How to Mitigate the Crowdstrike EDR Agent Issue Causing BSOD on Windows Systems

In the world of cybersecurity, even the most reliable solutions can sometimes encounter issues. Recently, a significant problem arose with the Crowdstrike Endpoint Detection and Response (EDR) Agent for Windows. This issue caused Blue Screen of Death (BSOD) errors across multiple workstations and servers, leading to a widespread cyber blackout.

Understanding the Issue:

The problem relays from a specific file within the Crowdstrike EDR Agent for Windows. When this file is active on your system it may cause the system crash and it will leads to BSOD. The primary goal is to delete this problematic file, allowing the system to run without interruptions.

Mitigation Steps:

Follow these steps to resolve the issue and get your systems back online:

  1. Start Windows in Safe Mode:

   – Restart your computer.

  – As it starts, press the F8 key (or Shift+F8 for some versions) repeatedly until the Advanced Boot Options menu appears.

   – Navigate with the arrow keys to select “Safe Mode” and press Enter key to continue.

  1. Navigate to the CrowdStrike Directory:

   – Once you are into Safe Mode, open File Explorer.

   – Navigate to the directory: `C:\Windows\System32\drivers\CrowdStrike`.

  1. Delete the Problematic File:

   – In the CrowdStrike directory, locate the file named `C-00000291*.sys`. You can use the search function within the folder if needed.

   – Right-click on the file and select “Delete.” Confirm the deletion when prompted on the screen.

  1. Restart the Computer Normally:

   – Close all the opened files, windows and restart the computer.

   – Allow the computer to start normally (without Safe Mode).

Additional Notes:

– Ensure that all affected workstations and servers follow these steps.

– It may be helpful to provide remote support or detailed step-by-step guides for users who are not familiar with these processes.

– After mitigation, monitor the systems closely for any further issues and ensure that all security measures are still in place.



Cybersecurity incidents can be disruptive, but with a clear action plan, they can be mitigated effectively. By following these steps, you can resolve the BSOD issue caused by the Crowdstrike EDR Agent and restore stability to your Windows systems. Remember, staying proactive and prepared is key to minimising the impact of such incidents in the future.

A Healthcare Clinic’s Cybersecurity Wake-Up Call: Phishing Attack Uncovered by RedTeam CyberSecurity Labs

Phishing attacks continue to pose significant risks to organizations, especially those handling sensitive information. Recently, RedTeam Cybersecurity Labs assisted a healthcare clinic in uncovering and mitigating a sophisticated phishing attack that compromised their operations and patient safety. Here’s a detailed account of how we exposed the attack and implemented measures to safeguard the clinic

The Incident

A healthcare clinic, responsible for issuing government-approved fitness certificates, approached us with a serious concern. They discovered that fitness certificates were being issued without the required medical tests, raising alarms about potential system compromise and patient safety.

Investigation and Findings

Our investigation revealed that the clinic’s system had been compromised through a phishing attack. Here’s how the attack unfolded:

  1. Deceptive Email: An employee received an email that appeared to be from a legitimate government health website. The email was expertly crafted, mimicking the official communications from the government health department.
  2. Cloned Website: The email contained a link to a website that was an almost identical clone of the government’s official health portal. This cloned site was designed to trick the employee into believing they were interacting with the genuine website.
  3. Credential Theft: The unsuspecting employee clicked the link and entered their login credentials on the fake website. This action unknowingly provided the attacker with their username, password, and other sensitive information.
  4. Unauthorized Access: With the stolen credentials, the attacker gained access to the clinic’s system. They exploited this access to bypass the medical test requirements and issue fitness certificates fraudulently.

Our Response

Upon identifying the breach, we implemented several measures to mitigate the damage and secure the clinic’s system:

  1. Immediate System Shutdown: We temporarily shut down the compromised systems to prevent further unauthorized access and potential damage.
  2. Password Reset and MFA Implementation: We reset all passwords and implemented multi-factor authentication (MFA) to strengthen security and prevent future unauthorized access.
  1. Employee Training: We conducted a comprehensive training session for the clinic’s staff, focusing on recognizing phishing attempts and implementing best practices to avoid such threats.
  2. Enhanced Monitoring: We deployed advanced monitoring tools to detect any unusual activities and ensure a rapid response to potential threats.

Lessons Learned

This incident highlights several critical lessons for organizations:

  1.  Employee Vigilance: Staff must be trained to recognize and respond to suspicious emails and potential phishing attempts.
  2. Continuous Training: Regular cybersecurity training is essential to keep employees informed about the latest threats and best practices.
  3. Robust Security Measures: Implementing MFA and strong password policies significantly enhances an organization’s security posture.
  4. Proactive Monitoring: Continuous system monitoring allows for early detection of breaches and swift remediation.

Phishing attacks are a serious threat to organizations, particularly those handling sensitive information. RedTeam Cybersecurity Labs is committed to helping organizations defend against these threats through proactive measures, comprehensive training, and thorough investigations. This case underscores the importance of cybersecurity vigilance and robust protective measures to safeguard sensitive information and ensure operational integrity.

Stay alert, stay protected, and ensure your organization is prepared to defend against phishing attacks.

For more information on how RedTeam Cybersecurity Labs can help your organization with cybersecurity awareness training for corporate employees, defend against phishing attacks, and other cyber threats, contact us today.

For more information, please contact us:

UAE Office: Phone: +971-505421994 

India Office: Phone: +91-9778403685

Email : [email protected]

Greybox vs. Blackbox Penetration Testing: Which One is Right for You?

When it comes to ensuring the security of your systems, choosing the right type of penetration testing is crucial. Two common methods are Greybox Penetration Testing and Blackbox Vulnerability Assessment and Penetration Testing (VAPT). Both have their own advantages, and understanding the differences can help you make the best choice for your needs.

Greybox Penetration Testing

Greybox penetration testing is a method where the tester has some knowledge about the system’s internal workings, like documentation or partial access.


  1. Efficient Testing:
    • Testers can focus on the most important parts of the system, making the process faster and more effective.
  2. Balanced Approach:
    • Combines the benefits of knowing the system (like whitebox testing) with the perspective of an outsider (like blackbox testing).
  3. Thorough Coverage:
    • Provides a deeper understanding of potential vulnerabilities without being completely blind to the system’s structure.

Best For:

  • Complex Systems: Where internal knowledge helps in identifying hidden issues.
  • Internal Applications: That need both an insider’s perspective and an external threat assessment.
  • Quick Assessments: When you need detailed results quickly.

Blackbox VAPT

What It Is: Blackbox VAPT is when the tester has no prior knowledge of the system. They test it just like a real attacker would, using publicly available information and tools.


  1. Realistic Attack Simulation:
    • Mimics how an external hacker would approach your system, providing a true test of your defenses.
  2. Unbiased Testing:
    • Testers have no preconceived notions, ensuring an impartial evaluation of your security.
  3. Cost-Effective:
    • Typically requires fewer resources than more in-depth methods, making it a good choice for many businesses.

Best For:

  • Public-Facing Systems: Like websites and APIs that need to be secure against external threats.
  • Regulatory Compliance: Often required for meeting certain security standards.
  • Initial Security Checks: To get a baseline understanding of your security posture.

Which One Should You Choose?

The choice between greybox and blackbox testing depends on your specific needs:

  1. Your Goal:
    • If you want to see how an external attacker might breach your system, go with blackbox.
    • If you need a detailed look at both internal and external vulnerabilities, greybox is better.
  2. Resources Available:
    • Greybox testing might need more preparation and internal knowledge sharing.
    • Blackbox testing can be quicker and less resource-intensive.
  3. System Complexity:
    • Use greybox for complex systems where knowing some internal details can help find deeper issues.
    • Use blackbox for simpler, public-facing systems that need a straightforward security check.


Both greybox and blackbox penetration testing are important for securing your systems. By understanding their strengths, you can choose the right method to protect your digital assets. For businesses in the UAE, working with a specialized penetration testing company like RedTeam Cybersecurity Labs can provide the expertise needed to ensure robust security.

By choosing the right approach and leveraging professional services, you can safeguard your systems against potential cyber threats and enhance your overall security posture.

For more information, please contact us:

UAE Office: Phone: +971-505421994 

India Office: Phone: +91-9778403685

Email : [email protected]

What is Mobile Device Management (MDM)?


In the age of cell phones, tablets, and other portable technologies, they have become indispensable to our personal and professional life. These tools facilitate collaboration, simplify the acquisition of private data, and expedite corporate procedures. Because organizations and institutions of all types are depending more and more on those gadgets, it is imperative that they be managed and protected. Mobile device management, or MDM, is useful in this situation.

What is Mobile Device Management (MDM)?

A full suite of tools and procedures for managing, safeguarding, and keeping an eye on mobile devices within an enterprise is referred to as mobile device management or MDM. Administrators can manage several aspects of such devices, such as device settings, safety policies, utility management, tool performance, and compliance tracking, using a centralized platform provided by MDM solutions. VMware Workspace ONE, Microsoft Intune, MobileIron, and Cisco Meraki are a few examples of MDM solutions. In order for MDM to function, a control agent must be installed on the mobile device that has to be managed.

Why Mobile Device Management (MDM)?

MDM is essential for improving defensively sensitive data and mobile device security. It enables organizations to implement security procedures, control devices from a distance, prevent data breaches, and lessen the possibility of unwanted access. By simplifying device control, MDM ensures that workers have access to essential resources, which boosts productivity. MDM also makes it easier to manipulate fees, use music, and lose capabilities. MDM lowers downtime and helps a mobile workforce with remote instruction and troubleshooting capabilities. It’s important for protecting information, making sure rules are followed, and maximizing cell device performance in today’s mobile-centric society.

Essential Benefits of Mobile Device Management (MDM)

MDM solutions provide a number of critical benefits to help organizations efficiently control and secure cellular devices. Some key advantages encompass:

Enhanced Security: Protects against data breaches and unauthorized access by enforcing security regulations that include the need for passwords, encryption, and whitelisting or blacklisting.

Device Configuration: Gives administrators the ability to control and manage tool settings from a single location.

App management: Makes sure that only approved and secure apps are permitted on devices by managing app updates, installations, and permissions.

Data protection: Encrypts and backs up important documents.

Scalability: The capacity to adjust to the requirements of businesses with different sizes and fleets of devices.

Compliance Monitoring: Verifies that devices follow company regulations and organizational rules.

IT administrators: Offer remote assistance, debug issues, and carry out updates with the help of remote support, which lowers downtime and boosts productivity.

Cost control: Measures include tracking statistics utilization, cutting down on device-related costs, and putting an end to unauthorized pricing.

By enforcing MDM, agencies can make sure their cell devices are secure, compliant, and successfully managed, ultimately enhancing productivity and protecting touchy information.

Beware! The Latest Social Media Scams That You Need to Know About

In an era where social media has grown to be an essential part of our everyday lives, it’s critical to be vigilant against the developing tide of scams lurking inside the digital realm. From phishing schemes to fake giveaways, scammers have grown to be increasingly cutting-edge in their techniques, preying on unsuspecting clients for monetary advantage. In this blog post, we can delve into a number of extraordinarily cutting-edge social media scams and provide you with critical precautions to guard yourself against falling victim.

Understanding the Social Media Scams: How they happen

  1. Phishing Attacks: One time-honored form of social media scam consists of phishing assaults, in which scammers impersonate valid groups or human beings to trick customers into divulging touchy information collectively with passwords, credit card numbers, or personal facts. These phishing attempts regularly come in the form of messages or emails containing malicious hyperlinks or attachments.
  2. Fake Giveaways and Contests: Another not unusual tactic utilised by scammers is the arrival of faux giveaways or contests on social media structures. These scams trap clients with guarantees of extravagant prizes in exchange for liking, sharing, or supplying non-public records. However, as quickly as users interact with the fraudulent posts, they may become targets for identification robbery or exclusive malicious sports activities.
  3. Impersonation Scams: In impersonation scams, fraudsters create fake profiles posing as dependent on people, which include pals, their own family human beings, or public figures. They then use their profiles to provoke conversations with unsuspecting customers, often requesting cash or touchy information under fake pretenses.
  4. Investment Schemes: With the rise of cryptocurrency and online shopping and promotion systems, scammers have furthermore started targeting customers with fraudulent funding schemes on social media. These scams promise immoderate returns with minimal chance, enticing customers to invest their difficult-earned coins in fake ventures that ultimately result in monetary loss.

Precautionary Measures: How to Protect Yourself

  1. Verify the Source: Before clicking on any hyperlinks or attractive posts on social media, commonly affirm the delivery to make certain legitimacy. Look for professional payments with set-up badges, and be careful of debts with suspicious or inconsistent records.
  2. Think Before You Click: Exercise caution when encountering unsolicited messages, emails, or commercials, mainly those soliciting personal facts or financial transactions. Avoid clicking on suspicious hyperlinks or attachments, as they will incorporate malware or phishing websites.
  3. Protect Your Personal Information: Be privy to the statistics you share on social media and keep away from disclosing touchy data collectively with passwords, credit score rating card numbers, or home addresses. Review your privacy settings frequently to determine who can get proper access to your non-public information.
  4. Stay Informed: Keep yourself updated on present-day social media scams and cybersecurity developments via reliable property, which encompasses fantastic protection blogs, records shops, or cybersecurity boards. Awareness is key to spotting and retaining potential threats online.
  5. Report Suspicious Activity: If you encounter any suspicious or fraudulent interest on social media, document it to the platform’s assist team right away. By reporting scams right now, you can help defend yourself and others from falling victim to comparable schemes.


In the end, staying steady on social media calls for a combination of vigilance, skepticism, and proactive measures. By familiarizing yourself with fashionable scams and implementing precautionary steps, you can navigate the digital panorama with a self-guarantee and guard your online presence against capability threats. Remember, in relation to social media scams, prevention is constantly more important than treatment. Stay informed, live carefully, and stay every day!


Introduction to Android Penetration Testing

The write-up will be covering the basics about android and how to set up an android pentesting lab also will be coming across the two vulnerabilities that are common in all android applications.


Android is an open-source mobile operating system. As it is open-source, android is the first choice for developers as well as consumers.

Android Architecture

The Android Operating System is divided into 4 layers.

Application Layer

As shown above, the first layer is the application layer, In which all the applications are being installed on the mobile phone. It runs within the Android run time with the help of the classes and services provided by the application framework.

Application Framework

The Application Framework layer provides many higher-level services to applications in the form of Java classes. Application developers are allowed to make use of these services in their applications. Content providers and activity managers are examples.

Dalvik Virtual Machine | Android Run Time


These are external libraries which are used for additional features or additional functions.

Linux Kernel

This layer is responsible for allocating hardware for the applications. And this layer contain all the drivers.It provides Android with several key security features, like

Security Architecture

Android security architecture consists of two models. They are:

Linux Security Model

The Linux security model is were each app runs through a unique Linux user ID. Linux helps in isolating applications from each other.

Here you can witness that it’s inside the package folder of the application diva that is installed on the virtual device. The system has formed a user id (u0_a74) for every resource that is inside the package.  So if there is any malicious application in the device they can’t affect or access other applications.

Android Security Model

In the android security model, the user’s privacy is protected by means of permissions. We all are familiar with the image shown above, we allow some of the permission that the application asking for. The permission is required by the application id declared in the AndroidManifest.xml file.

So, what is AndroidManifest.xml?

What is an APK?


The AndroidManifest.xml file is the control file that tells the system what to do with all the top-level components (specifically activities, services, broadcast receivers, and content providers described below) in an application. This also specifies which permissions are required. This file may be in Android binary XML that can be converted into human-readable plaintext XML with tools such as android apktool.

META-INF directory


The classes are compiled in the dex file format understandable by the Dalvik virtual machine.


The directory containing the compiled code that is specific to a software layer of a processor, the directory is split into more directories within it:


The directory containing resources not compiled into resources.arsc.


A directory containing application’s assets, which can be retrieved by AssetManager.


A file containing precompiled resources, such as binary XML, for example.

Setting up a lab


First we have to download Genymotion. So goto this link .

If you have already installed virtualbox on your pc then download Genymotion from the second option or if you have not installed virtualbox then download genymotion with virtualbox.

After completing the installation you have to download any virtual device.  We choose to download Google Nexus 6. After that click the install button.

It’s time to customize your device. You can set the Network mode and other settings as you wish or you can follow the same settings shown in the above image. After completing, click install and wait until the installation to be completed.

We have almost gone across the processes for the completed setting up of the virtual device. The next step is to install Google Play Store on your virtual device, to do that click on the “OpenGapps” icon and the download will be started. After the installation is completed you can reboot the device.

If you have any issue in downloading “OpenGapps”, you can manually download this. All you have to do is go to this link and download the compatible file. 

Configuring virtual device with Burp suite

So firstly you have to configure the proxy settings of the virtual device .

Now you completed the configuration in the Burp Suite.

The last step is to add a cacert to the virtual device.

Perfect! We successfully captured the requests from the virtual device.

Practical Time 🙂

Let’s discuss two vulnerabilities that have a high chance to be found in real world applications.

1. Hardcoding Issues

Hard-coding issues means developers hard-code some sensitive strings inside the source code. Hardcoded data might be password, access token etc..

Now we are going to connect to the device using adb.

adb connect [ip address : port]

You have successfully connected with the device. Next thing is to get the shell of the device. In order to do that run the following command:

adb shell

We are going to practice the testing on the application named DIVA (Damn Insecure and Vulnerable Application).

As you can see, diva is already installed in my device.

You can install apk using adb, for that use the following command:

adb install diva.apk

Now open diva app and click on the challenge named Hardcoding Issue Part 1.

So it is asking for a key for the users to access. When you type any value and click access it shows access denied.

So now you have to inspect the source code of the activity.

First, you need to unzip the apk.

unzip diva-beta.apk

As the next step, you have to read the contents inside the file “classes. dex”  but it is not in a human-readable format. The next step is to convert the dex file to jar format, to do that you can use the d2j-dex2jar tool.

d2j-dex2jar classes.dex

After executing this command there will be a new file in .jar format.

After executing this command there will be a new file in .jar format.

jd-gui classes-dex2jar.jar

Here you can find the source code of every activity that is in the application. You are here  to inspect the source code of the Hardcoded Issue, so open the corresponding file:

Here you can see that the developer hardcoded a sensitive string in the source code. So when the user enters any value in the box it validates with this key.

Now let’s enter this key in the box and see what happens.

These types of security vulnerabilities are known as Hard-coding Issues. That’s all about Hard-coding issues. Now you have to move to another vulnerability.

2. Insecure Data Storage

Insecure data storage means sometimes developers store sensitive information without encryption. Here the issue is storing user’s data like passwords, tokens in plain text cause any other application reads those sensitive data. 

Let’s practice this on the diva.

We have opened the Insecure Data Storage challenge in diva.

Now we can save our credentials. For that, we entered a username and password and click save.

It says that credentials are saved successfully. Now let’s inspect the source code of the activity. To do that repeat the process we did the last challenge. That is open the .jar file using jd-gui.

We can see that the credentials are stored in the SharedPreferences folder.

So let’s navigate to that folder.

Now we are inside the package folder of the application diva. Inside this folder, there is the folder that we are looking for that is “SharedPreferences”. The source code of this application says that the credentials are stored inside this folder.

The next step is inspecting the contents of this folder.

We can see that there is one xml file. Let’s read the contents of this file

cat jakhar.aseem.diva_preferences.xml

Here we can see that the credentials that are entered are stored in plain text and also in insecure locations.