![The Unexpected Benefits of Threat Modeling](https://images.squarespace-cdn.com/content/v1/6128b1eb2eb2cf15b7a35a2f/1722873788372-I2CWZBNEDNUU5CEEO3YF/a_person_meticulously_completing_a_threat_matrix.png)
The Unexpected Benefits of Threat Modeling
Threat modeling is a disciplined approach to technology design that identifies security threats and design constraints to prevent security flaws before they manifest in your platform.
![Vulnerability Research and the Importance of Supporting Young Talent](https://images.squarespace-cdn.com/content/v1/6128b1eb2eb2cf15b7a35a2f/1716511748194-YUOVHC1ZLTPOYUMWYY16/Logan_George_Juniper_Public_Disclosure.png)
Vulnerability Research and the Importance of Supporting Young Talent
This is a story with a happy ending where we were able to get back to the collaboration from the early open disclosure days, utilize modern practices to ensure responsible handling of the information, and allow a young person to make a positive contribution to infosec.
![TunnelVision (CVE-2024-3661): How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak](https://images.squarespace-cdn.com/content/v1/6128b1eb2eb2cf15b7a35a2f/1714399056843-M5ZPV9WF2YLTSL6PVJPE/TunnelVision_No_Light_At_The_End_of_The_Tunnel.jpg)
TunnelVision (CVE-2024-3661): How Attackers Can Decloak Routing-Based VPNs For a Total VPN Leak
We discovered a fundamental design problem in VPNs and we're calling it TunnelVision. This problem lets someone see what you're doing online, even if you think you're safely using a VPN.
![When You Have No Bars](https://images.squarespace-cdn.com/content/v1/6128b1eb2eb2cf15b7a35a2f/1714046542294-G9CYI6TVOARSHUVWXTXM/ce9a447d-f70c-4289-a2c1-c7af9db6c536.jpeg)
When You Have No Bars
A major network update failure led to a massive cellphone service outage across the US, impacting thousands and disrupting essential services. Despite cellular networks’ redundancy, the incident highlighted vulnerabilities in communication infrastructure when multiple base stations fail simultaneously.
![WebSockets and Meteor: Attacking Meteor Applications with eighthundredfeet](https://images.squarespace-cdn.com/content/v1/6128b1eb2eb2cf15b7a35a2f/1710810726129-VU78AK2XR30MH0C9J6B0/WebSockets_and_Meteor_Exploiting_Meteor_Applications.jpg)
WebSockets and Meteor: Attacking Meteor Applications with eighthundredfeet
A starting point for a comprehensive pen test on any application written using the Meteor framework. In addition to exploiting some of the framework’s inherent vulnerabilities, it contains a set of classes that can help script a variety of attacks.
![WebSockets and Meteor: Introduction to WebSockets for Penetration Testers](https://images.squarespace-cdn.com/content/v1/6128b1eb2eb2cf15b7a35a2f/1710806542130-49O7QX1XXL7RW6JAW0H8/WebSockets_and_Meteor_for_Penetration_Testers.png)
WebSockets and Meteor: Introduction to WebSockets for Penetration Testers
Most penetration testers know that common web security tools have limited support for WebSocket, but the differences between HTTP and WebSocket run much deeper than that. A successful penetration test on a WebSocket app requires a conceptual understanding of the protocol’s design.