Ofek itach

67 posts

Ofek itach

Ofek itach

@ofekitach

Katılım Temmuz 2017
463 Takip Edilen113 Takipçiler
Yakir Kadkoda
Yakir Kadkoda@YakirKad·
In 4 out of 6 cases, attackers only needed the victim's AWS account ID to exploit these vulnerabilities, emphasizing the importance of keeping your account ID secure. 🤫 [5/7]
English
1
0
1
675
Ofek itach retweetledi
Yakir Kadkoda
Yakir Kadkoda@YakirKad·
🚨 Thread: Six Critical AWS Vulnerabilities Found 🚨 We've uncovered serious vulnerabilities in AWS services, leading to potential remote code execution, data manipulation, and more. Here's what you need to know: 🧵[1/7]
English
2
2
38
4.7K
Ofek itach retweetledi
Aqua Security
Aqua Security@AquaSecTeam·
🚨 Aqua Nautilus researchers have identified the infrastructure of a potentially massive campaign against #cloud native environments. In the first of a two part series, we unfold the story of how we discovered the campaign, speculate on the threat actor, and share mitigation recommendations.💡 w/@MoragAssaf and @ofekitach blog.aquasec.com/threat-alert-a…
English
0
2
4
579
Ofek itach retweetledi
Ilay Goldman
Ilay Goldman@GoldmanIlay·
Check out our new blog about repojacking. We show a massive dataset we used and introduce exploitation scenarios using real repoaitories examples
Aqua Security@AquaSecTeam

Threat Alert! New research by Aqua Nautilus emphasizes the extent of #RepoJacking and exposes potentially millions of vulnerable repositories. Among the repositories found vulnerable to this attack were @Google and @lyft.  Check out the blog here to see the full research + recommended mitigations. blog.aquasec.com/github-dataset… #cloudnativesecurity

English
0
1
5
234
Ofek itach retweetledi
SkelSec
SkelSec@SkelSec·
I waited 2 years for this, rewrote impacket for this, asked cryptographers to remake algos in python for this, spent enormous time of my life to make this happen. and it's finally here this finally works and I can't find the words to express my satisfaction.
SkelSec tweet media
English
76
711
2.3K
0
Ofek itach retweetledi
Itay Cohen 🌱
Itay Cohen 🌱@megabeets_·
Excited to publish our research in which @EyalItkin and I were able to fingerprint 2 of the most active exploit developers for Windows. Together, they account for 16 Windows LPE exploits, of which 5 were 0-Days that were sold to APTs and crime groups. research.checkpoint.com/2020/grapholog…
English
4
145
344
0
Ofek itach retweetledi
Samir
Samir@SBousseaden·
new container, will be set to public soon :D
Samir tweet media
English
7
65
330
0
Ofek itach retweetledi
Michael Maltsev
Michael Maltsev@m417z·
Have you ever needed to get an earlier version of the Windows binary you're analyzing? Did you end up downloading Windows ISOs or update packages just for that? Not anymore! Introducing Winbindex: m417z.com/winbindex/ m417z.com/Introducing-Wi…
English
20
601
1.4K
0
Ofek itach retweetledi
Grzegorz Tworek
Grzegorz Tworek@0gtweet·
Undocumented (what a surprise!) EVTX file format flag, making all internal checksums ignored. Good to have if you plan to manipulate the log content.🕵️ Simple "try this at home" #PowerShell script: github.com/gtworek/PSBits…
Grzegorz Tworek tweet mediaGrzegorz Tworek tweet media
English
3
123
286
0
Ofek itach retweetledi
Samir
Samir@SBousseaden·
sometimes you can see a detection opportunity from a short video :) [URL matches, access to ECP url & OTHERS normally is useful for Exchange Admin ppl only, from process exec flow u can monitor any susp child proc of w3wp.exe with parent_cmdline line "*-ap *MSExchangeECPAppPool*"
Samir tweet mediaSamir tweet mediaSamir tweet mediaSamir tweet media
English
7
47
111
0
Ofek itach retweetledi
Samir
Samir@SBousseaden·
pivoting on rwdrv.sys (legit signed driver to discover UEFI other HW related settings) leads to Lojax/DoubleAgent UEFI rootkit. sysmon check eventid 6 with Signature: "ChongKim Chan" (cuz there are many version with diff hashes) - proper discovery for this type of TTP is a must
Samir tweet mediaSamir tweet mediaSamir tweet media
English
2
54
162
0
Ofek itach retweetledi
Samir
Samir@SBousseaden·
processes that use bits in windows, SCCM client, browsers, outlook, onedrive & some update programs, powershell one was for testing thus it's not that frequent to have it there and if so likely the transfer job name will be known and can be baselined.
Samir tweet mediaSamir tweet media
English
0
20
45
0

Keşfet

@YakirKad @Rudy4FutureTech @mike_katch @MoragAssaf @SemperisTech @elad_shamir @GuyTeverovsky @EyalItkin