Yaniv Balmas

For example, when using this technique on hotjar.com - we got access to screen recordings from millions of users worldwide 🤯

Did you think XSS is dead? So did we... We couldn't be more wrong. XSS is back with a vengeance! 💥 Combined with OAuth, the Salt-Labs team performed a full account takeover on several major online platforms. salt.security/blog/over-1-mi… #XSS #OAuth #cybersecurity #APISec #infosec

Hey @elonmusk, our team at Salt Labs just released some very concerning security issues in the ChatGPT ecosystem, which may put a lot of data for a lot of users at risk. Time for OpenAI to step up their security game, don't you think? Full report: salt.security/blog/security-…

Check out our latest research. This time, flaws in GenAI ecosystems and several issues in ChatGPT and its integrated plugins. Kudos, @AviadCarmel, for this wonderful research. salt.security/blog/security-…

@IdoNaor1 Nothing, it was that way when I found it 🤷🏼‍♂️

@ynvb What did you do this time?

Looking for a contact in OpenAI security team… anyone here has any leads?

@ClausHoumann Moving to DM ;)

Just discovered a full account takeover on Grammarly.com, Vidio.com and more using a new OAuth attack technique. This is the last part of the OAuth trilogy; in total, we could take over 1+ BILLION accounts! salt.security/blog/oh-auth-a… #OAuth #hacking

and ofcourse big kudos to @AviadCarmel for this wonderful research.

Down the OAUth rabbit hole we go... This time it's a framework issue potentially affecting hundreds of online services, including sites like Codecademy and others... More exciting targets are coming next... stay tuned and secure your OAuth implementations! salt.security/blog/a-new-oau…

@SaltSecurity @SaltSecurity's contribution, beyond the sponsorship, warms our hearts. A big shoutout to @ynvb, who contributed ideas and use cases that were quoted in the latest addition. 💖

Nothing like a good visual aid to remember how to assemble a network cable.

Booking.com OAuth Implementation Allows Full Account Takeover: bit.ly/3yosNoN by Elizabeth Montalbano

@zhouxinan Very similar indeed. Thx for sharing!

@ynvb This reminded me of my breaking Sina Weibo. xinanzhou.com/papers/Oakland…

Taking over booking.com accounts by abusing OAuth 2.0 youtu.be/IK_AV1UFS-0 Read the technical details here: salt.security/blog/traveling…?

@megabeets_ Wow @megabeets_ , that’s amazing. Congrats!!

I am incredibly honored and grateful to have been selected to the Forbes 30 Under 30 list for 2023! 🎉 This recognition is deeply important to me. I’ll continue pursuing my biggest goal — making the world a safer and more just place for all of us, humans & animals.❤️ #30under30

@Shiftreduce @cryptodavidw It also requires a strange peripheral called Mouse… does not sound hygienic to me…

@cryptodavidw I tried, not sure how to operate the keyboard there.

It’s 2023 guys, just use vscode :D

@inbarraz מדהים ענבר! מחכה להמשך…

#פידטרו פוסט חדש בבלוג הרטרו שלי: שחזור של Commodore PET 2001. inbarraz.wixsite.com/unarmed-retro/…

@aCaltum 🤦‍♂️bad call dude, nothing good ever comes out of it… (from experience ofcourse) You definitely need a vacation ;)

Reason 18363729 why I need vacations: While chatting with my wife I told her “what you’re doing is equal equal to something” She asked me - why are you saying equal equal? And the chat devolved into a monologue about assignment and equality on programming languages

Just discovered Mandiant has an Urban Dictionary entry. Fantastic stuff. Huge if true. urbandictionary.com/define.php?ter…