Dec 1, 2020Member-onlyAll That We Let In: Hacking mHealth Apps and APIs (Part 2)Introduction Have you noticed recently that the number of API breaches seem to be rising, not ebbing? You’re not alone. As a matter of fact, the number of API breaches have been going up exponentially and it’s only getting worse as we move into 2021. In part 1 of our…11 min read11 min read
Dec 1, 2020Member-onlyAll That We Let In: Hacking Mobile Health APIs (Part 1)Introduction Are you being kept up at night wondering just how secure your company’s mobile health (mHealth) APIs really are? You aren’t alone. And after the research I’ve conducted on mHealth APIs, you very well should be. If you aren’t, you will be. The number of mHealth companies have more…7 min read7 min read
Dec 1, 2020Member-onlyHacking GSM: Building a Rogue Base Station to Hack Cellular DevicesIntroduction A rogue base station (also called a dirt box or rogue BTS) is the use of a software-defined radio (SDR) to create a fake cell tower and a software implementation of a GSM/GPRS radio access network. The software typically used to power rogue BTS’ is YateBTS, which supports GSM850…6 min read6 min read
Published inDataDrivenInvestor·Nov 30, 2020Member-onlyLiars and Saints: Demystifying Cyber Deception, MITRE Shield, and Active Defense (Part 1)How MITRE Shield has turned cyber deception technology into a business imperative to deny a contested network to adversaries. Introduction Just when you began to fully wrap your head around the MITRE ATT&CK framework, MITRE went and published a brand new framework for you to understand that it’s called MITRE Shield. …6 min read6 min read
Published inDataDrivenInvestor·Jun 11, 2020Member-onlyHacking Bluetooth low energy (BLE) smart devicesIntroduction This article is written for penetration testers wanting to learn how to hack Bluetooth low energy (BLE) smart devices using relay attacks. These attacks can be employed against smart locks to even BLE-powered ignition systems in connected cars. …Hacking8 min readHacking8 min read
Published inDataDrivenInvestor·Jun 3, 2020Member-onlyOutbreak: Data Security in the New Era of PandemicsAbstract This white paper discusses the new generation of data security solutions that addresses the failure of traditional data loss prevention (DLP) solutions to secure sensitive data that in today’s cloud-first and software-as-a-service (SaaS) economy is no longer effective. Data is now mobile and able to move between on-prem networks, cloud…Covid-198 min readCovid-198 min read
Published inDataDrivenInvestor·Feb 21, 2020Member-onlyWhen the bough breaks: The end of the SIEM era and rise of ELKThe story behind the mass exodus of enterprises from SIEM to Elastic “It is not the strongest or the most intelligent who will survive, but those who can best manage change.” -Leon C. Megginson Introduction In my Ashes to Ashes article, I talked about how the event fatigue problem…Elk5 min readElk5 min read
Published inDataDrivenInvestor·Jan 22, 2020Member-onlyMemoirs of an API Hacker: Intercepting Encrypted Mobile Traffic to Hack a Bank’s API Server“Abashed the devil stood and felt how awful goodness is and saw Virtue in her shape how lovely: and pined his loss” -John Milton In a recent penetration test of a large bank, I was able to transfer money to any account and change any customer’s ATM debit card…Api Security6 min readApi Security6 min read
Published inDataDrivenInvestor·Nov 8, 2019Member-onlyThe Butterfly Effect: The Changing Winds on the SIEM MarketThe idea here is that small changes — the burgeoning amount of unstructured data being generated in the enterprise, the interminable event fatigue problem created by false positives in security information and event management (SIEM) solutions, and the global talent shortage in cybersecurity that makes finding affordable security operations center…Machine Learning4 min readMachine Learning4 min read
Published inDataDrivenInvestor·Sep 11, 2019Member-onlyUndivided We Fall: Decoupling Network Segmentation from Micro-Segmentation in the Software Defined PerimeterIntroduction As of today, no laws or regulations, even the latest version of PCI-DSS, HIPAA, and HITECH, do not make network segmentation or micro-segmentation compulsory to comply with the rule. …Software Defined Networks5 min readSoftware Defined Networks5 min read
