Tom Sela

Reverse engineering, Malware research, OS internals, DFIR and Deceptions.

[Tom Sela @4x6hw]

@0gtweet Hi @0gtweet, are you familiar with this project and blog? It's a PS implementation of netstat with timestamp from a couple of years back...
https://t.co/7gpjMpzQ86
https://t.co/mtjCaUD13Y

[Dolev Ben Shushan @DolevBens]

Check out our latest blog post about upgrading #MailSniper to support Azure AD SSO abuse for easier O365 mailbox scraping
https://t.co/tXEV36JLsl

[Tom Sela @4x6hw]

Thank you very much @ynvb for presenting to Team8's research leads forum about Checkpoint's thought leadership, you guys are doing a super impressive work!

[Hadar Yudovich @hadar0x]

I had some free time this weekend, so I started learning Mac OSX Forensics. Since learning something new never works smoothly for me, I learned about parsing plist files the hard way. #DFIR #macOS #forensics

https://t.co/7T6iHQLP5S

[Magal Baz @mb1687]

Last December @4x6hw and I gave a talk about security issues with Windows 10 Security Questions, and it's now on YouTube!
https://t.co/qNAfxSRXyf

The full technical report is available here -
https://t.co/10ge4IPvuA

[Nadav Grossman @NadavGrossman]

A code execution vulnerability we found in WinRAR, existed for about 19 years. enjoy :) https://t.co/ne7ONHgb1g

[Magal Baz @mb1687]

Check out the technical blog post by @4x6hw and me, following up on the research we presented at Black Hat Europe last month! @BlackHatEvents @illusivenw https://t.co/10ge4IPvuA

[Tom Sela @4x6hw]

#Lifehacker has made an article on the #powershell script we presented in our #BHEU talk, details below if you want to disable #Windows10 password reset questions. @mb1687 https://t.co/CpnvlHdoLC

[Illusive @illusivenw]

#Windows10 security questions may not be as secure as you'd think... #BHEU #BlackHatEurope #CyberSecurity https://t.co/nYdKV87Oav @4x6hw @mb1687

[Tom Sela @4x6hw]

Watching @mysmartlogon demonstrating new features of #PingCastle at #BHEU arsenal, looking forward for official version release :)

[Black Hat @BlackHatEvents]

#BHEU speakers @mb1687 & @4x6hw chat with @arstechnica @dangoodin001 regarding their research around Windows 10 vulnerabilities

[Illusive @illusivenw]

Snapshots from our team's presentation at #BlackHatEurope! @mb1687 @4x6hw @illusivenw @BlackHatEvents

[Ars Technica @arstechnica]

Why, in 2018, is Microsoft adding security questions to Windows 10? https://t.co/KXQS4qW1mw by @dangoodin001

[Tom Sela @4x6hw]

@mb1687 Last BlueHatil @gentilkiwi gave a talk that covered some smart card securiry https://t.co/6Ifv3Qam2c (from min ~27)

[Tom Sela @4x6hw]

@mb1687 and myself will be attending BlackHat (#BHEU) next week, presenting our research on #Win10 new securiry questions feature (Wed 4:30pm Room B). DM us if you would like to hangout. https://t.co/Ut5WOk3LCw

[Tom Sela @4x6hw]

@natashenka https://t.co/flGRXMI0Il

[Illusive @illusivenw]

Do Win10 security questions make users more secure? Come find out during our Illusive Labs' presentation at #BHEU where we'll demonstrate how they can be exploited by attackers to establish persistent presence in the network. @mb1687 @4x6hw @BlackHatEvents https://t.co/YCkyfLuOXg

[Illusive @illusivenw]

Our incredible @illusivenw Research Team is presenting at this year's #BlackHat Europe on December 5th. Click the link below for more details. @mb1687 @4x6hw #networksecurity #infosecurity #BHUSA @BlackHatEvents https://t.co/LURWXHzDxW

[Tom Sela @4x6hw]

Our #defcon26 talk, "Turning Deception Outside-In: Tricking Attackers with OSINT", was just uploaded to youtube. check it out. @hadar0x @tomkahana1 https://t.co/4HIOEH6FP4

[Black Hat @BlackHatEvents]

“When Everyone's Dog is Named Fluffy: A busing the Brand New Security Questions in Windows 10 to Gain Domain-Wide Persistence” - A new #BHEU Briefing by @mb1687 dives into vulnerabilities and mitigations of #Windows10 security features https://t.co/UlENnApDae

[Tom Sela @4x6hw]

@jaredcatkinson thank you for Get-InjectedThread, it is really cool! are you familiar with any implementation that supports both 32bit and 64bit processes from a 32bit process?