Author: HackWatchit

Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_HowToPlayBackdoorsBreaches.pdf More info: https://www.blackhillsinfosec.com/projects/backdoorsandbreaches/ 2:09 Introduction to the types of cards in the deck, pricing, why we created B&B 10:25 Basic setup for playing the game and how to play the game 18:03 Breaking down cards and how they work 35:54 Demo Game 1 44:39 Demo Game 2 54:50 Questions and comments This webcast was originally recorded live on October 16th, 2019 with John Strand. In this webcast, we’ll show you: how the game works, how to play, how to get your team involved, how to translate to management what you learn by…

The GDPR is a law developed by the European Union (EU) to protect individuals’ personal data. Although it originated in the EU, several countries and organisations outside Europe have to date also adopted this regulation, which shows how detailed and well-thought-out it is. Among many of the GDPR’s guidelines, the data breach notification letter is one such important guideline. Click here to download our GDPR breach notification template. What is a Breach Notification Letter? A breach notification letter is a way of fulfilling the requirements of GDPR in the event of a data breach. So how does it do that,…

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Released: MITRE ATT&CK v17.0, now with ESXi attack TTPsMITRE has released the latest version of its ATT&CK framework, which now also includes a new section (“matrix”) to cover the tactics, techniques and procedures (TTPs) used to target VMware ESXi hypervisors. PoC exploit for critical Erlang/OTP SSH bug is public (CVE-2025-32433)There are now several public proof-of-concept (PoC) exploits for a maximum-severity vulnerability in the Erlang/OTP SSH server (CVE-2025-32433) unveiled last week. 54% of tech hiring managers expect layoffs in 202554% of tech hiring managers say their…

Ray Felch // Disclaimer: Be sure to use a faraday bag or cage before transmitting cellular data so you don’t accidentally break any laws by illegally transmitting on regulated frequencies. Additionally, intercepting and decrypting someone else’s data is illegal, so be careful when researching your phone traffic.  Preface: I held an Advanced Amateur Radio Operator license (KR4FF) for many years and my entire career consisted of working in the fields of Electronic Engineering and Embedded Software Development. When I recently became aware of Software Defined Radio, naturally I was curious to learn more. The whole idea of using software to…

If you’re a sports fan, April is a smorgasbord. Baseball is back. The NBA playoffs are in full swing. The NFL draft is turning college stars into household names. Even bowling is rolling into the digital age (although it still can’t quite command the couch the way football does). But here’s the real headline: Artificial intelligence isn’t just in the owner’s box. It’s now in the dugout, on the field, in your running shoes, and even in your local bowling alley. AI and edge computing have become the ultimate utility players, reshaping how pros compete, how fans watch, and how…

Silent Push reveals a complex scheme where North Korean hackers posed as crypto companies, using AI and fake job interviews to distribute malware. Protect yourself from these deceptive tactics.  Cybersecurity firm Silent Push has uncovered a clever operation run by a North Korean hacker group, known as Contagious Interview, which has a link to the notorious Lazarus Group. Reportedly, Contagious Interview has been tricking people looking for jobs in the crypto world through three different fake cryptocurrency companies: BlockNovas LLC, Angeloper Agency, and SoftGlide LLC. Their goal? To lure job aspirants into downloading harmful software onto their computers. Fake Companies…

In the rapidly changing industrial cybersecurity sphere, advocating for women and gender diversity to empower women, is perhaps one of the most important things needed for building strong cybersecurity teams. The advancing digitization of industrial systems highlights the need for integrating diverse and holistic approaches to solve multifaceted cybersecurity problems. The OT/ICS (operational technology/industrial control system) space still struggles to cope with the lack of diversity. Women who attempt to join the workforce in this industry encounter biases, stereotypes, and absent role models. Organizations striving for ‘multicultural’ or ‘diverse’ teams need to address these problems and focus on inclusion, where…

A recent Windows security update that creates an ‘inetpub’ folder has introduced a new weakness allowing attackers to prevent the installation of future updates. After people installed this month’s Microsoft Patch Tuesday security updates, Windows users suddenly found an “inetpub” folder owned by the SYSTEM account created in the root of the system drive, normally the C: drive. It was strange to see this folder created as it is normally used to hold files associated with Microsoft’s Internet Information Service web server, which was not installed on these devices. In an update to a security advisory, Microsoft later confirmed that…

Kayla Mackiewicz // Last year, fellow tester Jordan Drysdale wrote a blog post about Cisco’s Smart Install feature. His blog post can be found here. If this feature is enabled on a Cisco device, an attacker can download or upload a config file and even execute commands. Whether you use the Smart Install feature or some other method to obtain a config file during a pentest, there is a tool out there called Cisco Config Analysis Tool, or CCAT, that can parse the file for you. This tool could also come in handy for network administrators looking to conduct audits…