Published inShiftLeft BlogThe Optus Breach: How Bad Code Keeps Happening to Good CompaniesFirst, let me be clear that I have no insider knowledge. This is my best guess at what occurred, based on publicly available information…Sep 26, 2022Sep 26, 2022
Published inShiftLeft BlogLog4Shell : JNDI Injection via Attackable Log4JApache log4j2 is one of the most widely utilized logging library in the Java ecosystem. Many applications depend on log4j that include and…Dec 12, 2021Dec 12, 2021
Published inShiftLeft BlogEvolving Threat series — Infiltrating NPM’s Supply Chain (UA-Parser-js)And if you think your are safe (as you recently procured a well marketed commercial open source dependency scanner) is when you are most…Oct 24, 20211Oct 24, 20211
Published inShiftLeft BlogConnecting RaaS, REvil, Kaseya and your security postureRansomware is an epidemic that adversely affects the lives of both individuals and large companies, where criminals demand payments to…Jul 11, 20211Jul 11, 20211
Published inShiftLeft Blog#Solorigate : SUPERNOVA forensics using Code Property GraphThe fallout of SolarWinds compromise has resulted in a bevy of new malware families, each with different characteristics and behaviors.Jan 3, 2021Jan 3, 2021
Published inShiftLeft Blog#Solorigate : A Month of Reckoning for SaaS software creators and consumersThe U.S. was caught off guard by foreign interference in the 2016 election. Given the powerful role of social media in political contests…Dec 28, 2020Dec 28, 2020
Published inShiftLeft Blog#Solorigate : SolarWinds SUNBRUST backdoor investigation using ShiftLeft’s Code Property GraphIf you’ve arrived to this post, I’d suggest reading the Part-1 and Part-2 to gain context.Dec 28, 2020Dec 28, 2020
Published inShiftLeft Blog#Solorigate : SUNBURST SolarWinds BackDoor : Crime Scene Forensics and detection techniquesFirst, let me be clear that I have no insider knowledge. This is my best guess at what occurred, based on publicly available informationDec 25, 2020Dec 25, 2020
Published inThe StartupSUNBURST SolarWinds Breach: Crime Scene Forensics (continued)First, let me be clear that I have no insider knowledge. This is my best guess at what occurred, based on publicly available informationDec 17, 2020Dec 17, 2020
Published inShiftLeft Blog#Solorigate : Visual Notes : SolarWinds Supply Chain compromise using SUNBURST backdoorFirst, let me be clear that I have no insider knowledge. This is my best guess at what occurred, based on publicly available information…Dec 15, 20201Dec 15, 20201
