
When Multi-Factor Authentication Isn’t Enough – Bypassing MFA via Phishing
Having multi-factor authentication is great – but it is only one piece of the security puzzle and won’t work completely on its own.
Successful mitigation of today’s security threats requires an approach that is both on the offensive and on the defensive. Here, we give our take on how to approach and handle specific security challenges, as well as our reaction to some of the latest industry topics.
Having multi-factor authentication is great – but it is only one piece of the security puzzle and won’t work completely on its own.
Posing as a copier repair guy, our consultant managed to get inside a company’s network during a physical pen test.
DirectDefense performs Red Team engagements for its clients as a standard service. During many physical Red Team engagements, we are met with physical access control systems that use RFID or NFC to provide authorized users access to certain areas of buildings. These systems are often used to control entry into a building, or control access… Read more »
Tips for a fast recovery after a ransomware attack, and how to mitigate the impact of such an attack with improved data backup.
How We Compromised a Major Corporate Network During a Physical Pen Test Here’s a “pro tip” for any company out there using armed guards to protect their facility: If you’re not properly segmenting your network, those armed guards can’t do anything to stop an attacker from compromising your company’s private data. We recently conducted a… Read more »
Notice to Our Customers While organizations around the world are reorganizing their workforces to handle the current health issue, I’d like to take this moment to reassure you that we at DirectDefense are well prepared to facilitate the services you count on us to provide for you. Unlike most industries that maintain a collective work… Read more »
COVID-19 has people suddenly working from home, but there are attackers seizing on the opportunity to compromise virtual networks.
Significant Volume of Brute Force Attempts Against Ingress Authentication Sources In the past 72 hours there has been a significant volume of brute force attempts against various ingress authentication sources (like o365 or VPN solutions). We have seen this across all of our customers and that this activity is both typical for this time of… Read more »
Revisiting the Security Threats That Marked 2019 and How They Were Managed Wow, what a year it has been! Security attacks in 2019 were marked by a resurgence of Ransomware attacks, business email compromise (BEC) attacks, and the discovery of painful blind spots in existing security programs for our new, and in some cases older,… Read more »
During application testing, most SQL injection attacks are mundane. Often, when there is one SQL injection, there are many–and they are easily exploitable with tools like sqlmap. Occasionally, an application is largely protected against SQL injection, but something interesting happens on a test. A tester manually validates a SQL injection vulnerability based on server responses,… Read more »