STM Cyber

HACK THE UNHACKABLE

[STM Cyber @stm_cyber]

We are so proud to announce that the 🇵🇱Poland -🇫🇮Finland team, under the command of the @CyberWojska, won second place in the world's largest cyber defense exercise, Locked Shields, 2024! 🥈 @trodbert, which included as many as 8 people from STM Cyber, achieved the best result in the entire NATO! #LockedShields2024 #NATO #CCDCOE

[STM Cyber @stm_cyber]

Przypominamy, że 8 marca odbędzie się Dzień Otwarty STM Academy!
Zgłoszenia prosimy wysyłać na [email protected], liczba miejsc ograniczona, więc lepiej się pośpieszyć.
Agenda:
10.00 – 10.30  Przywitanie uczestników - powitalna kawa
10.30 - 12.00  Warsztat: Jak rozpoznać i wykryć złośliwe urządzenia w organizacji?
Prowadzący: Mawekl (Mateusz Pstruś)
12.00 - 13.00  Przerwa obiadowa
13:00 - 13:30 Rekonesans oczami Pentestera, czyli „szukanie dziury w całym” cz. 1
Prowadzący: @redfr0g_ Jakub Brzozowski
13:30 - 14:30  Rekonesans oczami Pentestera, czyli „szukanie dziury w całym” cz. 2
Prowadzący: Szymon Jacek
14:30 - 14:45 Przerwa Kawowa
14:45 - 16:00 Możliwości działu R&D
Prowadzący: @BonusPlay3 (Adam Kliś)

[STM Cyber @stm_cyber]

Zapraszamy wszystkich chętnych na dzień otwarty 8.03.2024, żeby zapoznać się z STM Academy! Odbędzie się pokazowe szkolenie na platformie @hacking_dept , spotkanie z ekspertami cyberbezpieczeństwa oraz członkami najlpeszych polskich grup CTF w Polsce - @p4_team team oraz @DragonSectorCTF. Rejestracja uczestników poprzez wysłanie zgłoszenia na [email protected]

[The Hacker News @TheHackersNews]

Popular PAX PoS systems used in countless stores worldwide are vulnerable to crippling attacks.

Hackers could hijack transactions, steal data, and wreak havoc.

Are you patched? Read the full story: https://t.co/vusSi2HBMi

#cybersecurity #hacking

[STM Cyber @stm_cyber]

@rysiacz Their efforts resulted in the identification of two vulnerabilities:
1. CVE-2024-20916 - SQL injection - found by Patryk Rejchert
2. CVE-2024-20917 - DOM-Based Cross-Site Scripting - found by Piotr Konopko & Patryk Rejchert
Patch has been released on the 16th of January.

[STM Cyber @stm_cyber]

We are excited to share that our employees @rysiacz and Piotr Konopko from @stm_cyber conducted a security assessment of Oracle Enterprise Manager.
Read more in the comments.

[STM Cyber @stm_cyber]

Current list of vulnerabilities:
- CVE-2023-42134
- CVE-2023-42135
- CVE-2023-42136
- CVE-2023-42137
- CVE-2023-4818

Kudos to @CERT_Polska_en for helping with the disclosure process 🤝

[STM Cyber @stm_cyber]

We are releasing the first wave of vulnerabilities targeting @paxtechnology PAX Android POS terminals.
The list includes pre-auth RCE on the root account by exploiting a hidden bootloader functionality via USB.

You can expect more POS CVEs soon™ :)

https://t.co/7DjDTxZ3EU

[STM Cyber @stm_cyber]

Another happy hunting 👊
Dell Technologies would like to thank @redfr0g_ Brzozowski (redfr0g), Franek Kalinowski, and Stanisław Koza from STM Cyber for reporting these issues:
CVE-2023-44277
CVE-2023-44284
CVE-2023-44286
https://t.co/WaVxyQpf0V

[Jakub Brzozowski @redfr0g_]

Together with @albercik007 and Szymon Jacek from @stm_cyber we found several vulnerabilities in SolarWinds Platform 2023.4. An insecure handling of job execution could lead to DoS or Cross-Site Scripting (CVE-2023-40061).
You can find the advisory here https://t.co/7hXnWQ65cO

[STM Cyber @stm_cyber]

Congrats! We are so proud 💪

[Bonus @BonusPlay3]

We managed to win yet another space-related CTF, this time organized by @esaoperations. We managed to join forces with 2 great hackers from @HPI_DE, to form a 🇵🇱🇩🇪 team.
🛰️ 🔫 🦆

[STM Cyber @stm_cyber]

Bartosz Śmigielski @glasnostt from STM Cyber found a security vulnerability in SAP Business Objects identified by CVE-2023-42474. DOM-Based XSS was possible by injecting a URL in the GET parameter during window printing in analytical reporting. More info: https://t.co/TDLMkLKc74

[STM Cyber @stm_cyber]

Our pentesters Stanisław Koza and Jakub Sajniak (@kubolos231) found another high vuln in the Cisco product. It was marked CVE-2023-20211 and it allows any auth user to extract any info from the Cisco Unified Communications Manager using SQLi. Our PoC: https://t.co/qwCsfv0HGC

[STM Cyber @stm_cyber]

Our pentesters Janek and Szymon pranked us in our Microsoft Teams group using interesting phishing 🎣 trick!
Check out what they have discovered and how they manage to earn a free pizza 🍕 using message replay spoofing on Teams:
https://t.co/HMHGhl5VST

[Jakub Brzozowski @redfr0g_]

I am excited to lead a brand new course from @stm_cyber Academy - Network Security. If you want to take a deep dive into L2 attacks, network protocol exploitation and wireless security this course is definitely for You!

👨‍🎓

If interested go to https://t.co/1x5c7U4U5e

[p4 @p4_team]

Get ready, set, hack! https://t.co/q8OOuOigww just hit the ground! ⏰ Less than 24hrs to uncover flags, conquer snacks & tackle tricky AI challenges 🤖. This year we replaced all boring crypto puzzles with 2 zajebiste tasks.

[confidenceconf @CONFidenceConf]

Soon at #CONFidenceConf members of @p4_team 🐦 - Adam Kliś (security researcher @stm_cyber) and Krzysztof Zając (senior threat analysis specialist @CERT_Polska), will introduce you to the Artemis project.🌐

More➡️https://t.co/f0hiA0khmy

#cybersecurity #speakers #websecurity

[STM Cyber @stm_cyber]

@p4_team @DragonSectorCTF @hack_a_sat @solarwine_ctf You're welcome. You are always welcome with us. We look forward to the next!