Tuesday, August 21
TOP STORY
Microsoft Corp. took down 6 domains that Russia’s Fancy Bear group was expected to deploy as part of a phishing campaign (they say they’ve taken down 84 over the past two years). Their targets? Right-leaning conservative groups. WSJ sees this as part of an increase in politically motivated attacks [paywall] leading up to the 2018 midterm elections.
TWEET OF THE DAY
Often times, you can get a shell on an Exchange box, run mimikatz, and it RAINS clear-text creds. But obviously not all those users are interactively logging onto the Exchange system. Anyone know what mechanism is storing so many plaintext creds on Exchange boxes specifically? - @_wald0
OTHER ARTICLES WE’RE READING
Burp delivers, again. New Burp Suite REST API
What happens when you put a raspberry pi on the @defcon network? Nothing. Literally.
Amit Elazari says not having an "adequate process" to get reports from the external research community might be actionable under the law (FTC). See this CSO article published in early August for a bit more.
Duo’s Thu Pham on security hipsters and their love for the zero-trust network
ABOUT ZERO DAILY
Zero Daily is a daily newsletter that highlights application security, bug bounty, and hacker focused topics. The content is curated with love by @luketucker and brought to you by HackerOne.
Friends don’t keep good things to themselves - forward this to your homies and co-workers. BTW, want to see who runs bug bounties?
Have a news tip / story to highlight? We’d love to hear about it. Email: zerodaily@hackerone.com
If you’re an attacker head straight to Outlook Web App/ActiveSync servers. If you’re a defender, concentrate security controls on them.
HackerOne is the #1 hacker-powered security platform, helping organizations find and fix critical vulnerabilities before they can be criminally exploited. As the contemporary alternative to traditional penetration testing, our bug bounty program solutions encompass vulnerability assessment, crowdsourced testing and responsible disclosure management. Discover more about our security testing solutions or Contact Us today.