Author: HackWatchit

Paul Clark* // What is Software Defined Radio and why should you, the noble InfoSec professional, care about it? What kind of hardware and software do you need to start working with SDR? How do you set it all up? Join Paul Clark as he answers these questions and walks through a quick demo to whet your SDR appetite. Slides can be found here: https://www.dropbox.com/s/x00d7ugz81x4pmm/BHIS%20Webcast%20May%202018.pdf?dl=0 ______________ *Paul Clark owns Factoria Labs, an organization dedicated to the propagation of software defined radio. He’s teaching some classes at Black Hat in Vegas this year. Sign up for his Introductory or Intermediate classes…

Xona Systems, provider of secure access solutions for operational technology (OT) environments, announced its partnership with Solution Synergy, a trusted digital transformation partner for critical infrastructure industries. Together, the companies will empower organizations to modernize operations with secure, identity-based access management that protects critical systems without disrupting performance or reliability. At a time when operational networks are increasingly connected — and increasingly targeted — the need for robust, streamlined access control has never been greater. This partnership combines Xona’s award-winning secure access platform with Solution Synergy’s cybersecurity and OT expertise to deliver security-first remote access and privileged user management to…

Shields up US retailers. Scattered Spider threat actors can target them Pierluigi Paganini May 17, 2025 Google warns that the cybercrime group Scattered Spider behind UK retailer attacks is now targeting U.S. companies, shifting their focus across the Atlantic. The financially motivated group UNC3944 (also known as Scattered Spider, 0ktapus) is known for social engineering and extortion. The cybercrime group is suspected of hacking into hundreds of organizations over the past two years, including Twilio, LastPass, DoorDash, and Mailchimp. Initially targeting telecoms for SIM swaps, they expanded to ransomware and broader sectors by 2023. After 2024 arrests [1, 2, 3], their activity dropped, but ties to…

He’s got a wallet thicker than a FinTech unicorn’s pitch deck, a portfolio more diversified than a payments processor’s API, and a love for all things money that borders on the obsessive. So, what on Earth do you get the dad who’s already cornered the market on cufflinks and commemorative coins? Father’s Day is upon us, and for those with dads whose hearts beat to the rhythm of the closing bell, the search for a truly original gift can feel as daunting as decoding the latest DeFi protocol. Forget the tired ties and “World’s Best Dad” mugs. This year, we’ve…

GitLab launched GitLab 18, including AI capabilities natively integrated into the platform and major new innovations across core DevOps, and security and compliance workflows that are available now, with further enhancements planned throughout the year. Additionally, GitLab Premium customers can now purchase Duo Enterprise without requiring an upgrade to GitLab Ultimate. Accelerating the AI-native developer experience with GitLab Duo GitLab 18 transforms developer workflows by further integrating AI throughout the platform. GitLab Premium and Ultimate customers can leverage AI-powered Code Suggestions for real-time code completion and code generation as well as Chat for instant access to code explanations, code refactoring,…

A new wave of attacks uses PowerShell and LNK files to secretly install Remcos RAT, enabling full remote control and surveillance of infected systems. Cybersecurity experts at the Qualys Threat Research Unit (TRU) have recently uncovered a sophisticated cyberattack that utilizes the scripting language PowerShell to secretly install Remcos RAT (Remote Access Trojan). This method allows attackers to operate undetected by many traditional antivirus programs because the malicious code runs directly in the computer’s memory, leaving very few traces on the hard drive.  For your information, Remcos RAT is a powerful tool that cybercriminals use to gain complete control over…

What the Mobius Meltdown Reveals About Smart Contract Complacency One line of bad math. 9 quadrillion tokens. $2 million gone – in under 72 hours. Mobius didn’t get rugged. It got wrecked by a copy-paste error in an unaudited smart contract — and Web3 barely blinked. But this wasn’t just a bug. It was a broadcast: Web3 is still treating financial software like weekend code sprints. ⚠️ TL;DR — The Mobius Hack in 10 Seconds Exploit: Bug in .deposit() allowed unlimited minting Token: $MBU, launched on BNB Chain Tokens Printed: 9,731,099,570,720,980,659,843,835,099,042,677 Funds Stolen: $2.16M in USDT Exit Route: Tornado Cash…

Is Your Organization Capable of Securing its Digital Assets? Reflect for a moment: are your digital assets comprehensively protected from security threats? With the proliferation of non-human identities (NHIs) and the need for a safe cloud environment, a rigorous approach to digital asset security is paramount. This is particularly crucial for organizations operating in various sectors such as financial services, healthcare, and travel, and for departments, including DevOps and SOC teams. What Are Non-Human Identities (NHIs)? NHIs, or machine identities, are a vital component of contemporary cybersecurity. These identities are born by amalgamating a “Secret” (an encrypted password, token, or…

David Fletcher// The weak password policy finding is typically an indicator of one of two conditions during a test: A password could be easily guessed using standard authentication mechanisms. A password could be easily recovered after capturing crackable password hashes. Password strength is a topic of serious contention within most of the organizations that we test.  There is a constant struggle between information security staff who want to protect the organization and the people who have to do the business that keeps it viable. As IT and security personnel, when we ask employees to construct complex passwords, we usually end…