Bishop Fox is a security consulting firm whose blog publishes vulnerability research, exploit write-ups, and security advice.
HN links it for technical security posts like the BGP hijacking post-mortem; other comments are about its job postings and a site outage.
> That's the first time I hear about RFID/NFC MITM, neat.
That's been a thing for quite a few years now in the context of pentesting, e.g. for badge cloning / proxying for access control systems, see for example [1] for an overview presentation. There's quite a few BlackHat talks on that space that give a good overview at this point. This attack is intruiging since it circumvents more complex measures by manipulating the communication and obviously has practical and direct impact on a monetary asset.
I've read elsewhere ([2], German) that Visa declines to fix this with the explanation that it would require attackers to steal the card in the first place and is technologically too complex to be seen in the real world, which is kind of weird. The hardware required is pretty accessible at this point but I guess their risk assessment determined that the actually occurring fraud with this method is currently not worth fixing anything.
[1] https://www.bishopfox.com/files/slides/2016/InfoSec_World_2016-RFIDiggity-Brown-05Apr2016.pdf
[2] https://www.heise.de/security/meldung/Bezahlen-ohne-PIN-und-Unterschrift-Forscher-hacken-VISAs-50-Euro-Limit-4484956.html
Bishop Fox (https://www.bishopfox.com) | Phoenix, San Francisco, Atlanta, New York City | ONSITE or REMOTE | Full-time |
Bishop Fox is a leading IT security consulting firm serving the Fortune 1000 and high-tech startups. We protect our clients by finding vulnerabilities and building defenses before the attackers can break bad. From critical infrastructure to credit cards; social media to mobile games; flight navigation systems to frozen waffle factories — we’re right there, advising every bit of the way.
We’re looking for talented hackers and security associates to help us secure some of the world’s most complex software and sophisticated technologies.
Interested? We have several openings in both our Assessment and Penetration Testing and Enterprise Security practices. We are especially interested in folks in the San Francisco region at the moment.
APT
Senior Pentester - http://grnh.se/i6p5cv
ES
Security Compliance Associate - http://grnh.se/retuo6
If you have any questions, please feel free to email careers@bishopfox.com.
Could you please talk a little more about the ease of hiring for these positions? For example it looks like Bishop Fox has around 400 employees, and on their careers page at https://bishopfox.com/careers they're hiring basic "Penetration Testers" in Mexico and "Senior Penetration Testers" in the U.S. Nettitude has fewer employees and at https://www.nettitude.com/us/careers/ has a posting for "Junior Penetration Tester / Security Consultant" with a start date of September 2023 and a 7 month training course.
I'm sure these are great jobs but they don't really strike me as fallback options, meaning places where developers who are struggling elsewhere could apply and count on finding something. How many entry level testers in the U.S. do they hire each year, would you say?
100%
JSON wasn't some magical, made-on-the-fly format that makes Crockford some kind of genius. It was simply the standard Javascript object literal notation with some added constraints. I think some of those constraints make sense (i.e. are there any other languages that support both single and double quotes for string literals?), but funnily enough, some of the biggest issues with JSON interoperability is it is very underspecified in the areas that matter, such as the type and width of numeric literals, what to do in some edge cases like duplicate keys, etc. Just did a quick search, and here is a post that outlines some of the real security risks this underspecification leads to: https://bishopfox.com/blog/json-interoperability-vulnerabilities
You can also use https://github.com/noperator/raink to brainstorm TLDs that are relevant to some topic you care about. For example:
curl -s https://data.iana.org/TLD/tlds-alpha-by-domain.txt | raink -f /dev/stdin -p 'which of these TLDs is most related to the concept of "hacking"?' | jq -r 'map(.value)[:10]' [ "BLACK", "COMSEC", "TOOLS", "SECURITY", "ZERO", "EXPOSED", "FORUM", "SHELL", "BOT", "SOFTWARE" ] Those are all in the IANA list but not all can be registered—just showing as PoC. See https://bishopfox.com/blog/raink-llms-document-ranking for more background.
It's not hard to find quite recent json parsing vulnerabilities, e.g.
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-dos-vulnerability-in-json-parsing-cve-2021-42717/
A fun historical one was remote code execution due to a json parser bug in Google Chrome. Oops. If you try a simple search on mitre, you'll see some false positives, but also a bunch of actual vulnerabilities each year:
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=json
Here is a nice blog post walking through various JSON based exploits:
https://bishopfox.com/blog/json-interoperability-vulnerabilities