The Cyber Threat Perspective
SecurIT360
Step into the ever-evolving world of cybersecurity with the offensive security group from SecurIT360. We’re bringing you fresh content from our journeys into penetration testing, threat research and various other interesting topics.brad@securit360.com
Episodes
Mentioned books
Sep 14, 2022 • 31min
Episode 7: How to Make Threat Actors Cry
In this episode Brad and Spencer talk about what mature, proactive organizations are doing to harden and secure their environments, with the end goal of forcing attackers to make more noise which hopefully leads to quicker detection and ejection from your network. These are things that get us caught and slow us down on penetration tests and they are things that will absolutely do the same to real threat actors. Blog: https://offsec.blog/Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfwTwitter: https://twitter.com/cyberthreatpovWork with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇Spencer's Links: https://click.spenceralessi.com/mylinks Work with Us: https://securit360.com
Sep 9, 2022 • 22min
9-9-22 Week in Review: New EvilProxy Phishing Service and Linux Malware
In this week's review:New EvilProxy Phishing Service Allowing Cybercriminals to Bypass 2-Factor SecurityNew Linux Malware Evades Detection Using Multi-stage DeploymentBlog: https://offsec.blog/Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfwTwitter: https://twitter.com/cyberthreatpovWork with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇Spencer's Links: https://click.spenceralessi.com/mylinks Work with Us: https://securit360.com
Sep 7, 2022 • 24min
Episode 6: 5 Ways to Get More Value out of your External Penetration Test
Dive into the essentials of getting the most out of your external penetration tests. Discover the importance of asset inventory for effective testing and how understanding existing systems can enhance results. Learn about the crucial role of identifying security risks and leveraging open-source intelligence. The podcast stresses the significance of aligning testing objectives with client goals and emphasizes the value of building strong relationships with testers, turning assessments into valuable learning experiences.
Sep 2, 2022 • 27min
9-2-22 Week in Review: Okta Phishing, BEC Analysis, LNK Attacks
In this week's reviewRoasting 0ktapus: The phishing campaign going after Okta identity credentialsAdvanced BEC Scam Campaign Targeting Executives on O365The Rise of LNK Files (T1547.009) and Ways To Detect ThemBlog: https://offsec.blog/Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfwTwitter: https://twitter.com/cyberthreatpovWork with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇Spencer's Links: https://click.spenceralessi.com/mylinks Work with Us: https://securit360.com
Aug 31, 2022 • 31min
Episode 5: Common High Risk Findings on Internal Penetration Tests & How to Mitigate Them
Internal penetration tests reveal shocking yet common high-risk vulnerabilities like weak passwords and misconfigurations. The discussion dives into the dangers of storing passwords in plain text and the need for better security education. Revamping password policies and embracing random generation is advocated. Common vulnerabilities in Active Directory configurations are unveiled, specifically regarding privilege escalation. Legacy systems pose significant risks with relay attacks, highlighting the urgency for improved practices in the cybersecurity landscape.
Aug 26, 2022 • 32min
8-26-22 Week in Review: LastPass Breach, Office 365 Abuse, DevSecOps
In this week's reviewHackers Breach LastPass Developer System to Steal Source CodeYou Can’t Audit Me: APT29 Continues Targeting Microsoft 365 | MandiantThe GitLab 2022 Global DevSecOps SurveyBlog: https://offsec.blog/Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfwTwitter: https://twitter.com/cyberthreatpovWork with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇Spencer's Links: https://click.spenceralessi.com/mylinks Work with Us: https://securit360.com
Aug 24, 2022 • 32min
Episode 4: 7 Awesome Ways to Show Off Your Skills as a Pentester
Explore the importance of showcasing penetration testing skills for career growth. Discover strategies to overcome industry hurdles and how to leverage platforms like GitHub. Learn about the significance of networking through CTF competitions and sharing knowledge in the cybersecurity community. Embrace video content creation to build confidence and combat imposter syndrome. The discussion also highlights certifications, vulnerability research, and bug bounties as essential tools for advancing in the field.
Aug 19, 2022 • 23min
8-19-22 Week in Review: Password Snooping, Supply Chain, Cl0p Ransomware
In this week's reviewCleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPYRealtek SDK Vulnerability Exposes RoutersInfoSec Handlers Diary Blog - SANS Internet Storm CenterCVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflowClop Ransomware Gang Breaches Water Utility, Just Not the Right Onehttps://twitter.com/malwrhunterteam/status/1559244860636413952?s=20&t=ixiTRaQ9aflHzI37D_VlwQhttps://twitter.com/UK_Daniel_Card/status/1559252446320500741?s=20&t=ixiTRaQ9aflHzI37D_VlwQBlog: https://offsec.blog/Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfwTwitter: https://twitter.com/cyberthreatpovWork with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇Spencer's Links: https://click.spenceralessi.com/mylinks Work with Us: https://securit360.com
Aug 17, 2022 • 32min
Episode 3: It's a Trap! Avoid These 4 Common Pentesting Mistakes
Dive into the thrilling world of penetration testing! Discover four common pitfalls that testers face, including the urgent need for thorough documentation and clear communication. Hear a captivating personal tale that illustrates the risks of rushing during reconnaissance. Learn how high-quality visuals can enhance reports and better engage clients. Emphasize professionalism and the importance of discretion when reporting findings to protect sensitive information. This conversation is a valuable guide for both new and seasoned pentesters!
Aug 12, 2022 • 24min
8-12-22 Week in Review: BumbleBee Malware & High Profile Phishing Attacks
In this week's reviewBumbleBee Roasts Its Way to Domain AdminSMS & Voice Phishing Attackshttps://www.twilio.com/blog/august-2022-social-engineering-attackhttps://blog.cloudflare.com/2022-07-sms-phishing-attacks/https://blog.talosintelligence.com/2022/08/recent-cyber-attack.htmlBlog: https://offsec.blog/Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfwTwitter: https://twitter.com/cyberthreatpovWork with Us: https://securit360.comBlog: https://offsec.blog/Youtube: https://www.youtube.com/@cyberthreatpovTwitter: https://x.com/cyberthreatpov Follow Spencer on social ⬇Spencer's Links: https://click.spenceralessi.com/mylinks Work with Us: https://securit360.com
