JT

ITsec pro, pen-tester, white-hat hacker

[/r/netsec @_r_netsec]

FireEye has been hacked, and their red team tools stolen. They've released the detection/countermeasures on their GitHub! https://t.co/WF4mo3Gj4k

[Nicolas Krassas @Dinosn]

Bypassing LSA Protection without Mimikatz on Windows 10
https://t.co/GByLOgIP27

[The Hacker News @TheHackersNews]

⚠️ WARNING!

All versions of #Microsoft Windows (7, 8.1, 10, Server 2008, 2012, 2016, 2019) operating systems contain 2 new font parsing library RCE vulnerabilities that are:

—CRITICAL
—UNPATCHED
—Under active ZERO-DAY attacks

Details ➤ https://t.co/PXfkKFY250

#cybersecurity

[cirosec GmbH @cirosec]

cirosec colleague @jttgo at #ITDefense about cloud security

[Nicolas Krassas @Dinosn]

DNS Spoofing in Kubernetes Cluster https://t.co/cJWB42oK93

[Nicolas Krassas @Dinosn]

Privilege Escalation Cheatsheet (Vulnhub) https://t.co/h1uVqfFP8m

[Nicolas Krassas @Dinosn]

PINJECTRA: Known Windows 10 64-bit Process Injection Techniques + New One (dubbed "Stack Bomber") as a C++ Library
https://t.co/V2qeNn4k2N

[cirosec GmbH @cirosec]

Our colleagues discovered a format string vulnerability in Windows Explorer.
https://t.co/qc13CFHq5J

[JT @jttgo]

For all those using Google Authenticator, time to think about it

[Предраг Цујановић � Ｐ𝗿𝐞ⅆｒ𝚊ⓖ Ⅽ𝗎𝐉ａｎ𝚘𝕧ⓘć @cujanovic]

Attacking Google Authenticator https://t.co/4SxhX6bKc1

[JT @jttgo]

Just met @jaysonstreet at #LASCONATX. Great talk. Looking forward to meet you again at #ITDefense @cirosec.

[JT @jttgo]

Make users part of your security team, not part of the problem. If you succeed your users will become an IDS in your organization. Great talk @jaysonstreet at #LASCONATX

[JT @jttgo]

Container Security, Serverless and Orchestration. Great Training by @bondijois and Tilak T at Lascon Austin, Texas @LASCONATX. It isn’t that easy to keep your containers secure. Nice penetration testing tools available.

[Ekaterina Budnikov @KatjaBudnikov]

JavaScript Security - Webbrowser in Gefahr by Joshua Tiago (@cirosec ) @enterjsconf #ejs18 #katjasays #sketchnotes #javascript #security #xss

[cirosec GmbH @cirosec]

JavaScript-Security – Webbrowser in Gefahr - Vortrag von cirosec-Berater Joshua Tiago heute auf der #enterJS in Darmstadt
https://t.co/L4RSznexbe

[Lu Kassen @Axel_Lukassen]

#ejs18 great talk on security by joshua tiago at @enterjs

[Nick Sullivan @grittygrease]

It’s hard to overstate how bad this F5 bug is. It’s basically DROWN without needing SSLv2. If you have a vulnerable F5, anyone can sign things with your RSA private key. Bleichenbacher strikes again. https://t.co/sIdpsA3w5I

[JT @jttgo]

#owasp make the OWASP top ten great again. Keynote talk at #AppSecUSA

[James Forshaw @tiraniddo]

This only took me 4 years to write :-) Abusing default Windows Kernel Debugging settings to bypass the login screen. https://t.co/6QLQSlrIIX

[Jerry Gamblin @JGamblin]

Windows 10 Clipboard Vulnerability POC:
Win+L: Lock workstation
Win+ENTER: Start Narrator
CapsLock+F1: Open Narrator Help
Ctrl+V: Profit!