by Roman Faynberg | Apr 12, 2021 | Exploits, Featured, News, Techniques
You might have taken all the right steps to secure a corporate Windows workstation: your users are not running as local admins, endpoint protection is in place, service ACLs and file permissions are locked down, etc. Yet there is still a frequently overlooked...
by Mike Zusman | Jan 7, 2021 | Digital Transformation, Featured, News, Strategy, Techniques, Threat Modelling
As a business leader, you are likely familiar with SWOT analysis. SWOT is a strategic planning exercise to help identify a business’s Strengths, Weaknesses, and Opportunities, as well as Threats jeopardizing it’s growth and existence. You are probably less familiar...
by Mike Zusman | Dec 28, 2020 | Cloud, Digital Transformation, IOT, Mobile, News, Techniques, Web
Carve COO Max Sobell presenting on “Shifting Security Left” at Giphy HQ. Many a CTO and VP of Engineering has begrudgingly spent money on penetration tests in order to make their enterprise customers or auditors happy. You know how it goes: your team...
by Meador Inge | Aug 3, 2020 | News, Techniques, Tools, Web
Do we have a problem? The World Wide Web have been struggling with how to create portable, efficient and safe programs (pick two) for decades. The current best of breed attempt is called WebAssembly and is affectionately referred to as “WASM”. The project...
by Mike Zusman | Apr 21, 2020 | Featured, News, Techniques
A company asked us for help with a troubling issue: anonymous web site users would randomly become authenticated as other users in their financial services application. The client’s engineering team had no meaningful log data, and wasn’t able to reproduce the issue...
by Aidan Noll | Apr 16, 2020 | Exploits, Labs, News, Techniques, Tools
Intro – GraphQL GraphQL (GQL) is a popular data query language that makes it easier to get data from a server to a client via an API call. GQL is commonly deployed as a critical piece of the technology stack for modern web and mobile applications, and as a...
