Linkedin Logo X Logo YouTube Logo
CONTACT US
Neuvik Blog Logo

Blog

Using GenAI to Encode Malware and Bypass EDR

In this blog, Neuvik’s Director of Advanced Assessments for the EU, Jean Maes, shares an creative method to used to “bypass” a less discussed heuristic – entropy. To do so, he’ll explore the world of endpoint solutions and their telemetry, highlighting how to leverage Artificial Intelligence (AI) to decrease entropy and bypass EDR tooling.

Min read: 10 minutes

Read More
AI-generated image of a reclining man working on a laptop, surrounded by walls of data.

Lessons from a Decade of Security Assessments: the Security Issues That Refuse to Disappear

Recently, I took some time to reflect on my nearly decade-long career in information security, which led to a moment of introspection. As a security consultant, you always want to bring value to your client. You want to make sure that the client understands their security posture and understands the impact and importance of the […]

Min read: 25 minutes

Read More
AI-generated image of a scholar reading in a blue-lit library, with a glittering wall of circuits around a scholar's hat symbol.

Cyber Starts with Skill: The Case for Practitioner Training

Written by Neuvik co-founder Tillery with Ryan Leirvik, CEO and founder of Neuvik. Introduction In a perfect world, we don’t need penetration testing. In a perfect world, we don’t need red team operations. In a perfect world, technology is perfect from design to release, and the only things left to find in production have no […]

Min read: 6 minutes

Read More
AI-generated image of a futuristic person in a cybernetic suit.

Abusing OpenID Connect Claims to Take Over Accounts

Written By Rick Alfaro, Neuvik Advanced Assessments Consultant Intro On a recent engagement, we were performing a web application assessment for a client. They had recently implemented AWS Cognito as their user directory and wanted to kick the tires a bit. I took on this task from the point of view of someone who had […]

Min read: 7 minutes

Read More

Cyber Risk, Fraud, and the Impact of Emerging Technologies

New Technology as a Source of Fraud and Risk   How do you initially react to each newly introduced advancement in technology?   As engineers and problem solvers, we typically think of advancements optimistically. We see them as exciting opportunities to help push forward improvements — because technology should make things better for people, whether […]

Min read: 13 minutes

Read More

Technical Case Study: The Tale of Privilege Escalation vs the Unstartable Service

In this technical case study, Neuvik’s Director of Advanced Assessments in Europe, Jean Maes, and MD of Advanced Assessments, Dave Mayer, showcase an edge case privilege escalation (privesc) methodology that enabled successful privilege escalation during a recent penetration test for a client. By sharing this step-by-step methodology and its implications, we hope that fellow offensive […]

Min read: 8 minutes

Read More

Journey into Windows Kernel Exploitation: The Basics

This blogpost embarks on the initial stages of kernel exploitation. The content serves as an introduction, leading to an imminent and comprehensive whitepaper centered around this subject matter. Through this, a foundation is laid for understanding how kernel drivers are developed, as well as basic understanding around key concepts that will be instrumental to comprehending […]

Min read: 24 minutes

Read More

A Retrospective Vulnerability Case Study: The Developer’s POV

In this month’s blog series, we’ve moved “backwards through time” using a 2017 T-Mobile case study to illustrate what can be learned from three roles discovering a vulnerability in an operational system at varying points in the development cycle.   Our previous two installments discussed what lessons can be learned from a red teamer’s discovery of that vulnerability, followed […]

Min read: 10 minutes

Read More

A Retrospective Vulnerability Case Study: The QA Tester’s POV

In our March 2nd blog, we discuss what can be learned from a red teamer when finding a vulnerability in an operational system. Red teamers are expected to find imperfections in systems and configurations, as their role is inherently vulnerability-discovery based.   But this is not always true for quality assurance (QA) testers as part of the […]

Min read: 11 minutes

Read More

How to Evaluate & Audit Excessive Permissions in AWS

Enabling excessive permissions in Cloud infrastructure can easily lead to unauthorized access, but regularly auditing AWS permissions can make that harder for attackers.   In Neuvik’s previous blog, we highlighted a typical policy misconfiguration of enabling excessive permissions and access management. Although this is hard to program, scale, and observe (which is why this flaw is […]

Min read: 7 minutes

Read More

A Retrospective Vulnerability Case Study: The Red Teamer’s POV

Almost every organization has perforations in their deployed technology.   Identifying and understanding where those perforations can lead to brazen vulnerabilities is essential in understanding the organization’s cybersecurity risk. The challenge that most organizations face is missing an opportunity to use multiple perspectives to inform risks across a system’s lifecycle.   Our goal with this […]

Min read: 8 minutes

Read More

The Power of Security Culture: 6 Lessons Learned from Reddit’s Incident Response

Incident response is a crucial capability for every organization; it’s the one time that organizations can mitigate risk as it’s happening. Some organizations spend significant time understanding their incident response process and fine-tuning response playbooks. This means in the event of an event, or an incident, they are either prepared for something happening that is known […]

Min read: 7 minutes

Read More

Role-based permissions in AWS Cloud routinely introduce simple “pathways” for unauthorized access when not checked

In cloud-based deployments, users and services are associated with roles. These roles become the way of governing identity and access. A common tendency in many organizations is to overlook these permissions — providing an opportunity for attackers to exploit them once discovered.   One solution: audit the roles, regularly.   What are over-permissioned roles and […]

Min read: 6 minutes

Read More

Common Flaws that Create Risk Through Third Party (Program) Risk Management

Third Party Risk Management (TPRM) is an essential component of any organizational cybersecurity risk management program. This is because TPRM programs help identify and mitigate risks to your organization introduced by external parties, ultimately trying to achieve the reduction of cyber risk provided by third parties. Running an effective TPRM program is a large undertaking […]

Min read: 6 minutes

Read More

“Pull from the Right” — because we resist the push

With our Neuvik Editorial Insights series, we highlight the expertise of our team and showcase their individual thoughts on the cybersecurity industry today.   Introduction Product security is hard to tackle, especially for established organizations that are just starting to integrate security elements into their existing development practices, otherwise known as “secure by design” or […]

Min read: 5 minutes

Read More

What if your IdP is breached?

Here, we are providing an open-sourced checklist to help guide an organization through the March 22, 2022 Okta event, from a Red Teamer’s point-of-view: https://github.com/neuvikredteam/PurpleTeam-Checklists/blob/main/IdP-Breach-Checklist.md This week, there was a confirmed, report that Okta was breached by the Lapsus$ hacking group. As far as we know, the group is not believed to be a state-sponsored actor. Organizations, […]

Min read: 4 minutes

Read More