Michael Cherny

Programmer, Security Researcher, Architect, Tech enthusiast, now Chief Architect @aquasecteam

[Itay Shakury @itaysk]

We've recently launched VEX Hub, and today we have its first contribution from @Rancher_Labs! Now Trivy users who scan Rancher projects (k3s, longhorn, harvester, etc) will get the most accurate vulnerability reports, post Rancher team's vulnerability triage. Additionally >>

[Yaniv Agman @AgmanYaniv]

Exciting news! Tracee's new version v0.13.0 is here, and it brings a brand new user experience through policies. With policies, you can easily define rules for specific workloads. Check out the release notes for more info! https://t.co/sKFvXRSjm5 #Tracee #eBPF #RuntimeSecurity

[Michael Cherny @chernymi]

Very interesting talk. Thank you @drhyrum .

[BlueHat IL @BlueHatIL]

Big thanks to Hyrum Anderson for closing out the awesome first day of BlueHat IL with his talk on the unmanaged risks of chatbots, GPT-4, and more.

[Michael Cherny @chernymi]

Truly impressive and inspiring presentation it was. Kudos @benny_zeltser and @LuskyYehonatan

[BlueHat IL @BlueHatIL]

The amazing Benny Zeltser & Jonathan Lusky hopped from ring 3 into ring -2 and back, just in time to tell us how.

[Michael Cherny @chernymi]

I am really not sure why that *truely* a surprise. We should be sad, but actually this is one of those “not again!!!” sort of things…

[Nick Frichette @Frichette_n]

*screaming in cloud security* https://t.co/rjPV81wYxT

[Michael Cherny @chernymi]

Well structured and easy to understand. Like when potentially complicated subject is made approachable.

[Viacheslav Biriukov @brk0v]

mmap() is a tremendously important Linux syscall. Many open-source and in-house databases and KV storages use it internally to simplify data access. That's why it's so essential for SREs to understand its interaction with Page Cache: https://t.co/SaLhniuPpK

[Nick Frichette @Frichette_n]

New cloud security research! We found a vulnerability in AWS AppSync that allowed us to trick the AppSync service to assume roles in other accounts, allowing us to access their resources. https://t.co/cu27TJCN7R

[Christophe Tafani-Dereeper @christophetd]

My awesome colleague @Frichette_n has found a cross-tenant vulnerability in AWS AppSync, allowing an attacker to access data in victim's accounts.

Write-up: https://t.co/ddIvV0Fvyu

AWS security bulletin: https://t.co/O1qk8RTYj1

[Michael Cherny @chernymi]

Cooperation is a key. Very much agree. Truly hope that In the open source age it can actually happen. So much redundant work is done over the years by security industry to overcome “traceability” shortcomings of vendors.

[Brendan Gregg @brendangregg]

New startups are developing eBPF as a "zero instrumentation" observability/APM solution. Trace plaintext HTTP/gRPC/etc. across your site calls without code changes (zero added instrumentation). Currently via uprobe hacking. 1/n

[Michael Cherny @chernymi]

@bradgeesaman Thank you for that. My whole family was amused 😁

[Will Schroeder @harmj0y]

In case you missed it, @exploitph and @4ndr3w6S just released some _awesome_ work that just landed into Rubeus' master branch- "Diamond Tickets"! Check out more details at https://t.co/02Pw2ygXzU. Great work Charlie and Andrew!!

[Sagie Dulce @SagieDulce]

Diamond #kerberos attack now part of #Rubeus.
Original research by @TalBeerySec & @chernymi

[Michael Cherny @chernymi]

So, that’s a fun conversation to read…

[Darren Shepherd @ibuildthecloud]

I just want to point out to
@fatherlinux
- I was right. I KNEW this would happen at some point. Mixing and matching FUD and kernel issues unrelated to your point has always been begging for trouble.

[Sinaei @Intel80x86]

After 3 years of development, today we proudly announce & celebrate the first release of a new hypervisor-based user-mode & kernel-mode debugger, @HyperDbg. 🎉

As an alternative to #Windbg, HyperDbg is mainly built for analyzing, reversing, and fuzzing!

https://t.co/hpkeAuKiJY

[Bryan Boreham ➡️ BlueSky @bboreham]

Some tips on crafting your submission to KubeCon / CloudNativeCon, from my perspective as a previous program committee member reading them:

0. No sales pitches. We eject them first. You waste a little of my time and a lot of your time even typing one in.

[Nick Frichette @Frichette_n]

I wrote up some thoughts around using stolen IAM credentials. This covers how to check if they are valid, how to use them, and covers some operational security concerns along with some potential tips for defenders to detect shady activity.
https://t.co/KpaOTNENfe

[Jayden @tritonesum]

Well that was a very difficult but fun exploit to write. We've reported to Linux and will do a write-up soon (@pqlqpql and myself). Details redacted since it's not patched yet.

[Nick Frichette @Frichette_n]

If it's useful for anyone, I'm making my AWS API client public. This is what I used to uncover two XSS vulns in the AWS Console and is based off the silent permission enumeration research I did a while ago. I have to stress it is VERY hacky software. https://t.co/dEOkP949bf

[Nick Frichette @Frichette_n]

Tremendous news everyone (in offsec)! There's a bypass for the new GuardDuty InstanceCredentialExfiltration finding! It's via VPC endpoints! (I caution this is with limited testing)

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

So much fun this morning, a @Microsoft signed #mimikatz

Thank you @jxy__s for your research and a such beautiful code

Now, will wait for people to understand that the "source file" can be really another thing than a file on the disk