HP Security Research Blog
The HP Security Research blog provides a platform for security experts from across HP to discuss innovative research, industry observations, and updates on the threat landscape to help organizations proactively identify and manage risk.

HDD firmware: Hacking in the dark

oleg-02.jpgMalware that can stay resident in a hard drive’s firmware is unsettling news (and serious business). But with most HDD documentation focused on fixing or replacing failed hardware, how does a curious researcher examine the firmware?

Labels: firmware| HPSR| Research

If you build it, will it be the Security Operations Center (SOC) you need?

11252988_ml.jpg

Are you building the SOC you want or the one you can afford? Often they are different and may not provide an organization the best security posture. Let’s look at how to convince the business of SOC value to build what you need.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – August 28, 2015

field-logo.jpgWelcome to the August 28th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.

Labels: HPSR

HP Security Research OSINT (OpenSource Intelligence) articles of interest – August 21, 2015

field-logo.jpgWelcome to the August 21st edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – August 14, 2015

field-logo.jpgWelcome to the August 14th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news. 

ZDI@10: A wrap on Black Hat and a look ahead

zdi_10_year.pngAs we celebrate 10 years of the Zero Day Initiative (ZDI), join us as we take a look back at the conferences that were and the things yet to come.

Tags: pwn2own| ZDI| ZDI@10
Labels: pwn2own| ZDI| ZDI@10

ZDI@10: 10 fascinating facts about 10 years of bug hunting

zdi_10_year.pngOver the last ten years, HP’s Zero Day Initiative (ZDI) established itself as the world’s premier vendor-agnostic bug bounty program. During this time, the ZDI released over 2,000 advisories and counting. Let’s look at some of the more interesting facts gleaned from a decade of running the world’s largest vendor-agnostic bug bounty program.

Labels: exploits| lists| ZDI| ZDI@10

On the road again...ZDI VEGAS!

ZDI@10.PNGCome check out presentations from the award-winning HP Zero Day Initiative team during “Black Hat Week” in Las Vegas. Join Brian Gorenc, Head of ZDI, and his team as they walk you through the research just nominated for a 2015 Pwnie Award for Most Innovative Research (and previous winner of the Microsoft Mitigation Bug Bounty and BlueHat for Defense Bounty).

Tags: Pwnie| ZDI| ZDI@10
Labels: HPSR

HP Security Research OSINT (OpenSource Intelligence) articles of interest – July 31, 2015

field-logo.jpgWelcome to the July 31st edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

HP Zero Day Initiative: Life begins at 10

ZDI@10.PNGIn 2007, David Endler penned a blog on five years of vulnerability markets in which he laid out the motivation and philosophy for launching iDefense and the Zero Day Initiative (ZDI). Some things have changed while others remained constant. As the ZDI celebrates its ten-year anniversary, I offer up more insight into one of the world’s oldest vendor-agnostic bug bounty programs and attempt to answer some of the questions posed at the end of that blog eight years ago.

Tags: exploits| ZDI| ZDI@10
Labels: HPSR

Think like a bad guy: Know your environment

16828179_ml.jpgThe first step in thinking like a bad guy is to understand your environment. Identify the “attractive nuisance” in your network that the bad guy wants to find and protect it appropriately. You cannot protect an environment you don’t know.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – July 24, 2015

field-logo.jpgWelcome to the July 24th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

HP Security Research OSINT (OpenSource Intelligence) articles of interest – July 17, 2015

field-logo.jpgWelcome to the July 17th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

Adobe's CVE-2015-5090 - Updating the Updater to become the bossman

In July 2015, Adobe patched many different bugs in Reader and Acrobat. One of those bugs, CVE-2015-5090, can allow code execution with SYSTEM privileges. This deep dive covers the discovery of the bug and how it can be used as a functioning exploit.

SAP: One of the weaker security links?

11794781_ml.jpgThe importance of Enterprise Resource Systems (ERPs) in modern enterprises can’t be overstated, but their security profile can be hazy at best. With new data emerging recently about the state of one very high-profile ERP system, we take a look at signs your installation may be compromised.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – July 10, 2015

field-logo.jpgWelcome to the July 10th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

HPSR Software Security Content 2015 Update 2

HP Software Security Research is pleased to announce the immediate availability of updates to HP Application Defender, HP WebInspect SecureBase (available via SmartUpdate), HP Fortify Secure Coding Rulepacks (English language, version 2015.2.0), and HP Fortify Premium Content. As of today, HPSR Software Security Content supports over 958 vulnerability categories across 22 programming languages and spans more than 827,000 individual APIs.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – June 26, 2015

field-logo.jpgWelcome to the June 26th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

HP Security Research OSINT (OpenSource Intelligence) articles of interest – June 19, 2015

field-logo.jpgWelcome to the June 19th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

There and back again: a journey through bounty award and disclosure

ZDI Logo_4Blog_200px.jpgIn February 2015, HP Zero Day Initiative (ZDI) team members Brian Gorenc, AbdulAziz Hariri, and Simon Zuckerbraun won $125,000 from Microsoft’s mitigation-bypass bug bounty program. Today they’re fully disclosing the details of that bypass. Here’s where – and why.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – June 12, 2015

field-logo.jpgWelcome to the June 12th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

HP Security Research OSINT (OpenSource Intelligence) articles of interest – June 5, 2015

field-logo.jpgWelcome to the June 5th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

HP Security Briefing, Episode 22: The hidden dangers of inadequate patching strategies

16413961_l.jpgInstallation of security updates should be easy – that’s certainly the theory. In this briefing, we examine industrywide problems with patching and how inadequate servicing approaches hurt everyone.

HP Security Research OSINT (OpenSource Intelligence) articles of interest – May 29, 2015

field-logo.jpgWelcome to the May 29th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.

Labels: HPSR

Oh, behave!: Breaches, APT, and activity monitoring

defense.jpgA recent Gartner survey indicates that an overwhelming majority of breaches are application-related. We look at how that knowledge can be power in the right defenders’ hands.

Common Web mistakes that invite trouble

web security.jpgSometimes it seems as if security folk simply can’t shut off the part of their brain that looks for trouble. Unfortunately, years of questionable web site development tactics have made trouble plenty easy to find. See if any of these misbehaviors ring a bell.

Adult Friend Finder leak – what can we learn?

too-many-friends-found.jpgThe recent breach and data dump of records on 3.8 million Adult Friend Finder subscribers may have provided a certain degree of amusement to the Internet – though it’s safe to say that the subscribers and the site owners aren’t laughing. However, a breach of employees’ (very) personal information can still spell trouble for your network. We look at the implications.

Labels: HPSR

HP Security Research OSINT (OpenSource Intelligence) articles of interest – May 22, 2015

field-logo.jpgWelcome to the May 22nd edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR

Software Development KITchen sink

bug picture.jpgCVE-2014-8361 (ZDI-15-155), recently disclosed by the Zero Day Initiative, provides a depressing example of why near-intractable vulnerabilities will continue to plague the tech industry – and will only get worse as we fully embrace the Internet of Things.

Labels: HPSR

HP Security Research OSINT (OpenSource Intelligence) articles of interest – May 15, 2015

OSINT.jpgWelcome to the May 15th edition of the HP Security Research OSINT articles of interest. This is a list of publically available articles that we find relevant in today's security news.  

Labels: HPSR
Search
Showing results for 
Search instead for 
Do you mean 
About the Author(s)
  • Head of OpSec Research
  • I am a senior security content developer with Hewlett-Packard Security Research (HPSR). In this role, I write and edit security analysis and supporting content from researchers, including those from HP’s Zero Day Initiative (ZDI) program. The ZDI program augments HP’s Enterprise Security Products with zero-day research through a network of over 3,000 independent researchers around the world. I am also responsible for providing insight into the threat landscape; competitive intelligence to the research team; and providing guidance on the social media roadmap. Part of my role includes speaking publicly and promoting the research and technology of the HPSR.
  • Kernelsmith is senior vulnerability researcher with Hewlett-Packard Security Research (HPSR). In this role, he analyzes and performs root-cause analysis on hundreds of vulnerabilities submitted to the Zero-Day Initiative (ZDI) program. He also tries to automate whenever he can, pulling from the devops and virtualization arenas. Josh is also a developer for the Metasploit Framework and has spoken at a few conferences and holds a few certifications. Prior to joining HP, Smith served in the U.S. Air Force for 10 years and subsequently became a security engineer at the John Hopkins University Applied Physics Laboratory. Smith performed research into weapons systems vulnerabilities as well as evasion and obfuscation techniques to add depth and realism to security device tests. Smith received a B.S. in Aeronautical Engineering from Rensselaer Polytechnic Institute and an M.A. in Management of Information Systems from the University of Great Falls.
  • Security Researcher, Software Security Research
  • Security Researcher, Zero Day Initiative
  • Steve Povolny manages the Digital Vaccine team at HP TippingPoint. The team is composed of security researchers and filter/signature developers for the Intrusion Prevention System.
HP Blog

HP Software Solutions Blog

Featured


Follow Us
Labels
The opinions expressed above are the personal opinions of the authors, not of HP. By using this site, you accept the Terms of Use and Rules of Participation.