#securityresearch

Akamai security researchers have uncovered an interesting attack technique they call “Bring Your Own EDR.” The research demonstrates how a trusted, privileged EDR component can potentially become an attacker’s tool against the system it was designed to protect. In a SentinelOne case study, researchers found that exposed interfaces could be abused by an administrator to bypass Windows Protected Process Light protections and interact with highly protected processes. By chaining multiple techniques, they demonstrated how legitimate security software could potentially be turned into a powerful attack mechanism. The bigger lesson is important: security software itself is part of the attack surface. EDR solutions operate with extremely high privileges, which makes vulnerabilities, exposed interfaces, weak trust assumptions, and insecure management mechanisms particularly significant. Organizations should consider not only whether their security tools detect threats, but also how well those tools protect themselves from abuse. “Bring Your Own EDR” is an interesting evolution of the traditional BYOVD concept and another reminder that trusted software should never automatically be treated as inherently trustworthy. #Cybersecurity #EDR #EndpointSecurity #ThreatResearch #ZeroTrust #WindowsSecurity #SecurityResearch #InformationSecurity https://www.akamai.com/blog/security-research/bring-your-own-edr-turn-commercial-edr-trojan-horse

32768 × 32768 × 4 = 2^32 In 32-bit arithmetic: 0. That's how the size check in discord/lilliput computes its output buffer requirement. "0 > buffer_len" is never true, so the guard is inert — the PNG decoder then writes 4 GiB into an 8 MiB buffer. Trigger: a 10 KB, perfectly valid PNG. Not RCE — the product only wraps at 2^32, so every overflow is ≥4 GiB and hits unmapped memory immediately. No write primitive. Reliable DoS though. Reported to Discord today. Writeup (German): aethersec.de/heap-buffer-overflow-in-lilliput-discord #infosec #vulnresearch #memorysafety #discord #dos #securityresearch

This is the part of 2FA/TOTP that many people don’t realize: Your phone isn’t receiving the 6-digit code from the server. Instead, your authenticator app acts like a specialized cryptographic calculator. 🧮🔐 It takes a shared secret key, combines it with the current time, and applies the TOTP algorithm to generate a temporary 6-digit code. At the same time, the server independently performs the same calculation using its copy of the secret key and the same time counter. Same secret + same time counter + same algorithm = same result. That’s why your authenticator app can generate the correct code without receiving it from the server. It’s a simple idea, but a brilliant application of cryptography. You can even test this yourself: add the same TOTP secret to both Google Authenticator and Microsoft Authenticator. Even if you set them up at different times, both apps can independently generate the same 6-digit code at the same time. And here’s another important point: The algorithm doesn’t need to be secret. TOTP is based on publicly known, standardized cryptographic algorithms such as HMAC. What needs to remain secret is the shared secret key. So: 🧮 Algorithm/math: Can be publicly known. 🔑 Secret key: Must remain private. Never share it. ⏱️ Time: Isn’t secret. 🔐 Security: Comes from protecting the secret key, not from hiding the algorithm. That’s a core principle of modern cryptography: A cryptographic system should remain secure even when the algorithm is publicly known. The secret is the key. #2FA #TwoFactor #Security #Cybersecurity #SecretKey #Authentication #Cryptography #Math #TOTP #OTP #AuthenticatorApp #Internet #SecurityResearch

Our recent work "Dead Weight: Analyzing Code Bloat and Its Security Implications in WebAssembly Binaries" was presented at DIMVA 2026 in Chania, Greece. We analyzed over 8,000 real-world WebAssembly binaries and found that 70-85% of compiled functions are never executed. Beyond just taking up space, this dead code leaves a large attack surface for indirect exploitation primitives. Proceedings to appear in Springer LNCS. Author preprint: https://www.pratikkamble.com/DIMVA2026_WasmBloat.pdf Work done with my advisor Dr. Aravind Prakash. Thank you for the guidance and support. #WebAssembly #SecurityResearch #BinaryAnalysis #DIMVA2026

New blog post! The title should be self-explanatory, it's an appreciation post for Nightmare Eclipse. You might notice that the tone is a bit more emotional/angry than my usual style of writing. This one's personal. https://ti-kallisti.com/general/ms/nightmare-eclipse.html #NightmareEclipse #Microsoft #Hackers #InfoSec #SecurityResearch #ChainsawMan #Reze

🚨 The biggest mistake in modern web security? Believing your WAF is enough. For years, we were taught: Deploy a Web Application Firewall and you're protected. That mindset no longer matches how many real-world attacks work. Today's attackers increasingly focus on: 🔓 Broken Authorization (BOLA/BFLA) 🔑 Identity & OAuth/JWT abuse 🔌 API vulnerabilities 🧠 Business Logic flaws ⚡ Race Conditions 🤖 Legitimate functionality abused in unintended ways These attacks often don't rely on payloads that a WAF is designed to block. Instead, they exploit trust. As cybersecurity professionals, we need to think beyond signatures and filtering rules. Understanding how attackers chain application logic, identities, and APIs together is becoming just as important as finding SQL injection or XSS. I wrote an article exploring this shift in modern application security. 📖 Read it here: 👉 https://danielisaace.hashnode.dev/stop-trusting-your-waf-modern-attackers-have-already-moved-on I'm curious to hear from the community: What do you think is the most overlooked attack vector in modern web applications today? Your perspective might help someone else rethink their security strategy. #CyberSecurity #ApplicationSecurity #AppSec #WebSecurity #API #OWASP #EthicalHacking #PenetrationTesting #DevSecOps #SecurityResearch #CyberDefense #InfoSec

I need followers in tech + cybersecurity—please help... I promise I’ll post stuff smarter than “oops, wrong config”. #CyberSecurity #Infosec #ThreatIntelligence #SecurityResearch #BlueTeam #RedTeam #SOC #VulnerabilityManagement #AppSec #PenTesting #threatintel