<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>News &#8211; SCRT Team Blog</title>
	<atom:link href="/category/news/feed/" rel="self" type="application/rss+xml" />
	<link>/</link>
	<description>Orange Cyberdefense Switzerland&#039;s technical blog</description>
	<lastBuildDate>Wed, 29 Mar 2023 12:43:53 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>

<image>
	<url>/wp-content/uploads/2024/10/cropped-favicon-32x32-1-32x32.png</url>
	<title>News &#8211; SCRT Team Blog</title>
	<link>/</link>
	<width>32</width>
	<height>32</height>
</image> 
	<item>
		<title>Attacking Android Antivirus Applications</title>
		<link>/2023/03/29/attacking-android-antivirus-applications/</link>
		
		<dc:creator><![CDATA[2Dai]]></dc:creator>
		<pubDate>Wed, 29 Mar 2023 12:43:00 +0000</pubDate>
				<category><![CDATA[Exploit]]></category>
		<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=3848</guid>

					<description><![CDATA[Although the usefulness of security tools such as Antivirus, VPN and EDR is now indisputable in business circles, these solutions often need a lot of privileges and permissions to work properly, also making them an excellent target for an attacker. The presence of a bug in one of these types of solutions could allow a &#8230; <a href="/2023/03/29/attacking-android-antivirus-applications/" class="more-link">Continue reading <span class="screen-reader-text">Attacking Android Antivirus Applications</span></a>]]></description>
		
		
		<enclosure url="/wp-content/uploads/2023/02/poc.mp4" length="514750" type="video/mp4" />

			</item>
		<item>
		<title>Splunk Boss Of The SOC (BOTS) @Insomni&#8217;hack</title>
		<link>/2022/04/04/splunk-boss-of-the-soc-bots-insomnihack/</link>
		
		<dc:creator><![CDATA[Quentin Brusa]]></dc:creator>
		<pubDate>Mon, 04 Apr 2022 09:28:41 +0000</pubDate>
				<category><![CDATA[Analytics]]></category>
		<category><![CDATA[Insomni'hack]]></category>
		<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=3453</guid>

					<description><![CDATA[It&#8217;s was a pleasure this year to meet you at the 2022 edition of our amazing security conference Insomni&#8217;hack ! With Splunk collaboration, we come back this year with &#8220;Splunk Boss Of The SOC&#8221; challenge. What is BOTS and his history Boss Of The SOC (BOTS) is a blue-team version of capture the flag competition. &#8230; <a href="/2022/04/04/splunk-boss-of-the-soc-bots-insomnihack/" class="more-link">Continue reading <span class="screen-reader-text">Splunk Boss Of The SOC (BOTS) @Insomni&#8217;hack</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Internal security recommendations survey</title>
		<link>/2021/10/11/internal-security-recommendations-survey/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Mon, 11 Oct 2021 13:11:57 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=3223</guid>

					<description><![CDATA[During the first wave of Covid and most people locked up at home, I wanted to engage with my colleagues in various departments here at SCRT by having them answer a simple survey. The survey related to what actions they would recommend and prioritize in order to secure the information system of a random company, &#8230; <a href="/2021/10/11/internal-security-recommendations-survey/" class="more-link">Continue reading <span class="screen-reader-text">Internal security recommendations survey</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Splunk &#038; advanced filtering with Event Masker</title>
		<link>/2021/05/03/splunk-advanced-filtering-with-event-masker/</link>
		
		<dc:creator><![CDATA[Quentin Brusa]]></dc:creator>
		<pubDate>Mon, 03 May 2021 14:34:47 +0000</pubDate>
				<category><![CDATA[Analytics]]></category>
		<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=3164</guid>

					<description><![CDATA[What is Splunk ? Splunk is a Data-to-Everything Platform designed to ingest and analyze all kind of data. They can be visualized and correlated through Splunk searches, alerts, dashboards, and reports. Splunk is the #1 of 2020 Gartner Magic Quadrants in SIEMs for its performant analysis and visionary in Application Performance Management category. Splunk and &#8230; <a href="/2021/05/03/splunk-advanced-filtering-with-event-masker/" class="more-link">Continue reading <span class="screen-reader-text">Splunk &#38; advanced filtering with Event Masker</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Stealing user passwords through a VPN&#8217;s SSO</title>
		<link>/2021/02/25/stealing-user-passwords-through-a-vpns-sso/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Thu, 25 Feb 2021 15:57:36 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=2831</guid>

					<description><![CDATA[Last year I got this idea that I should attempt to pay for my holidays to Japan by hunting for bounties in security appliances while in the plane. A full 10 hours of uninterrupted focus on one solution seemed like it should yield interesting results. So I started reverse engineering the Firewall of a relatively &#8230; <a href="/2021/02/25/stealing-user-passwords-through-a-vpns-sso/" class="more-link">Continue reading <span class="screen-reader-text">Stealing user passwords through a VPN&#8217;s SSO</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Continuous Pentesting</title>
		<link>/2020/08/26/continuous-pentesting/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Wed, 26 Aug 2020 08:39:22 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Pentest]]></category>
		<guid isPermaLink="false">/?p=2757</guid>

					<description><![CDATA[At SCRT, we have been performing penetration tests for nearly 20 years now and have always tried to improve our methodologies to match client expectations and deliver the most accurate and useful results from each test we undertake. Over the last few years, Bug bounty programs have been making a name for themselves as they &#8230; <a href="/2020/08/26/continuous-pentesting/" class="more-link">Continue reading <span class="screen-reader-text">Continuous Pentesting</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>SCRT on Covid-19 and Remote Access / Working From Home</title>
		<link>/2020/04/14/scrt-on-covid-19-and-remote-access-working-from-home/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Tue, 14 Apr 2020 13:26:51 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=2573</guid>

					<description><![CDATA[Like everybody, SCRT has been adjusting to life under Covid-19 over the last weeks. Thankfully, we&#8217;ve been prepared for working from home for quite some time now as many of us do so during normal circumstances anyways. This is however not the case for all companies and we&#8217;ve unfortunately been called in to help some &#8230; <a href="/2020/04/14/scrt-on-covid-19-and-remote-access-working-from-home/" class="more-link">Continue reading <span class="screen-reader-text">SCRT on Covid-19 and Remote Access / Working From Home</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>SonicWall SRA and SMA vulnerabilities</title>
		<link>/2020/02/11/sonicwall-sra-and-sma-vulnerabilties/</link>
		
		<dc:creator><![CDATA[Alain Mowat]]></dc:creator>
		<pubDate>Tue, 11 Feb 2020 12:43:12 +0000</pubDate>
				<category><![CDATA[Exploit]]></category>
		<category><![CDATA[News]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=2546</guid>

					<description><![CDATA[Last year, Orange Tsai did some awesome research and discovered several vulnerabilities in SSL VPN providers which can allow an attacker to break into a network through the very device which is supposed to protect it. The vulnerable constructors were: I&#8217;ll admit I&#8217;ve always found it particularly ironic to discover vulnerabilities in security-related devices and &#8230; <a href="/2020/02/11/sonicwall-sra-and-sma-vulnerabilties/" class="more-link">Continue reading <span class="screen-reader-text">SonicWall SRA and SMA vulnerabilities</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>Public Intrusion Test of Swiss Post’s E-Voting System</title>
		<link>/2019/02/07/public-intrusion-test-of-swiss-posts-e-voting-system/</link>
		
		<dc:creator><![CDATA[Sergio Alves Domingues]]></dc:creator>
		<pubDate>Thu, 07 Feb 2019 13:56:52 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<guid isPermaLink="false">/?p=2535</guid>

					<description><![CDATA[Context The Swiss Cantons have offered online voting to members of their electorate since 2004. Meanwhile, more than 200 binding trials at Federal votes and elections have taken place in 15 cantons over the years. In order to expand online voting to a broader public, the Federal regulation obliges the Cantons to meet an additional &#8230; <a href="/2019/02/07/public-intrusion-test-of-swiss-posts-e-voting-system/" class="more-link">Continue reading <span class="screen-reader-text">Public Intrusion Test of Swiss Post’s E-Voting System</span></a>]]></description>
		
		
		
			</item>
		<item>
		<title>PHPMyAdmin multiple vulnerabilities</title>
		<link>/2018/12/14/phpmyadmin-multiple-vulnerabilities/</link>
		
		<dc:creator><![CDATA[blogscrt]]></dc:creator>
		<pubDate>Fri, 14 Dec 2018 10:34:10 +0000</pubDate>
				<category><![CDATA[News]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<guid isPermaLink="false">/?p=2431</guid>

					<description><![CDATA[During an assignment, I found several serious vulnerabilities in phpMyAdmin, which is an application massively used to manage MariaDB and MySQL databases.&#160;One of them potentially leads to arbitrary code execution by exploiting a Local file inclusion, while the other is a CSRF allowing any table entry to be edited. 1. Local File INCLUSION in transformation &#8230; <a href="/2018/12/14/phpmyadmin-multiple-vulnerabilities/" class="more-link">Continue reading <span class="screen-reader-text">PHPMyAdmin multiple vulnerabilities</span></a>]]></description>
		
		
		
			</item>
	</channel>
</rss>
