Omerez

[Omerez @Omerez_com]

1Y for #NotPetya. 1Y for #EternalBlues stats.
182 countries. 4.5M computers. 10% are vulnerable to #EternalBlue. 34% of networks are vulnerable. #SMBv1 is still enabled with most computers.
Check out https://t.co/8vgumLIn8y for trends by date, country, network size and more... 🎷

[𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 @netresec]

NEW FINDING: There's a 1 bit flag hidden in #SUNBURST DNS requests indicating whether or not the victim has been targeted and the backdoor has progressed to "stage 2" operation.
https://t.co/xxe0SoBgKU

[Prevasio @prevasio]

Part 3 of our Sunburst\SolarWinds Analysis

[Omerez @Omerez_com]

#SolarWindsHack #SolarWindsOrion

[Omerez @Omerez_com]

@campuscodi @craiu @megabeets_ @prevasio @Truesec - great job on sharing latest research and infected domains! 👏 I have a few more which were not mentioned till now (some are giants), and list keeps growing... Wondering about the best way to share it ethically. Thoughts?

[Costin Raiu @craiu]

This is nuts. Solarwinds had a support page (now removed) advising users to DISABLE antivirus scanning for Orion products' folders.

[NSA Cyber @NSACyber]

Malicious cyber actors are using two sets of #TTPs to access protected data in the #cloud. Detect and mitigate against this activity by reviewing our latest #cybersecurity advisory: https://t.co/scmnGlM7cP

[Omerez @Omerez_com]

Too many unpatched #SolarWindsOrion are still live.
Indicators (html body): "SolarWinds.Logo.Footer.svg" AND ("2020.2" OR ("2019.4" AND "Orion Platform HF5"))
https://t.co/Pe51IOUe3o
https://t.co/Ly6GA4Nr1o
#SolarWinds #SolarWindsHack

[Vinoth Kumar @vinodsparrow]

Was reading about a sophisticated attack on FireEye leveraging Solarwinds. Hmmm how that would happened?🤔. Then realized their password was *****123 🤣 #FireEye #SolarWinds

[Omerez @Omerez_com]

@justin_lister @GossiTheDog @TechCrunch @zackwhittaker @n0x08 Updated #EternalBlues stats (May 20, 2019).
Check out screens 12-14 for a drill down into (#EternalBlue) vulnerable/SMBv1 hosts based on network size and country -
https://t.co/8vgumLIn8y

[Matt Miller @epakskape]

Fellow data nerds: here's a snapshot of the vulnerability root cause trends for Microsoft Remote Code Execution (RCE) CVEs, 2006 through 2017.

A few callouts: heap corruption, type confusion, and uninit increased in 2017. Use after free steady y/y but proportionally declined.

[Omerez @Omerez_com]

@jlenkows Are you trying to scan more hosts than the default 256? If so, #EternalBlues supports a scan up to 16,384 IPs in one scan - just edit the IP range.
If you're looking for full automation, I highly recommend #metasploit.

[Omerez @Omerez_com]

@_eypres #PowerBI 💪

[Omerez @Omerez_com]

#EternalBlues stats:
>90% of computers in Uzbekistan and Ecuador still support SMBv1 😱

[Omerez @Omerez_com]

More #EternalBlues scans were taken all of a sudden. Why? #badrabbit 🐇

[BleepingComputer @BleepinComputer]

New Massive Wave of MongoDB Ransom Attacks Makes 26,000 New Victims - by @campuscodi
https://t.co/ftqX3e6RD0

[BleepingComputer @BleepinComputer]

Windows Debug Tool WinDbg Gets a Major Facelift - by @campuscodi
https://t.co/gTafC6OpEX

[Omerez @Omerez_com]

@TalBeerySec EDR market estimated at $2B in 3-4 years. Makes sense for Microsoft to take a share...

[Omerez @Omerez_com]

@VessOnSecurity Any chance Sandra Bullock wrote this script? 😂
https://t.co/Vvq8oo1ia7

[Omerez @Omerez_com]

@0xAmit Did you see #EternalBlues stats? https://t.co/hl1AzmJ1cm
Scanning 28M non-public IPs shows: 2 out of 3 hosts still use SMBv1 😱