Randori Attack Team

96 posts

Randori Attack Team banner
Randori Attack Team

Randori Attack Team

@RandoriAttack

Trusted Adversary @RandoriSecurity | Exploit Development | Offensive Operations | #InfoSec tweets only | Managed by @syndrowm @pwnpnw @aaronportnoy

Katılım Mayıs 2019
60 Takip Edilen2.8K Takipçiler
Randori Attack Team retweetledi
chompie
chompie@chompie1337·
In collaboration with @FabiusArtrel and @aaronportnoy we conducted a post mortem of the QueueJumper MSMQ RCE patch. We do an in depth RCA, identify variants, create exploit primitives, evaluate exploitability, and make some interesting new discoveries! securityintelligence.com/posts/msmq-que…
English
4
89
252
53.9K
Randori Attack Team
Randori Attack Team@RandoriAttack·
OpenSSL released details for CVE-2022-3602 & CVE-2022-3786. Due to the mitigating factors outlined in our post we do not believe these will be exploited for remote code execution in real-world scenarios: randori.com/blog/openssl-v…
English
0
8
13
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
The Randori Attack Team developed a working exploit for #f5 BIG-IP CVE-2022-1388. To help the #infosec community assess their risk, we published our technical analysis and a bash one-liner that organizations can run to test exploitability. Details here: randori.com/blog/vulnerabi…
English
0
32
52
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
@springframework Clarification on the above: a 400 code is not the *only* positive indicator of susceptibility--just a definitive one.
English
0
1
7
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
Thanks to @mubix doing great work dispelling myths and misinformation around #log4j twitter.com/mubix/status/1…
Rob Fuller@mubix

10 #Log4Shell Facts vs Fiction: a 🧵 1. 1.x is NOT vuln to this RCE. While it doesn't have another RCE, it requires access to send serialized data to a listener ON the log server. This is much MUCH harder to exploit and kind of rare for a Log4j server to be running.

English
0
1
3
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
Heads up, expect to see a growing diversity of payloads as this evolves. Patching & Default-Deny still your best strategies.
Greg Linares (Laughing Mantis)@Laughing_Mantis

#log4J info stealing method: Just saw an info stealer payload that uses System.getenv(); to grab ALL variables and then send them back to the attacker. That's all it does. This means attackers do not have to know what env variables to guess in order to steal them.

English
0
0
10
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
The Randori Attack Team can confirm the exploitability of unpatched Jamf Pro on-prem via "Log4Shell". Due to the severity of impact, we recommend organizations patch immediately. See: randori.com/blog/jamf-pro-…
English
1
10
17
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
If impacted: 1. assume compromise and review logs for signs of malicious activity. 2. Configure firewalls to prevent outbound connections. 3. Look for updates from VMware on release of patches. 4. Read updated Log4Shell blog and follow @RandoriAttack for updates. 3/3
English
0
2
0
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
We have validated exploitability with a working exploit, and anticipate widespread exploitation by threat actors imminently. Randori has been in contact with the VMWare team to assist their development of mitigations. 2/3
English
1
1
1
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
The Randori Attack Team can confirm exploitability of VMWare products in live environments (VMSA-2021-0028) via Log4j (CVE-2021-44228) aka "Log4Shell". This is a critical vulnerability. Follow @RandoriAttack for updates: randori.com/blog/cve-2021-… 1/3
English
2
73
137
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
We have been monitoring activity and neither Palo Alto Networks nor Randori’s threat intelligence sources have identified attempted exploitation. We hope to give defenders extra time through the end of the year to apply mitigations.
English
1
0
7
0
Randori Attack Team
Randori Attack Team@RandoriAttack·
We have been collaborating with Palo Alto on CVE-2021-3064 and have jointly decided to delay release of technical details as many customers have yet to apply protections due to the COVID-19 pandemic.
English
1
8
28
0

Keşfet

@FabiusArtrel @aaronportnoy @springframework @taviso @_mattata @GreyNoiseIO @Andrew___Morris @mubix