Bishop Fox

Could you please talk a little more about the ease of hiring for these positions? For example it looks like Bishop Fox has around 400 employees, and on their careers page at https://bishopfox.com/careers they're hiring basic "Penetration Testers" in Mexico and "Senior Penetration Testers" in the U.S. Nettitude has fewer employees and at https://www.nettitude.com/us/careers/ has a posting for "Junior Penetration Tester / Security Consultant" with a start date of September 2023 and a 7 month training course. I'm sure these are great jobs but they don't really strike me as fallback options, meaning places where developers who are struggling elsewhere could apply and count on finding something. How many entry level testers in the U.S. do they hire each year, would you say?

http://www.bishopfox.com/ "Error establishing a database connection" Can't even keep a website up and running, what a very tech savvy company.

> That's the first time I hear about RFID/NFC MITM, neat. That's been a thing for quite a few years now in the context of pentesting, e.g. for badge cloning / proxying for access control systems, see for example [1] for an overview presentation. There's quite a few BlackHat talks on that space that give a good overview at this point. This attack is intruiging since it circumvents more complex measures by manipulating the communication and obviously has practical and direct impact on a monetary asset. I've read elsewhere ([2], German) that Visa declines to fix this with the explanation that it would require attackers to steal the card in the first place and is technologically too complex to be seen in the real world, which is kind of weird. The hardware required is pretty accessible at this point but I guess their risk assessment determined that the actually occurring fraud with this method is currently not worth fixing anything. [1] https://www.bishopfox.com/files/slides/2016/InfoSec_World_2016-RFIDigg… [2] https://www.heise.de/security/meldung/Bezahlen-ohne-PIN-und-Unterschri…

Bishop Fox (https://www.bishopfox.com) | Phoenix, San Francisco, Atlanta, New York City | ONSITE or REMOTE | Full-time | Bishop Fox is a leading IT security consulting firm serving the Fortune 1000 and high-tech startups. We protect our clients by finding vulnerabilities and building defenses before the attackers can break bad. From critical infrastructure to credit cards; social media to mobile games; flight navigation systems to frozen waffle factories — we’re right there, advising every bit of the way. We’re looking for talented hackers and security associates to help us secure some of the world’s most complex software and sophisticated technologies. Interested? We have several openings in both our Assessment and Penetration Testing and Enterprise Security practices. We are especially interested in folks in the San Francisco region at the moment. APT Senior Pentester - http://grnh.se/i6p5cv ES Security Compliance Associate - http://grnh.se/retuo6 If you have any questions, please feel free to email [email protected].

Here's the case [1]. Looks like they targeted a single /24 so that's likely why it wasn't a bigger issue. [1] https://bishopfox.com/blog/bgp-hijacking-technical-post-mortem

You can also use https://github.com/noperator/raink to brainstorm TLDs that are relevant to some topic you care about. For example: curl -s https://data.iana.org/TLD/tlds-alpha-by-domain.txt | raink -f /dev/stdin -p 'which of these TLDs is most related to the concept of "hacking"?' | jq -r 'map(.value)[:10]' [ "BLACK", "COMSEC", "TOOLS", "SECURITY", "ZERO", "EXPOSED", "FORUM", "SHELL", "BOT", "SOFTWARE" ] Those are all in the IANA list but not all can be registered—just showing as PoC. See https://bishopfox.com/blog/raink-llms-document-ranking for more background.

100% JSON wasn't some magical, made-on-the-fly format that makes Crockford some kind of genius. It was simply the standard Javascript object literal notation with some added constraints. I think some of those constraints make sense (i.e. are there any other languages that support both single and double quotes for string literals?), but funnily enough, some of the biggest issues with JSON interoperability is it is very underspecified in the areas that matter, such as the type and width of numeric literals, what to do in some edge cases like duplicate keys, etc. Just did a quick search, and here is a post that outlines some of the real security risks this underspecification leads to: https://bishopfox.com/blog/json-interoperability-vulnerabilities

Company name is "Bishop Fox" One of their products is called "Cosmos" https://bishopfox.com/cosmos Too many secrets?

At least some PLA hackers are explicitly required to avoid giving away that they're operating from China[1], so the information the article cites about IP addresses and other forensic information makes me wonder if this was a false flag operation. [1] https://bishopfox.com/blog/the-isoon-disclosure-exploring-the-integrat…

last key wins is terrible advice and has serious security implications. see https://bishopfox.com/blog/json-interoperability-vulnerabilities or https://www.cvedetails.com/cve/CVE-2017-12635/ for concrete examples where this treatment causes security issues. the https://datatracker.ietf.org/doc/html/rfc7493 defines a more strict format where duplicate keys are not allowed.

if you are making JSON data to use in your language and application you will probably not have any problem. But as in any thing there can interoperability issues between implementations and programming languages - especially if your JSON is being generated and consumed by your JavaScript site some potential issues https://bishopfox.com/blog/json-interoperability-vulnerabilities on edit: not parent commenter of course, just what I think they might have meant.

It gets worse: parser differences can create security risks "An Exploration of JSON Interoperability Vulnerabilities" https://bishopfox.com/blog/json-interoperability-vulnerabilities

It's not hard to find quite recent json parsing vulnerabilities, e.g. https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsec… A fun historical one was remote code execution due to a json parser bug in Google Chrome. Oops. If you try a simple search on mitre, you'll see some false positives, but also a bunch of actual vulnerabilities each year: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=json Here is a nice blog post walking through various JSON based exploits: https://bishopfox.com/blog/json-interoperability-vulnerabilities

I actually blogged about this in 2015, it's a problem for basically all cloud providers that allow recycled allocation of IPs: https://www.bishopfox.com/blog/2015/10/fishing-the-aws-ip-pool-for-dan…

I wanted to submit the link to a blog [1] but HN didn't let me do it for some reason (getting either 'Sorry, that story was previously submitted.' or 'Unknown or expired link.' randomly but I didn't find it in HN search). [1] https://www.bishopfox.com/blog/2017/10/a-bug-has-no-name-multiple-heap…

I didn't realise this was true - https://www.bishopfox.com/resources/tools/other-free-tools/md4md5-coll…

I don't think that's true. This site from 2006 claims they could find collisions in an average of 45 minutes on a 1.6 Ghz Pentium 4: http://www.bishopfox.com/resources/tools/other-free-tools/md4md5-colli… If you account for speed increases over the last 10 years and assume the password thief has access to a botnet, then it wouldn't surprise me if they've found collisions for the entire list. Edit: Nevermind, the link finds two strings that hash to the same thing; it does not find a string that hashes to an existing hash.

That's a completely different from just wanting the e2e crypto source, which is useless by itself. https://www.bishopfox.com/blog/2016/04/if-you-cant-break-crypto-break-…

> No attacker is going to start out by trying to break the crypto, unless it's obviously broken. Emphasis mine. I agree with ryanlol here. Why bother with active attacks when you can just steal their private key from a code execution? Similar to this, but with the priority flipped: https://www.bishopfox.com/blog/2016/04/if-you-cant-break-crypto-break-…

On debian/ubuntu you can detect modified packages with `debsums` - but the signatures seem to be MD5, for which it's possible to generate collisions with e.g. something like http://www.bishopfox.com/resources/tools/other-free-tools/md4md5-colli… .

Here you go "CodeSearchDiggity": http://www.bishopfox.com/resources/tools/google-hacking-diggity/attack…

This may help: http://www.bishopfox.com/blog/2013/10/linkedin-intro/ and the blog post announcing it: https://engineering.linkedin.com/mobile/linkedin-intro-doing-impossibl…