Omerez

1Y for #NotPetya. 1Y for #EternalBlues stats. 182 countries. 4.5M computers. 10% are vulnerable to #EternalBlue. 34% of networks are vulnerable. #SMBv1 is still enabled with most computers. Check out app.powerbi.com/view?r=eyJrIjo… for trends by date, country, network size and more... 🎷

NEW FINDING: There's a 1 bit flag hidden in #SUNBURST DNS requests indicating whether or not the victim has been targeted and the backdoor has progressed to "stage 2" operation. netresec.com/?b=2113a6a

Part 3 of our Sunburst\SolarWinds Analysis

#SolarWindsHack #SolarWindsOrion

@campuscodi @craiu @megabeets_ @prevasio @Truesec - great job on sharing latest research and infected domains! 👏 I have a few more which were not mentioned till now (some are giants), and list keeps growing... Wondering about the best way to share it ethically. Thoughts?

This is nuts. Solarwinds had a support page (now removed) advising users to DISABLE antivirus scanning for Orion products' folders.

Malicious cyber actors are using two sets of #TTPs to access protected data in the #cloud. Detect and mitigate against this activity by reviewing our latest #cybersecurity advisory: nsa.gov/News-Features/…

Too many unpatched #SolarWindsOrion are still live. Indicators (html body): "SolarWinds.Logo.Footer.svg" AND ("2020.2" OR ("2019.4" AND "Orion Platform HF5")) zoomeye.org/searchResult?q… zoomeye.org/searchResult?q… #SolarWinds #SolarWindsHack

Was reading about a sophisticated attack on FireEye leveraging Solarwinds. Hmmm how that would happened?🤔. Then realized their password was *****123 🤣 #FireEye #SolarWinds

@justin_lister @GossiTheDog @TechCrunch @zackwhittaker @n0x08 Updated #EternalBlues stats (May 20, 2019). Check out screens 12-14 for a drill down into (#EternalBlue) vulnerable/SMBv1 hosts based on network size and country - app.powerbi.com/view?r=eyJrIjo…

@GossiTheDog 🤔 1.7M bit.ly/SHOSMB 1.5M bit.ly/SHOSMBv1 SMBv1 only Potential. Using @Omerez_com EB scan data: Vuln SMBv1= 12.5% (All) 14.8% (Med) 19.2% (201901). So 197K <233K> 300K vuln to #WannaCry . NOT 1-2m being reported @TechCrunch @zackwhittaker @GossiTheDog @n0x08

Fellow data nerds: here's a snapshot of the vulnerability root cause trends for Microsoft Remote Code Execution (RCE) CVEs, 2006 through 2017. A few callouts: heap corruption, type confusion, and uninit increased in 2017. Use after free steady y/y but proportionally declined.

@jlenkows Are you trying to scan more hosts than the default 256? If so, #EternalBlues supports a scan up to 16,384 IPs in one scan - just edit the IP range. If you're looking for full automation, I highly recommend #metasploit.

@_eypres #PowerBI 💪

#EternalBlues stats: >90% of computers in Uzbekistan and Ecuador still support SMBv1 😱

More #EternalBlues scans were taken all of a sudden. Why? #badrabbit 🐇

New Massive Wave of MongoDB Ransom Attacks Makes 26,000 New Victims - by @campuscodi bleepingcomputer.com/news/security/…

Windows Debug Tool WinDbg Gets a Major Facelift - by @campuscodi bleepingcomputer.com/news/microsoft…

@TalBeerySec EDR market estimated at $2B in 3-4 years. Makes sense for Microsoft to take a share...

@VessOnSecurity Any chance Sandra Bullock wrote this script? 😂 youtube.com/watch?v=uHkRda…

@0xAmit Did you see #EternalBlues stats? omerez.com/eternal-blues-… Scanning 28M non-public IPs shows: 2 out of 3 hosts still use SMBv1 😱