Author: HackWatchit

Jeff Barbi // *Guest Post Background Unless you’re pentesting mobile apps consistently, it’s easy for your methodologies to fall out of date. Each new version of Android brings with it additional security features to bypass, making the process you used three years ago to set up your testing device obsolete. If you’re like me, instead of documenting how you set up your last phone, you re-discover a new process each time you configure one. This is redundant and silly. Worse, the information is scattered across the internet in code repos, blogs, and forum threads. Worse still, much of this info…

The notorious Lazarus Group, a North Korean state-backed hacking group, is back at it again. This time, they’re sneaking malicious code into the popular npm software repository, a vital resource for countless developers worldwide. Cybersecurity researchers at Socket Research Team have found six new fake packages, already downloaded around 330 times, designed to infiltrate developers’ computers, swipe login details, steal cryptocurrency information, and even install a backdoor for long-term access. What’s npm and Why Should I Care? Think of npm as a giant online library for JavaScript code. Developers use it to grab pre-built pieces of software (called “packages”) to…

DBeaver is the most powerful open-source SQL IDE, but there are several features people don’t know about. In this post, I will share with you several features to speed up your workflow, with zero fluff. I’ve learned these as I’m currently digging deeper into the tools I use daily, starting with Dbeaver. In a future post, I’ll compare the workflow between DBeaver versus building your SQL development environment on VSCode (or Cursor). If you’re interested in that, be sure to follow my publications! Today, though, the focus is on learning the cool features of DBeaver. Let’s get started. The Command…

Managing IT assets is already a complex challenge, but keeping track of SaaS applications—especially shadow SaaS—makes it even more difficult. Without complete visibility, security gaps emerge, compliance efforts become a guessing game, and IT operations slow down. If your team relies on ServiceNow’s Configuration Management Database (CMDB) to power ITSM, ITAM, IRM, or other critical functions, it’s imperative to have an accurate, continuously updated SaaS inventory. That’s where the Grip – ServiceNow CMDB integration comes in. Grip automates SaaS discovery, tracking, and data synchronization, ensuring that your CMDB is always up to date—without manual effort. Eliminate Shadow SaaS Visibility Gaps…

What if the next big crypto hack could be stopped not by tighter regulations or smarter coders, but by simply showing users what they’re agreeing to? That’s the premise behind Human Wallet, a Web3 wallet from the Holonym Foundation, which launched its public alpha testing today. With a radical approach to transaction security, it’s tackling a vulnerability exposed by the recent $1.5 billion Bybit breach—one that’s been hiding in plain sight: blind signing. The Bybit hack, the largest in crypto history, laid bare the risks of users approving transactions without fully understanding them. Blind signing—where complex transaction details are reduced…

Today is Microsoft’s March 2025 Patch Tuesday, which includes security updates for 57 flaws, including six actively exploited zero-day vulnerabilities. This Patch Tuesday also fixes six “Critical” vulnerabilities, all remote code execution vulnerabilities. The number of bugs in each vulnerability category is listed below: 23 Elevation of Privilege Vulnerabilities 3 Security Feature Bypass Vulnerabilities 23 Remote Code Execution Vulnerabilities 4 Information Disclosure Vulnerabilities 1 Denial of Service Vulnerabilities 3 Spoofing Vulnerabilities The above numbers do not include Mariner flaws and 10 Microsoft Edge vulnerabilities fixed earlier this month. To learn more about the non-security updates released today, you can review our dedicated…

It all started a few months ago when I was assigned to review the IR-200 course during its development phase. As a Student Mentor at OffSec, this is a standard process—we test the course and exam to ensure everything runs smoothly for students. This responsibility allowed me to experience the course and exam firsthand before its release. The IR-200 course is designed to teach foundational concepts in incident response. The primary goal is to enable students to identify the phases of incident response and learn how to deal with each phase effectively. While reviewing the material, I realized that the…

00:00 – PreShow Banter™ — Wade’s Googly Eyes00:41 – BHIS – Talkin’ Bout [infosec] News 2023-01-2301:26 – Story # 1: BIG TECH LAYOFFS. LAYOFFS! DOOM! RECESSION! We are self-publishing free Infosec Zines called PROMPT#. PROMPT# will contain:  Infosec articles  Challenging puzzles  Comic book based on real-life hacking adventures  Coloring contests  Bonus Backdoors & Breaches Consultant Cards (print version only)  Other stuffs  You can check out current and upcoming issues here: https://www.blackhillsinfosec.com/prompt-zine/ 

White House nominates top leaders for CISA, other DHS components Sean Plankey has been tapped to lead CISA after serving in key cyber roles during Trump’s first term. His nomination comes as CISA grapples with recent cuts. Justin Doubleday@jdoubledayWFED March 11, 2025 3:07 pm 2 min read A former Energy Department and National Security Council official has been tapped to lead the Cybersecurity and Infrastructure Security Agency. President Donald Trump today formally nominated Sean Plankey to serve as director of CISA. Plankey’s name was included among a slew of nominations sent to the Senate. During Trump’s first term, Plankey served…