Dom Walterspiel

Taster of beer/whiskey/wine, eater of breakfast burritos, archery and football fiend. Cloud Security @wiz

[Dom Walterspiel @DomWalterspiel]

@ChotiSheikhni @ShaykhSulaiman It’s a fake. See the comment right above yours.

[Hillai Ben-Sasson @hillai]

We found a public AI repo on GitHub, exposing over 38TB of private files – including personal computer backups of @Microsoft employees 👨‍💻

How did it happen? 👀
A single misconfigured token in @Azure Storage is all it takes 🧵⬇️

[Wall Street Mav @WallStreetMav]

Have you checked the ingredients in your chicken sandwich at Chick-fil-A or Popeyes? You might want to.

"Popeyes chicken sandwich, come to find out they have over 40 ingredients in a Popeyes chicken. 32 of them were man-made chemicals."

Have you cut down on fast food due to the massive amounts of chemicals? Even McDonald's has over 12 ingredients in their fries.
🚨🚨🚨

[Robert M. Lee @RobertMLee]

I appreciate everyone’s support on our security event. Not to make light of it but I��m proud of our security team for stopping the criminals at a single onboarding employee’s email account. No internal systems were compromised. No criminals paid. Transparency and defense can win

[Bill Ackman @BillAckman]

The gov’t has about 48 hours to fix a-soon-to-be-irreversible mistake. By allowing @SVB_Financial to fail without protecting all depositors, the world has woken up to what an uninsured deposit is — an unsecured illiquid claim on a failed bank. Absent @jpmorgan @citi or @BankofAmerica acquiring SVB before the open on Monday, a prospect I believe to be unlikely, or the gov’t guaranteeing all of SVB’s deposits, the giant sucking sound you will hear will be the withdrawal of substantially all uninsured deposits from all but the ‘systemically important banks’ (SIBs). These funds will be transferred to the SIBs, US Treasury (UST) money market funds and short-term UST. There is already pressure to transfer cash to short-term UST and UST money market accounts due to the substantially higher yields available on risk-free UST vs. bank deposits. These withdrawals will drain liquidity from community, regional and other banks and begin the destruction of these important institutions. The increased demand for short-term UST will drive short rates lower complicating the @federalreserve’s efforts to raise rates to slow the economy. Already thousands of the fastest growing, most innovative venture-backed companies in the U.S. will begin to fail to make payroll next week. Had the gov’t stepped in on Friday to guarantee SVB’s deposits (in exchange for penny warrants which would have wiped out the substantial majority of its equity value) this could have been avoided and SVB’s 40-year franchise value could have been preserved and transferred to a new owner in exchange for an equity injection. We would have been open to participating. This approach would have minimized the risk of any gov’t losses, and created the potential for substantial profits from the rescue. Instead, I think it is now unlikely any buyer will emerge to acquire the failed bank. The gov’t’s approach has guaranteed that more risk will be concentrated in the SIBs at the expense of other banks, which itself creates more systemic risk. For those who make the case that depositors be damned as it would create moral hazard to save them, consider the feasibility of a world where each depositor must do their own credit assessment of the bank they choose to bank with. I am a pretty sophisticated financial analyst and I find most banks to be a black box despite the 1,000s of pages of @SECGov filings available on each bank. SVB’s senior management made a basic mistake. They invested short-term deposits in longer-term, fixed-rate assets. Thereafter short-term rates went up and a bank run ensued. Senior management screwed up and they should lose their jobs. The @FDICgov and OCC also screwed up. It is their job to monitor our banking system for risk and SVB should have been high on their watch list with more than $200B of assets and $170B of deposits from business borrowers in effectively the same industry. The FDIC’s and OCC’s failure to do their jobs should not be allowed to cause the destruction of 1,000s of our nation’s highest potential and highest growth businesses (and the resulting losses of 10s of 1,000s of jobs for some of our most talented younger generation) while also permanently impairing our community and regional banks’ access to low-cost deposits. This administration is particularly opposed to concentrations of power. Ironically, its approach to SVB’s failure guarantees duopolistic banking risk concentration in a handful of SIBs. My back-of-the envelope review of SVB’s balance sheet suggests that even in a liquidation, depositors should eventually get back about 98% of their deposits, but eventually is too long when you have payroll to meet next week. So even without assigning any franchise value to SVB, the cost of a gov’t guarantee of SVB deposits would be minimal. On the other hand, the unintended consequences of the gov’t’s failure to guarantee SVB deposits are vast and profound and need to be considered and addressed before Monday. Otherwise, watch out below.

[Shir @shirtamari]

Vulnerability full disclosure - New Oracle cloud vulnerability allowed users to access the virtual disks of other Oracle customers >>

[Clint Gibler @clintgibler]

☁️ @wiz_io worked with Azure to get middleware agents new auto-patching capabilities

So now you don't have to manually patch critical vulns in software Azure installed for you that you may not know you have

https://t.co/CXLEnKNzY7

[Dom Walterspiel @DomWalterspiel]

Here we go! @sagi and @nirohfeld from @wiz_io kicking off @fwdcloudsec in Boston! Pumped to be a sponsor of this great event.

Should be an awesome day of talks and we’re hosting a great event (with darts) tnght. *Ping me if you’d like to join us.
#fwdcloudsec #cloudsecurity

[Dom Walterspiel @DomWalterspiel]

Very much looking forward to this awesome event with @wiz_io We are hosting a great party afterwards. Please DM me if you’d like to attend.

[fwd:cloudsec @fwdcloudsec]

We're happy to announce Wiz is a Silver sponsor for fwd:cloudsec! @wiz_io https://t.co/u1JtRvbMAg

[Scott Piper @0xdabbad00]

This is a great diagram by @ramimacisabird showing the initial compromise vector in known AWS breaches on the left and what the attacker did with their access.

[sagitz @sagitz_]

Today Wiz Research (@shirtamari, @nirohfeld, @ronenshh and myself) published details on #ExtraReplica, a severe vulnerability that allowed anyone to access the databases of other #Azure customers.

Here’s how we did it: 🧵 (1/n)
https://t.co/4hNas25zIM

[Wiz @wiz_io]

Big shout out to @shirtamari, @nirohfeld, @ronenshh and @sagitz_ for making MSRC's Q1 research leaderboard, coming in at #5 for Azure and #15 overall! MSRC excels in partnering with researchers, which further advances their product security. https://t.co/kHgQlk8t0E

[World of Statistics @stats_feed]

Company’s biggest acquisition:

Dell: EMC, $67B
IBM: Red Hat, $34B
Salesforce: Slack, $27.7B
Microsoft: LinkedIn, $26.2B
Facebook: WhatsApp, $19B
Intel: Altera, $16.7B
Amazon: Whole Foods, $13.7B
Google: Motorola Mobility, $12.5B
Uber: Postmates, $2.65B
Apple: Beats, $3B

[alon @41thexplorer]

"Under threat, it took us hours to deploy @wiz_io. From the time that #Log4Shell got identified to the time we could assess the impact of the risk on our org took 2-3 days. Last year, it would have been infinite, we would have closed 15% of what we've learned we have" -@igortsyg

[Dom Walterspiel @DomWalterspiel]

@AshleyEANews @CBSNewsRadio @jeffpeguescbs @james_a_lewis @DanPatterson @MalcolmNance @SeanPlankey @CyberSheath_CEO Oh shit!

[Dom Walterspiel @DomWalterspiel]

@joerogan mountain lion nails a deer https://t.co/k85LEb7Mqp

[Dom Walterspiel @DomWalterspiel]

@whoismrrobot creator @samesmail and writers with @Tanium's consultants for the show on the mainstage at #TaniumCONVERGE Love it.

[Dom Walterspiel @DomWalterspiel]

@HardcoreHistory You talked about Compton Cowboys! Friend is making powerful doc: https://t.co/l8c9rwCAqK Trailer: https://t.co/Q5vB67tURz