/images/logo.png

TRACKFLAW

XZ Utils: the backdoor shaking the free world and cybersecurity

🕶️ New and scandalous backdoor in XZ Utils on Linux Introduction On March 29, 2024, a major security flaw was discovered in XZ Utils, a package widely used in popular Linux distributions. This flaw, known as CVE-2024-3094, allows attackers to execute code remotely on affected systems. TL;DR CVE-2024-3094 introduces a backdoor into the OpenSSH server, allowing attackers in possession of a UNIQUE private key to launch commands before the authentication step.

Why do an intrusion test on its WordPress site

Why a Penetration Test is MANDATORY for Your Wordpress Site in 2024? Introduction WordPress, as one of the most widely used content management systems (CMS) in the world, powers a significant portion of websites, ranging from personal blogs to corporate sites. However, its popularity comes with increased security risks, making penetration testing crucial for safeguarding these sites against cyber attacks. 📈 Some staggering statistics (according to lesmakers.fr): The #1 CMS in the world.

GhostRace: New concern CPU vulnerability

👻 GhostRace: Specter v2.0? TL;DR A new class of speculative execution vulnerabilities, named GhostRace, has been discovered in March 2024. This attack is particularly dangerous as it can be used to exploit a wide array of software, including web browsers, operating systems, and critical applications. The Theory But how does the GhostRace attack work? 🤔 The GhostRace attack (CVE-2024-2193) exploits flaws in synchronization primitives, which are software tools used to coordinate the execution of multiple processes or threads.

How to Hack a 20 billion euro multinational corporation (legally)?

📸 CVE-2023-2520{2|3}: How to hack MULTINATIONAL company with file upload and SSRF? Introduction Information security is now at the heart of our daily lives. On the news, on the internet, on social networks, everyone, with or without knowledge, seems to have already been a victim of a more or less serious computer attack. And this can affect small businesses as well as the biggest companies in the CAC40. If you thought the security of the world’s biggest companies was inviolable, think again.

Compromise Jenkins reading files CVE-2024-23897

💣 From a minor verbose error to full compromise The origin On January 25, 2024, researchers from Sonar published 2 vulnerabilities related to the leader in open-source continuous integration and continuous deployment (CI/CD) software: Jenkins. Jenkins plays a central role in automating software development processes for a large part of the industry, holding about 44% market share in 2023. The potential impact of these vulnerabilities is therefore significant. The most concerning flaw, identified as CVE-2024-23897, allows unauthenticated attackers to read limited data from arbitrary files and “read-only” authorized attackers to access an entire file on the Jenkins server.

Which approach to choose for conducting a penetration test?

🤔 How to choose the right approach for conducting a penetration test? Black Box, Gray Box, White Box? In the constantly evolving world of cybersecurity, where cyberattacks are becoming increasingly sophisticated, conducting penetration tests has become a necessity for businesses concerned about protecting their IT systems and sensitive data. These tests, often referred to as black box, gray box, and white box tests, are crucial components of any robust IT security strategy.

How to compromise Gitlab accounts with CVE-2023-7028 vulnerability

😮 Publicly exposing GitLab in 2024: too risky? Is exposing one’s own GitLab a good security practice? Well, you will see that it is not. 2024 starts strongly, giving good reasons not to expose this service on the Internet (but rather to host it behind a VPN). A tense start to the year On January 11, 2024, GitLab, the renowned community platform, released an important announcement concerning new versions 16.7.2, 16.

How to choose the right penetration testing provider in 2024?

🕵️ How to choose the right penetration testing provider in 2024? Is an penetration test useful? The answer is yes! Penetration testing is an essential step in IT security. They help identify vulnerabilities in an IT system and correct them before they are exploited by malicious attackers. Choosing a penetration testing provider is an important decision. It’s important to select a reliable and competent provider, capable of delivering quality results.

Reverse tab nabbing, phishing on steroids.

💉 Reverse tab nabbing, phishing on steroids. Are you familiar with reverse tab nabbing? 🐟 Reverse tab nabbing is a phishing attack technique that involves redirecting a tab’s original page to a malicious one. This technique is particularly vicious as it can trick users into thinking they’re still on the legitimate site they originally visited. An example To help you understand this attack, here’s a realistic scenario. 1️⃣ A victim browses a vulnerable site and clicks on a teaser link pointing to https://legit-store.