We have all seen how fast things can change in 2020 but the one thing that has not changed is the number of security breaches. In fact, the coronavirus increased the security threat landscape. One reason for this increase is due to the working from home (WFH) environment created more vulnerabilities and avenues for attacks. […]
03
Sep
Sep
WordPress’ popular plugin File Manager (versions 6.0-6.8) contains a vulnerability that allows an attacker to upload files and execute commands. Indicators of compromise include filenames such as “hardfork.php”, “hardfind.php” and “x.php”. The root of this problem is connector.minimal.php, which is due to a recent name change and executes directly — allowing the upload of malicious […]
02
Sep
Sep
With every security test, Risk Crew has performed, there has been at least one attack surface that can vary in their level of security. These can be viewed as the number of accessible machines and applications within them. As a result, the number of attack surfaces is not the only security measure to be implemented […]
25
Aug
Aug
Microsoft Azure Sphere versions 20.07 and 20.06 contain vulnerabilities such as remote code execution and privileges escalation. This could allow an attacker to gain access to sensitive information and possibly get admin-level permissions on the affected machine. These vulnerabilities could have severe consequences, so make sure you patch it before it is used against you. […]
21
Aug
Aug
As security professionals with nearly two decades in the industry, we understand the significance of choosing the right penetration testing service provider. It’s important to not only look for testers with the technical skills required but they should be trustworthy highly experienced, credible and deliver on their promises of testing, reporting and remediation. They should […]
19
Aug
Aug
The NHS Test and Trace Programme leaves no doubt that it involves the processing of personal data on a large scale. The service was established to form a central part of the government’s coronavirus recovery strategy was formally launched on the 28th of May 2020. The aim of this service is to help identify, contain […]
19
Aug
Aug
Once you have successfully attained Cyber Essentials Plus (CE+) certification and the celebrations are over, what do you do? Do you just sit back and be happy that CE+ has been achieved or do you build upon it? Well, it all depends on why you undertook to achieve CE+ in the first place. Many companies […]
17
Aug
Aug
Amazon Alexa subdomains have been found to be vulnerable to Cross-Origin Resource Sharing and Cross-Site Scripting. Exploiting these would have allowed an attacker to install or remove apps without the user’s knowledge and gather information about the device and the user(s). It would have only required one click from a specially crafted amazon link. IoT […]
13
Aug
Aug
Certifying to Cyber Essentials Plus Although many organisations pursue Cyber Essentials Plus (CE+) certification in order to meet public sector contract requirements, there are other numerous benefits of Cyber Essentials Plus. These are self-evident to most information security professionals, but in case you’re struggling for words here they are. Reassure customers that you are working […]
13
Aug
Aug
The EU-US Privacy Shield was invalidated on the 16th of July 2020 by a ruling of the EU Court of Justice (CJEU). This ruling was done in the case known as Schrems II (C-3111/18). This case challenged the processes for personal data transfers between the EU and the US on the basis to hold that […]