoping exercise, and it is during these scoping processes that we discuss different ways of potentially achieving the desirable business objectives and the pros and cons of each.

Read more
  • Penetration testing
  • Red teaming
  • Tools and techniques

Avoiding Microsoft OneNote attachments spreading malware on your network

OneNote is note-taking software, developed by Microsoft and is included in the default Office suite bundle. In recent years, OneNote files have become popular channels for attackers to distribute malware, given their common installation and Microsoft's organisational measures to block macros from running in Excel and Word.

Read more
  • Red teaming

Informed consent: Social engineering and 'assumed compromise'

"Informed consent: Permission granted in full knowledge of the possible consequences" We're familiar with the concept of informed consent; in medicine, we treat it as criminal to perform a medical intervention without valid informed consent being in place. In red teaming, informed consent is just as important.

Read more
  • Penetration testing
  • Tools and techniques

Five-Minute Fix: Frameable Responses (Clickjacking)

A 'Frameable Responses' or 'Clickjacking' vulnerability is reported when a web application allows its contents to be framed by another website. This may be reported because of a lack of a 'Content-Security-Policy' HTTP response header, and/or a lack of an appropriate 'X-Frame-Options' HTTP response header. When a page can be framed by another website, an attacker can load the target site in an iFrame on a website they control and render decoy layers over the victim site that is being framed, to trick a user into sending sensitive information or clicking a button that can cause an unintended action.

Read more
  • Penetration testing
  • Red teaming

Why you need to protect DA (Domain Admin)

This post will discuss why protecting administrative accounts responsible for the domain and the forest is so important. We will look at what is means for an attacker to gain access to these privileges and the impact of these types of breaches.

Read more
  • Penetration testing
  • Tools and techniques

Five-Minute Fix: HTTP Strict Transport Security (HSTS) Not Enforced

HTTP Strict Transport Security (HSTS) is a security enhancement for web applications in the form of a response header. When a secure web application does not return a 'Strict-Transport-Security' header with its responses to requests, this weakness will usually be reported by a vulnerability scanner or in a penetration test report. HSTS is supported by all major browsers, other than Opera Mini.

Read more
  • Tools and techniques

MOVEit Transfer Critical Vulnerability CVE-2023-34362

MOVEit is a popular file transfer application and on May 31 2023, Progress disclosed a critical vulnerability in it leading to a widespread exfiltration of sensitive data stored on the platform. The incident gained significant attention when Zellis, a major UK-based payroll provider serving numerous high-profile companies, publicly acknowledged the compromise of customer and staff personally identifiable information. Two days after the announcement, the vulnerability was assigned CVE-2023-34362. However, it is suspected that threat actors had been exploiting the vulnerability for at least four days prior to the disclosure. While the exact number of affected victims remains undisclosed, the attack has been characterised as involving mass exploitation and broad data theft.

Read more

Improve your security

Our experienced team will identify and address your most critical information security concerns.