• CySCA2014-in-a-Box –
    CySCA2014-in-a-Box is a Virtual Machine that contains most of the challenges faced by players during CySCA2014. It allows players to complete challenges in their own time, to learn and develop their cyber security skills.
  • From a Username to Full Account Takeover –
    Usernames, email addresses and phone numbers are invaluable pieces of information for attackers. They can be used in a large variety of attacks which in some cases result in full account takeover.
  • Replicating NSA’s gadgets using open source –
    One peek at the leaked pages of NSA’s ANT catalog made wireless security researcher Michael Ossmann’s mind start spinning. In this podcast recorded at Hack In The Box Amsterdam 2014, he shares his insights on what to use – and how – to duplicate hardware devices found in the ANT catalog.
  • NSA Playset –
    Inspired by the NSA ANT catalog, Security researchers of NSA hope the NSA Playset will make cutting edge security tools more accessible, easier to understand, and harder to forget. Now you can play along with the NSA!
  • HITB Haxpo and HITBSecConf –
    The HITB2014 Amsterdam Conference Day 1 and Day 2 Agenda, all of the presentation links and videos are available here.
  • ShmooCon 2014 & Firetalk Videos Posted to YouTube –
    The videos of ShmooCon 2014 and FireTalks recorded Friday and Saturday nights are available now. Here they are for your viewing pleasure.


  • PAExec –
    PAExec is a free, redistributable and open source equivalent to Microsoft’s popular PsExec application. Anyone can download and use PAExec.
  • Audit Project Releases Verified Repositories of TrueCrypt 7.1a –
    The team behind the Open Crypto Audit Project, which has undertaken an audit of TrueCrypt, has posted a verified repository of TrueCrypt 7.1a on GitHub. There are versions for Windows, Linux and OS X.
  • THC-Hydra –
    Hydra is a parallized login cracker which supports numerous protocols to attack. New modules are easy to add, beside that, it is flexible and very fast.
  • New Iso released –
    Archassault have released a new iso, its mainly updated with their latest tools. You can download it from here.


  • Discovering the Bluetooth UAP –
    This is a very effective method of determining the master’s UAP through passive monitoring. It is complicated, but it is only a small part of the even more complicated process of determining a piconet’s frequency hopping pattern and hopping along.
  • Mimikatz Against Virtual Machine Memory Part 2 –
    First issue was symbols in windbg. Most importantly, NO symbols for windbg. Second issue was creating the dmp file. The rest follows the same flow as the previous post.
  • Hacking Jenkins Servers With No Password –
    Here’s a fun trick Royce Davis has used on some recent security assessments to gain an initial foothold. If you aren’t familiar with the Jenkins server, it runs by default on port 8080 and also by default it has no password

Vendor/Software patches

  • Adobe, Microsoft Push Critical Security Fixes –
    Adobe and Microsoft today each released updates to fix critical security vulnerabilities in their software. Adobe issued patches for Flash Player and AIR, while Microsoft’s Patch Tuesday batch includes seven update bundles to address a whopping 66 distinct security holes in Windows and related products.


  • Red Button Flaw Exposes Major Vulnerability In Millions of Smart TVs –
    The drones, launched from the roof of a tall apartment building, have a clutch of electronic gear aboard that can capture incoming digital broadcasts, inject a bit of malicious code to the data portion of the stream, and send it back out on the same frequency.
  • Code-cracking teens hack into Grant Avenue ATM –
    Caleb Turon and Matthew Hewlett hacked a Bank of Montreal ATM and then alerted bank staff to the vulnerability of the ATM. both Grade 9 students, found an old ATM operators manual online that showed how to get into the machine’s operator mode.
  • Metasploit now includes module to exploit CVE-2014-0195 (OpenSSL DTLS Fragment Vuln.) –
    The latest release of Metasploit released on thursday includes a module to ease exploitation of CVE-2014-0195. This vulnerability in the DTLS implementation of OpenSSL was patch last week and didn’t get the attention the MitM vulnerability got that was patched at the same time.

Other News

  • Even Toilets Aren’t Safe as Hackers Target Home Devices –
    A world of connected devices makes possible “for the bad guys to have permanent entry into your household.” The vision is to connect almost everything — from cars to fridges, lamps, even toilets. Forget to flush? There’s an app for that.
  • UK plans to lock up cyberattackers for life –
    Life sentences will be handed out for cyber attackers who steal industrial secrets, cause death, injury or compromise national security.