by Editor | Nov 18, 2021 | CarveFacts, News, Web
Emails are sent from a source server to a destination server (sometimes through multiple hops) via the SMTP protocol. When you use a webmail client – think Gmail and Yahoo – to send an email, the web server sends emails to its bundled SMTP server and...
by Editor | Nov 10, 2021 | CarveFacts, News, Strategy
Ask any cyber-security professional if using self-signed SSL certificates is acceptable, and they’ll probably say “not really.” Ask why, and we’ll say “we can’t always know who’s behind the screen,” even though we really want to say...
by Jeff Ake | Oct 25, 2021 | CarveFacts, News, Strategy, Techniques
During scoping for penetration tests, customers often say that they want us to perform the engagement exactly as a bad actor would, with no collaboration from the customer’s IT or security teams and no access to inside information. This is known as a black box...
by Editor | Sep 28, 2021 | CarveFacts, News, Strategy, Web
Keeping track of your company’s public IP space is always a good idea. This means maintaining a centralized up-to-date list of: All static IP blocks allocated to you (by an ISP)All VPS instances operated by you in the cloud This makes your life easier by:...
by Jeff Ake | Sep 21, 2021 | CarveFacts, IOT, Strategy
Author: Carve Systems If your user base is primarily IoT devices and your organization doesn’t want to manage passwords for each device, then it seems like a series of unguessable passwords such as “d3v1ce [serial-number]” is the only solution. While that technically...
by Jeff Ake | Jul 30, 2021 | CarveFacts, News, Uncategorized
Author: Austin Ralls One of the easiest ways Carve consultants escalate privilege is reusing a password from a low-privilege account to authenticate to a high-privilege account. It doesn’t happen all that often, but when it does, it’s a quick compromise....
