Rory McNamara

Staff Security Researcher @snyksec

[Rory McNamara @PsychoMario]

Swapped out my lab infrastructure for Incus, found some vulnerabilities on the way. Read more here:

[Snyk @snyksec]

🚨 BREAKING: Arbitrary Writes High-Severity Vulnerabilities Discovered in Incus VM Project

Hats off to Snyk security researcher @PsychoMario for the security disclosures: https://t.co/oFhzT1v7id

[Rory McNamara @PsychoMario]

I had a play with some vector databases and identified a new(?) method for persistent prompt injection. Read about it here:

[Snyk @snyksec]

🚨 New threat: Persistent prompt injection with poisoned vector databases!

Discover how “RAGPoison” exposes this risk and learn how to protect your LLMs.

Read more: https://t.co/D5icj6zpOF

#RAGPoison #PromptInjection #Cybersecurity

[Snyk @snyksec]

🚨 New threat: Persistent prompt injection with poisoned vector databases!

Discover how “RAGPoison” exposes this risk and learn how to protect your LLMs.

Read more: https://t.co/D5icj6zpOF

#RAGPoison #PromptInjection #Cybersecurity

[Liran Tal @liran_tal]

/1 🚨 mega-thread on exploiting MCP servers via prompt injection, buckle up 👇

[Snyk @snyksec]

Major credit to the NixOS, Lix, and Guix teams for their incredibly fast response and for issuing patches to fix the issues. Want to see the full exploit chain, from file descriptor exfiltration to root shell? Read the full technical deep dive on our blog: https://t.co/HV7uFH7bgY

[Snyk @snyksec]

With arbitrary directory deletion, we targeted /tmp to race another Nix build process. This second race allowed us to hijack a chown call, letting us change the ownership of any file on the system to a user we controlled. The target? /etc/pam.d.

[Snyk @snyksec]

This foothold allowed us to create a classic Time-of-Check, Time-of-Use (TOCTOU) race condition. By modifying a directory while the garbage collector was running, we could trick a privileged Nix process into emptying any directory on the system.

[Snyk @snyksec]

Our path to root began by looking at failed builds. We found that we could exfiltrate a file descriptor from a sandboxed build process, giving us the ability to modify a directory inside the supposedly immutable /nix/store even after the build was finished!

[Snyk @snyksec]

We just dropped a deep dive on a series of vulnerabilities the Snyk Security Labs team found in NixOS!

When chained together, they allow for a full privilege escalation from any user to root on a default installation. #NixOS #Linux #infosec #vulnerability

[Rory McNamara @PsychoMario]

NixOS is super neat, I managed to find some vulnerabilities resulting in a pretty cool privilege escalation. I wrote about it here: https://t.co/N4S64hMMjL

[Rory McNamara @PsychoMario]

Great work from my team:
Is your local AI tooling really safe from attack?

[Snyk @snyksec]

🚨 Security alert! We found vulnerabilities in Cortex.cpp (Jan AI). While self-hosted #AI is booming, security can't be an afterthought. Dive into our findings and how we addressed them. 👇 https://t.co/dZvFLVCOSD

[Rory McNamara @PsychoMario]

@andersonc0d3 I had assumed this was just intentional behaviour, I used this to bypass a proposed privesc patch in wpa_supplicant last year: https://t.co/FKka9AntIo

[Snyk @snyksec]

Unveiling the mysteries of ComfyUI Custom Node Vulnerabilities with our latest blog post! 🕵️‍♂️ Dive deeper into plugin ecosystem security with our seclabs team's in-depth exploration. Don't miss it! ⚡ #AppSec #AIsecurity #ComfyUI More here: https://t.co/laWtqbFNsa

[Snyk @snyksec]

Ever wondered how Spring properties can be leveraged to obtain Remote Code Execution (RCE)? Our seclabs team expanded on @steventseeley's research—check it out here: https://t.co/DsIRlRSAYO #Cybersecurity #RCE #JavaSecurity #AppSec #SpringFramework

[Snyk @snyksec]

Vulnerability Alert: Our SecLabs uncovered CVE-2024-21545 in Proxmox VE 8.2.2, allowing attackers with limited permissions to potentially take full control of systems.

Explore our breakdown of the discovery, exploitation, and mitigation process. https://t.co/4yDH7xOtzj

[Rory McNamara @PsychoMario]

Proxmox CVE-2024-21545!
I turned a local file read into full root command execution on Proxmox VE 8.2.2. Pretty cool chain if I do say so myself.
Writeup: https://t.co/4Qc8BM3DqG

[Rory McNamara @PsychoMario]

@katz3n_ will speak about this at @hackfest_ca, Day 2 Track 2 15:30. Be sure to check it out!

[Rory McNamara @PsychoMario]

I had some fun exploiting Ubuntu 24.04 when it came out. Read more about it here:

[Rory McNamara @PsychoMario]

I had some fun exploiting Ubuntu 24.04 when it came out. Read more about it here:

[Snyk @snyksec]

Our security labs team found a privilege escalation vulnerability chain in Ubuntu 24.04. Read about the journey of discovery and exploitation here: https://t.co/CLtJJicd5P #vulnerability #0day

[Snyk @snyksec]

Your #code might be more vulnerable than you think. 😱

#RepoJacking is a powerful, yet widely unknown threat to your software supply chain. Learn how this attack works and how to defend against it in our latest blog post: https://t.co/2ouoFsrpMe

[Snyk @snyksec]

New research: Exploiting WebSockets for HTTP cache poisoning & bypassing Istio RBAC with HTTP response header injection. Learn how these attacks work & secure your apps. https://t.co/GWrorOwt3b #websecurity #istio #securityresearch