- SecureMyOrg - Security From Around The Globe
- Posts
- Newsletter #15 - June 25, 2024
Newsletter #15 - June 25, 2024
SecureMyKnowledge

SecureMyKnowledge
Greetings CyberSecurity Enthusiasts~ 👋🪲
How have you all been?
You’ve probably heard the terms “Red-hat” hacker, “White-hat” Hacker, or whatever color there is in the CyberSecurity world, and if you’re new, you might not know the difference between them and what exactly they do.
In this week's edition of our newsletter, we delve into the diverse world of hackers, exploring the various categories and their motivations. Understanding these distinctions is crucial in comprehending the landscape of cybersecurity threats today.
🧑🏭 Jobs & Internships
Delinea seeks a remote security engineer with 2+ years of penetration testing experience to join their cloud operations team, focusing on application security and cross-functional collaboration, offering career growth and excellent benefits.
CrowdStrike seeks a remote penetration tester with 2+ years of web application security experience to conduct penetration testing and manage findings. The role offers competitive pay, equity, health benefits, and professional development in a remote-first, inclusive culture.
Rapid7 seeks a Penetration Tester to improve clients' security through technical skills and defense knowledge. This role involves various testing engagements, excellent communication, and a collaborative mindset, requiring 3+ years in a technical security role and up to 30% travel.
Walmart InfoSec seeks a Penetration Tester to conduct security assessments, ensure compliance, and deliver quality reports. The role requires excellent communication skills, technical competencies, and up to 30% travel, offering competitive pay and comprehensive benefits in a hybrid work environment.
Cobalt Core seeks USA-based freelance penetration testers with 3+ years of experience to perform manual testing of web apps, APIs, and mobile applications, and collaborate with clients. The role offers flexible hours, professional development, and compensation for your efforts.
🔏 Last Week in Cyber Security
Join our Discord to get more news in the Security Domain. 🛡️
U.S. Bans Kaspersky Software Over National Security Concerns
The U.S. Department of Commerce has banned Kaspersky Lab's U.S. subsidiary from offering its security software, citing national security risks due to its ties with the Russian government. This prohibition also applies to Kaspersky's affiliates and parent companies. The decision is based on concerns that Kaspersky's software could be manipulated by the Russian government to access sensitive U.S. information and facilitate espionage. The ban begins July 20, with current customers urged to find alternatives by September 29.
Vulnerability in AI Chatbot Allows Full Database Access: A Synack Red Team Discovery
Kuldeep Pandya, a member of the Synack Red Team, uncovered a critical vulnerability in an AI chatbot deployed on a host target. Through an authentication bypass, Pandya gained unrestricted access to the chatbot, which could execute SQL queries directly on the database. This flaw allowed him to enumerate permissions, query sensitive employee data, and ultimately dump database contents, including personal information. The discovery underscores the importance of rigorous security measures in deploying AI-driven applications.
Zoom Session Takeover via XSS and OAuth Exploits: Team Unearths Critical Security Flaws
A collaborative effort between Sudi, BrunoZero, and H4R3L uncovered severe vulnerabilities in Zoom's platform, enabling session hijacking through XSS and OAuth exploits. By chaining two XSS vulnerabilities—exploiting cookie XSS and leveraging cookie tossing—they gained control over user sessions across Zoom's subdomains. This exploit allowed them to manipulate browser permissions, enabling unauthorized webcam and microphone access. The team responsibly disclosed the findings to Zoom, leading to a $15k bounty and subsequent patching of the vulnerabilities.

Unraveling the Rainbow of Hacker Types
1. White-Hat Hackers: Guardians of Cybersecurity
White-hat hackers, also known as security researchers or ethical hackers, operate with a focus on uncovering vulnerabilities in systems and networks. They work within legal boundaries, often collaborating with organizations to improve their cybersecurity posture. White hackers use their skills to audit systems, develop security tools, and provide guidance on mitigating risks. Their efforts contribute significantly to enhancing overall cybersecurity resilience.
2. Grey-Hat Hackers: Moral Ambiguity
Grey-hat hackers operate in a morally ambiguous space between white and black hat hackers. They may breach systems without malicious intent but without explicit permission, often to highlight vulnerabilities or to challenge cybersecurity measures. Their actions can blur ethical boundaries and raise important questions about responsible disclosure and the ethics of hacking.
3. Black-Hat Hackers: Malicious Intentions
Black-hat hackers, or simply black hats, represent the darker side of hacking. These individuals or groups exploit vulnerabilities in systems for personal gain, financial profit, or malicious intent. Their activities can range from stealing sensitive data and financial information to disrupting services or deploying ransomware. Black hackers operate outside the law and pose significant threats to individuals, businesses, and governments worldwide.
Beyond the well-known grey, white, and black hackers, there are other categories that define hackers based on their motivations and actions:
3. Red-Hat Hackers: Unveiling Vulnerabilities
Red-hat hackers, often referred to as ethical hackers or penetration testers, are cybersecurity professionals who are authorized to attempt to penetrate a system's defenses. Their primary objective is to identify vulnerabilities and weaknesses before malicious hackers can exploit them. Red hackers play a critical role in proactive cybersecurity measures by simulating real-world attacks to strengthen defenses and protect sensitive data.
4. Blue-Hat Hackers: Defenders of Systems
Blue-hat hackers, also known as security defenders or cybersecurity professionals, specialize in defending systems and networks from malicious attacks. They utilize defensive strategies, such as intrusion detection, incident response, and proactive security measures, to safeguard against cyber threats. Blue hackers work tirelessly to protect data integrity, confidentiality, and availability.
5. Green-Hat Hackers: Environmental Advocates
Green-hat hackers focus their efforts on environmental causes, using hacking skills to promote sustainability, environmental awareness, and activism. They may target corporations or entities contributing to environmental degradation or promote green technologies through innovative use of cybersecurity tactics.
💡 Did you know? 💡
During the Cold War, American hackers known as "The 414s" inadvertently breached military and government systems in the 1980s, earning them the title of early "Red Hat" hackers. Their exploits not only raised cybersecurity concerns but also spurred the U.S. government to enhance its digital defenses, inadvertently making these hackers pioneers in raising awareness about cybersecurity threats during a real-life digital "cold war."

In conclusion, there are so many other types of hackers in the world of CyberSecurity, and understanding the diverse categories of hackers is essential for developing effective cybersecurity strategies and defenses. Whether they are ethical hackers fortifying our digital fortresses or malicious actors exploiting vulnerabilities, hackers play a significant role in shaping the cybersecurity landscape. Stay vigilant, stay informed, and stay secure.
Here is Avast’s way of explaining these categories:
Thank you for reading this week's CyberSecurity newsletter. Stay tuned for more knowledge and updates on protecting your digital world.
Reply