Insinuator

Bold Statements.

[Insinuator @Insinuator]

Token Protection in Entra ID binds refresh tokens to a device. In our tests, Microsoft's recommended Teams policy was bypassed by changing the User-Agent to Linux on the first request. The web client isn't covered at all.

Part 3 of 4: https://t.co/U0Zvc3OuJ7 #EntraID

[Enno Rey @Enno_Insinuator]

AI Security Summit, hosted by @ERNW_ITSec
https://t.co/pk2PiIb5hC

[Insinuator @Insinuator]

AI Security Summit, November 5, Heidelberg.

One day on securing AI systems in production. Four 20-minute talks, four moderated round tables.

Offensive AI, AI & GRC, Secure LLM Environment, AI in Defense.

Sessions are held in German.

https://t.co/TNB2ztLPZr

[Insinuator @Insinuator]

Part II of our Bluetooth Auracast research is live, with an updated Auracast Hacker's Toolkit that now does real sniffing, plus a new Packet Visualizer.

Flash an nRF52840 dongle and start capturing BIS PDUs.

By Dennis Heinze.

https://t.co/FDxgBf8gOt

#Bluetooth #Auracast

[Insinuator @Insinuator]

Part 2 of our token theft series in Entra ID is live: Continuous Access Evaluation, measured.

33 of 740 first-party resources carried the CAE claim. In exchange, CAE tokens may live up to 28 hours.

By Niklas Kerner.

https://t.co/QSfAFSKKGt

#EntraID

[Insinuator @Insinuator]

Long time no post here, just busy elsewhere.

Part 1 of our new 4-part series on token theft in Microsoft Entra ID is live on Insinuator, accompanying ERNW White Paper 80.

https://t.co/qnJgs6Vbzy

#EntraID #OAuth

[Insinuator @Insinuator]

New post: Setting up Secure Boot on Gentoo Linux https://t.co/CP3rgnBihj

[Insinuator @Insinuator]

New post: Windows Hello for Business – The Face Swap https://t.co/GL3WKqHN7G

[Insinuator @Insinuator]

New post: When Your Edge Browser Syncs Private Data to Your Employer https://t.co/mV6jwcaRaE

[Insinuator @Insinuator]

New post: Jigsaw RDPuzzle: Piecing Attacker Actions Together https://t.co/eJ8JYojTel

[Insinuator @Insinuator]

New post: Part I: Bluetooth Auracast from a Security Researcher’s Perspective https://t.co/0lpeASo3XS

[Insinuator @Insinuator]

New post: Vulnerability Disclosure: Command Injection in Kemp LoadMaster Load Balancer (CVE-2024-7591) https://t.co/3CdZrzoLAJ

[Insinuator @Insinuator]

New post: Vulnerability Disclosure: Authentication Bypass in Vaultwarden versions < 1.32.5 https://t.co/13JTx2iNZm

[Insinuator @Insinuator]

New post: Announcement: Progress / Kemp LoadMaster CVE-2024-7591 https://t.co/lE3zN6fpmj

[Insinuator @Insinuator]

New post: Disclosure: Potential Limitations of Apple ADE in Corporate Usage Scenarios https://t.co/WA91wn2qvG

[Insinuator @Insinuator]

New post: CrowdStrike: What is the worldwide BSOD all about? https://t.co/6tOqk3Pl1i

[Insinuator @Insinuator]

New post: Disclosure: Apple ADE – Network Based Provisioning Bypass https://t.co/8HRspTlUQl

[Insinuator @Insinuator]

New post: BMBF UNCOVER – Monitoring von Sicherheitsvorfällen in Fahrzeugen https://t.co/TAID2Pd2KK

[Insinuator @Insinuator]

New post: Active Directory & Entra ID Security Track at Troopers 24 – Agenda Preview https://t.co/FOkDfa8wla

[Insinuator @Insinuator]

New post: Security Advisory: Achieving PHP Code Execution in ILIAS eLearning LMS before v7.30/v8.11/v9.1 https://t.co/ehDdIT0Dx6