Everyone in security will tell you need two-factor authentication (2FA), and we agree. End of article? Nope. The devil, as always with security, is in the details. Case in point: in the last few we…

📢📢WE ARE HIRING!🚨🚨We have 5 open positions to work with us on research on different cybersecurity topics. We are especially looking for pre-doctoral staff (with a master's degree) or junior PhDs (less than 2 years of experience)👇👇👇👇

Hi everyone! In this tutorial we're going to take a deep dive into REST APIs. I recently wrote this article where I explained the main differences between common API types nowadays. And this tutorial aims to show you an example of how you can fully i...

Cybercriminal group ITG10 is likely targeting South Korean government, universities, think tanks, and dissidents. IBM Security X-Force shares the analysis.

The dark web is a part of the Internet that differs from the regular Internet as it is a network that offers anonymity and privacy. Because of its structure,

Hosts Sophia d'Antoine and Ian Roos presented the list at Summercon in Brooklyn, New York, where they also handed out a surprise Lifetime Achievement Award.

About The Project Recently I’ve been building rudimentary file monitoring tools to get better at Golang, and build faux-watchdog programs for research at Arch Cloud Labs. Through this experimentation, I’ve identified some interesting gaps in the inotify subsystem…

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

A Collection of Android (Samsung) Security Research References - NetKingJ/awesome-android-security

Reverse engineering Spybot's Terminator tool (Zemana Antimalware driver) to achieve LPE as SYSTEM and unrestricted raw SCSI disk read/write.

Unauthenticated Remote Code Execution as root. CVSS 10

There are many reasons you may want to extract iOS applications; one in particular is reviewing security and privacy aspects with an analysis tool such as Ghidra. Unfortunately, unlike .apk files for Android, .ipa files cannot be side-loaded very easily;…

AI can be enhanced with the technologies behind DePIN across four dimensions…

Photo by Matheus Queiroz on Unsplash In late 2022 we decided to start monitoring PyPI , arguably the most important Python repository, a...

A step-by-step how-to guide to using QEMU in Ubuntu 18.04 to emulate embedded devices.

Seed generation of Trust Wallet was flawed, the total entropy was only 32 bits. We have created a file containing all possible seeds. Fortunately, the Ledger Donjon discovered the vulnerability very quickly and likely avoided one of the biggest hack in the…

tldr: Swing VPN is using its user base to DDOS sites using its users as a an attack botnet.
Introduction It all started with a friend of mine complaining that his phone was doing a request to a specific app every few seconds. Initial assumption was that the…