Mirko Conti

( Security enthusiast && Cybersecurity architect at Allego ) == true

[Mirko Conti @_mkcn]

If your code is executed on the attacker's pc then it is not your code anymore

if the attacker's code is executed on your pc, then it is not your pc anymore

[Mirko Conti @_mkcn]

A very promising idea, I hope to try it soon!
https://t.co/21BSbRYe8B

[Madhu Akula @madhuakula]

Thanks to all the wonderful people for your contributions, valuable feedback, suggestions & encouragement 🔥 🚀

🥳 We have 3000 Github 🌟 Kubernetes Goat 🐐
https://t.co/7omjqBTYLr

Plz Share & RT 🙏

#Kubernetes #CNCF #Hacking #InfoSec #Community #opensource #Security #Pentest

[Nagli @galnagli]

The team at @OpenAI just fixed a critical account takeover vulnerability I reported few hours ago affecting #ChatGPT.

It was possible to takeover someone's account, view their chat history, and access their billing information without them ever realizing it.

Breakdown below 👇

[Florian Roth ⚡️ @cyb3rops]

🥹

[Sam Curry @samwcyo]

Super excited to release our car hacking research discussing vulnerabilities affecting hundreds of millions of vehicles, dozens of different car companies:

https://t.co/xCHG5oLYWK

Contributors:
@_specters_ @bbuerhaus @xEHLE_ @iangcarroll, @sshell_ @infosec_au @NahamSec @rez0__

[Mirko Conti @_mkcn]

@homelabit Recentemente mi è stato consigliato questo modulo di HackTheBox
https://t.co/FAB6ACg8hL

[Mirko Conti @_mkcn]

@smaury92 CVE-2022-41352?

[Corben Leo @hacker_]

Uber was hacked.

The hacker social engineered an employee -> logged into the VPN and scanned their intranet. 👇

[Sid Palas @sidpalas]

1/ There are many ways to manage credentials in Kubernetes, some better than others: 🔐

- Kubernetes Secrets
- Encrypt Secrets (Bitnami, KSOPS)
- External secret stores
- Secrets Store CSI Driver
- Sidecar injectors (Vault, Conjur)

Here's the rundown: 🧵

[Kinnaird McQuade @kmcquade3]

The Center for Internet Security released the Supply Chain Security Benchmark!

It is SO awesome to see more industry attention on locking down CICD pipelines.

Table of contents attached.

PDF link: https://t.co/WSyOoZme7p

[Jason Choi @mrjasonchoi]

I was today years old when I found out Cloudflare has a wall full of lava lamps they feed into a camera as a way to generate randomness to create cryptographic keys

[Mirko Conti @_mkcn]

#WWDC #passkeys #apple
"First you enter the password."
Ok.
"Then, it is usually obfuscated through something like hashing plus salting, and the resulting salted hash is sent to the server."
What!?
Why so many people think passwords are hashed client-side?
https://t.co/4CuPZX41BG

[@mikko @mikko]

https://t.co/RJpx9o71mg

[Mirko Conti @_mkcn]

@PincoPallinoQ @JediPerLItalia fonte di "alimentazione"*

[Mirko Conti @_mkcn]

@PincoPallinoQ @JediPerLItalia Era uno dei primi dispositivi passivi, quindi senza batteria. Richiede però una fonte di "alimentare" esterna.
https://t.co/e7zV9jbOj8

[MG @_MG_]

13 seconds. That’s the amount of time an OMG Cable had to be connected to my Android for @int0x80 to have ongoing access to my camera, microphone, photos, messages, GPS, etc.

Full episode on @Hak5: https://t.co/2823tfsyFc

[Loïc Castel @Dick_Reverse]

First mindmap - Am I vulnerable to Log4shell (v5.0, updated with higher impact for CVE-2021-45046)

[Mirko Conti @_mkcn]

Tricky one, but nice challenge

[Louis Dion-Marcil @ldionmarcil]

@caspicat @SonarSource this is equally surprising and terrorizing to me. great catch

[Mirko Conti @_mkcn]

8,0𝗘

unexpected disk size