Timothy D. Morgan

Founder & CTO of @DeepSurfaceSec
15 years helping others fix their code. Now fixing the brokenness of vuln management. Opinions are often strong and are my own.

[Timothy D. Morgan @ecbftw]

It was a real pleasure working with the @Lansweeper team on this #inventorymanagement / #CyberSecurity integration. They're great partners to have.
https://t.co/F3S8OW6MHF

[DeepSurface Security @DeepSurfaceSec]

Learn more on @Lansweeper’s blog ( https://t.co/nLsMwi0VyS ), our blog ( https://t.co/lzJLiWVOwQ ), or get started now by visiting the Lansweeper - DeepSurface Integration Page ( https://t.co/fFblAdXnZY ).

2/2

[DeepSurface Security @DeepSurfaceSec]

#DeepSurface is thrilled to announce our new Integration Partnership with Lansweeper!

Together we are pushing the boundaries of visibility– giving you a complete view of your assets AND where your #cybersecurity risk really exists.

1/2 🧵

[Timothy D. Morgan @ecbftw]

@techspence DLL sideloading in privileged services or scheduled tasks. Still super common in the real world, anytime someone installs software outside of C:\Program Files https://t.co/t2vdEXYw8S

[Timothy D. Morgan @ecbftw]

https://t.co/3kimtn0mI8

[Timothy D. Morgan @ecbftw]

And this is why I have such a hard time helping newcomers to the field... Thanks for putting it in an nutshell @halvarflake.

[Chris Eng @chriseng]

Wow, @halvarflake managed to capture the security "old-timer" experience in three succinct bullet points.

[Timothy D. Morgan @ecbftw]

@gf_256 Bonus points if you've ever pulled that off during a pentest.
I once submitted negative value as a refund to the "customer". At the report readout, I told the devs "Oh, but I really doubt your fulfillment department would issue the refund" ...*pause*... "You might be surprised."

[Information Warfare Center @cyberintel]

Coming up next on #DRNewsDesk Tim Morgan @DeepSurfaceSec @ecbftw on DeepSurface Adds Risk-Based Approach to Vulnerability Management https://t.co/nK9akoPDQc #bhusa

[Timothy D. Morgan @ecbftw]

@wvuuuuuuuuuuuuu Glad someone is finding it useful!

[wvu @wvuuuuuuuuuuuuu]

As mentioned in the blog post, the technique is from @ecbftw in 2013. The old is new again. https://t.co/UTjYaslw7q

[Horizon3 Attack Team @Horizon3Attack]

Check out a recent finding by one of our own, Naveen Sunkavally. CVE-2022-28219 is an unauth RCE for ManageEngine ADAudit Plus.

This XXE -> Deserialization chain often leads to host compromise as well as priv'd AD creds. Check out the blog post and POC: https://t.co/bLHzhvSnLo

[Timothy D. Morgan @ecbftw]

Was a fun interview.

With that said, these interviews allow for only so much depth in the answers, so I'm curious to know others' thoughts on some of the questions they asked. What are your experiences with the limits of CVSS+TI? Reporting to boards?

[DeepSurface Security @DeepSurfaceSec]

How is risk-based vulnerability management like the weather report?
https://t.co/C2KQQSOvic

[Nicolas Grégoire @Agarri_FR]

OWASP's example implementation of check_private_ip() is quite naive. It can be bypassed with 0x7f.0.0.1 #SSRF https://t.co/M3cttxZtRl

[Timothy D. Morgan @ecbftw]

Patch what matters.
https://t.co/3wc0ZGGFb0

[Timothy D. Morgan @ecbftw]

https://t.co/B3CDatMzPj

[DeepSurface Security @DeepSurfaceSec]

We’re thrilled to announce our latest $4.5 million #seedfunding. Learn how we’re accelerating product development of our award-winning #vulnerability and risk management platform today #cybersecurity #automation https://t.co/ORlC0hvP35

[Alex Ionescu @aionescu]

It’s 2022, and the fix is still “disable the anti malware agent”.

Don’t ever change, infosec/AV industry.

[Greg Linares (Laughing Mantis) @Laughing_Mantis]

#Log4J Worm is ITW

@vxunderground has a sample of the self propagating worm using log4j as a vector.

It installs a Mirai bot which makes sense to targeting embedded Linux devices

Looks like it uses user-agent for exploitation and modifies the binary before sending (?)