Blog

Read more about the article Windows Downdate: Downgrade Attacks Against the OS Itself

Windows Downdate: Downgrade Attacks Against the OS Itself

At DEF CON 32 in August 2024, SafeBreach’s Alon Leviev unveiled Downdate — a technique that abuses the Windows Modules Installer, TrustedInstaller privileges,and deliberately-eased vbsm manifest permission to silently roll back fully-patched Windows binaries to vulnerable prior versions, re-opening fixed BitLocker bypasses and Hyper-V escapes on current builds. This account explains the downgrade mechanics, the CVE-2024-21430 fix timeline, and why the research redefined patch currency as a security property worth defending.

Continue ReadingWindows Downdate: Downgrade Attacks Against the OS Itself
Read more about the article National Public Data: 2.9B SSN Records for the Price of a Breach

National Public Data: 2.9B SSN Records for the Price of a Breach

In August 2024, national background-check broker National Public Data confirmed a breach that leaked roughly 2.9 billion rows of personal records — names, addresses, relatives, SSNs — covering plausibly every US adult and parts of the UK and Canada, after a criminal actor first offered the data for sale in April and a third party then dumped 277GB free. This account traces the broker supply chain that assembled the dossier, the class-action lawsuit that forced acknowledgment, and the post-SSN security posture every organization now needs.

Continue ReadingNational Public Data: 2.9B SSN Records for the Price of a Breach
Read more about the article AT&T’s Snowflake Ransom Payment: The $370K Precedent

AT&T’s Snowflake Ransom Payment: The $370K Precedent

On July 31, 2024, AT&T confirmed its customer data — including call and text metadata of nearly all subscribers and some SSNs — had been stolen off Snowflake’s cloud via compromised service-account credentials, and that it had paid roughly $370,000 to the SQlMap-scanning crew known as ShinyHunters to delete it. This account reconstructs the credential theft, the infostealer-to-Snowflake kill chain, the economics of a mid-six-figure ransom, and the quarterly-burial of accountability between carrier, and its data-warehouse vendor.

Continue ReadingAT&T’s Snowflake Ransom Payment: The $370K Precedent
Read more about the article CrowdStrike Falcon Outage: 8.5M Hosts & Fragile Architecture

CrowdStrike Falcon Outage: 8.5M Hosts & Fragile Architecture

On July 19, 2024, a routine sensor configuration update from CrowdStrike passed staged testing and rolled through the Falcon channel to roughly 8.5 million Windows hosts — and crashed them into Blue Screens of Death, grounding flights, halting broadcasters and hospitals in the largest IT outage in history. This account reconstructs the flawed content-deployment pipeline, the Channel File 291 logic that sent the kernel into chaos, the 78-minute Remediation and guidance HHCfollows, the blame theater that followed, and why the incident rewrote every argument about single-vendor concentration risk.

Continue ReadingCrowdStrike Falcon Outage: 8.5M Hosts & Fragile Architecture
Read more about the article APT29 Inside TeamViewer: 2024’s Calmest, Most Instructive Breach

APT29 Inside TeamViewer: 2024’s Calmest, Most Instructive Breach

On June 28, 2024, TeamViewer disclosed that a state-sponsored actor — widely reported as Russia’s APT29 — had breached its corporate IT network through a standard employee’s credentials, and that the remote-access product itself, and every customer, stayed untouched. This account reconstructs the hours-to-containment timeline, explains why corporate/product segmentation carried the day, places the intrusion in Cozy Bear’s patient espionage season, and draws the anti-SolarWinds comparison that made this 2024’s most instructive breach.

Continue ReadingAPT29 Inside TeamViewer: 2024’s Calmest, Most Instructive Breach
Read more about the article Polyfill.io Hijack: 100,000+ Sites Inherited a Malicious Script

Polyfill.io Hijack: 100,000+ Sites Inherited a Malicious Script

When Sansec disclosed in late June 2024 that the polyfill.io domain had been sold and its hosted script rewritten to inject mobile-only scam redirects, hundreds of thousands of embedded sites — WordPress themes among them — discovered they had inherited an implant, invisible to desktop QA by design. This account traces the Funnull acquisition chain, the conditional payload mechanics, Cloudflare’s mirror intervention, the DNS-harassment retaliation, the 2025 arrests, and the inventory lesson every site owner still owes themselves.

Continue ReadingPolyfill.io Hijack: 100,000+ Sites Inherited a Malicious Script
Read more about the article Brain Cipher vs Indonesia’s Data Centers: A National Ransomware Reckoning

Brain Cipher vs Indonesia’s Data Centers: A National Ransomware Reckoning

In June 2024, the Brain Cipher crew — running a LockBit 3.0 builder clone — encrypted Indonesia’s National Data Center, disrupting 200+ government services from immigration to licensing, then released a decryptor with an apology-flavored admission that extortion failed, then hit again during recovery. This account covers the copycat-crew economics behind the operation, why one shared-tenant data center meant national outage, the second-encryption lesson about persistence, and the segmented-architecture rebuild Indonesia promised next.

Continue ReadingBrain Cipher vs Indonesia’s Data Centers: A National Ransomware Reckoning
Read more about the article Snowflake Extortion: 165+ Customers, One Credential Wave

Snowflake Extortion: 165+ Customers, One Credential Wave

On June 19, 2024, Mandiant’s public advisory named UNC5537 as the crew behind the Snowflake extortion wave — 165+ victim organizations entered with infostealer credentials against MFA-less tenants, datasets extorted through listings and a dedicated leak market researchers dubbed Snow:Bay. This piece condenses the TTP catalogue, the backyard economics of stolen logs, the aftermarket that changed notification obligations forever, and the single control that would have prevented every confirmed intrusion.

Continue ReadingSnowflake Extortion: 165+ Customers, One Credential Wave
Read more about the article Snowflake-Ticketmaster: The Cloud-Secure Myth Breaks

Snowflake-Ticketmaster: The Cloud-Secure Myth Breaks

Live Nation’s May 2024 SEC filing confirmed criminal access to roughly 560 million Ticketmaster customer records — taken not by exploiting Snowflake but by logging into it with infostealer-derived credentials on a tenant without MFA. This account explains the UNC5537 tradecraft that chained $20 stealer logs into Fortune-500 data lakes, why the ‘no Snowflake breach’ defense only half-worked, what the ~560M-record dataset contained, and the mandatory-MFA wave that reshaped SaaS identity through 2024.

Continue ReadingSnowflake-Ticketmaster: The Cloud-Secure Myth Breaks
Read more about the article Windows Recall: The Privacy Debate Before Launch

Windows Recall: The Privacy Debate Before Launch

Announced May 20, 2024 as a Copilot+ flagship, Windows Recall promised searchable memory of everything on screen — and researchers found the archive in a plaintext SQLite database any user-context malware could read, with a runtime API to match. This account covers Kevin Beaumont’s teardown, the TotalRecall extraction tool, the threat-model fallacies in each Microsoft defense, the June climb-down to opt-in plus Windows Hello and encryption, and the rare process win of an architecture changed before deployment.

Continue ReadingWindows Recall: The Privacy Debate Before Launch
Read more about the article CrushFTP VFS Sandbox Escape: Zero-Trust Patch Confusion in File Transfer

CrushFTP VFS Sandbox Escape: Zero-Trust Patch Confusion in File Transfer

On April 19-20, 2024, CrushFTP shipped emergency fixes for CVE-2024-4040 — an unauthenticated escape from the virtual file system sandbox that exposed arbitrary host files, including the credential-stuffed configuration that anchors enterprise partner integrations. Exploitation followed within days, CISA listed it April 30, and a chaotic trail of interim builds left customers arguing about version numbers mid-fire. This account covers the traversal-to-escape chain, the mainserv credential hunt, and the hard lessons of small-vendor emergency patching.

Continue ReadingCrushFTP VFS Sandbox Escape: Zero-Trust Patch Confusion in File Transfer
Read more about the article PuTTY ECDSA Nonce Bias: How 71 Signatures Exposed Your SSH Key

PuTTY ECDSA Nonce Bias: How 71 Signatures Exposed Your SSH Key

PuTTY’s April 2024 advisory for CVE-2024-31497 read like a physics problem: the terminal’s ECDSA implementation biased nonces on NIST P-521, so roughly 71 captured SSH signatures suffice for a lattice attack that recovers the private key. This piece explains the Hidden Number Problem math, why archived PCAP and DLP session capture retroactively weaponized years of traffic, the 0.81 deterministic-nonce fix, and the brutal rotation drill that made every P-521 key used through Pageant presumptively burned.

Continue ReadingPuTTY ECDSA Nonce Bias: How 71 Signatures Exposed Your SSH Key