Joris van de Vis

SAP security researcher and specialist

[International Cyber Digest @IntCyberDigest]

❗️ Linux is having a brutal week. Another local to root privilege escalation vulnerability just dropped: "Copy Fail 2: Electric Boogaloo."

This is the third Linux LPE in a row, after Copy Fail and Dirty Frag. The PoC is public on GitHub. There is still no coordinated patch.

https://t.co/6XifksYgZ6

[Joris van de Vis @jvis]

@vxunderground I can confirm the exploit works, its not a 0day though but a 4 month old vulnerability.

[vx-underground @vxunderground]

"Scattered Lapsus$ Hunters (UNC3944)", have released an alleged SAP7 0day exploit onto Telegram.

I can't confirm or deny if it's an actual 0day, I have no way to test or confirm anything. However, it is fully weaponized.

I've uploaded it to VXUG

https://t.co/rCLwMHpY0w

[Joris van de Vis @jvis]

The premier SAP Security Customer events returns to Rotterdam! See here for details:
https://t.co/7YwTH9SqK2

[Lennaert @lennaert89]

Super proud of the amazing work the team has done!

[Joris van de Vis @jvis]

@seccubus op tv voor het @DIVDnl om het risico van online zonnepanelen te duiden 🤩

[Pablo Artuso 🗿🇦🇷 @lmkalg]

Since 12/22, SAP is patching critical vulnerabilities as a result of a research project that I've been doing for some time. Today, my key finding was patched: CVE-2023-28761. An innocent 6.5 bug, that opens the door to abusing all those critical patched bugs through the Internet.

[Joris van de Vis @jvis]

@0xkormorant Dus dat. Gejank voor de bühne, mosterd na de maaltijd, goedkope retoriek, doorzichtig als een glas water en wat al niet meer is.

[Emil Coenen @ecoenen73]

@PROTECT4S @jvis https://t.co/7l7vsCeeCb

[Joris van de Vis @jvis]

@vah_13 any paper planned on this? 🍿😬

[Dutch Institute for Vulnerability Disclosure @DIVDnl]

Present at @HotelHacker with talks, fun and disclosures.

[Protect4S @PROTECT4S]

While he is not working, @jvis is a dedicated volunteer at @DIVDnl Institute for Vulnerability Disclosure.

@Cvthof stated that the mission of @DIVDnl is to make the digital world safer.

@PROTECT4S is proud to support @DIVDnl mission through a donation of €1000!

Link below!

[Lennaert @lennaert89]

Together with all the other volunteers of @divdnl we've made it in to the @ncsc_nl Wall of Fame 2022!

Congratulations, super proud of everyone for all the hard work that went in to making this happen.

https://t.co/tYekaKy9k9

[Protect4S @PROTECT4S]

@PROTECT4S wishes our fellow Chinese friends a Happy Chinese New Year!

Secure your SAP systems for your year to be as lovely as the rabbit.Strengthen your SAP security to be as sensitive as a rabbit’s hearing.Detect threats to secure your SAP systems.

Contact us! Link below!

[Emil Coenen @ecoenen73]

@PROTECT4S @jvis https://t.co/rjkSdEhoq8

[Joris van de Vis @jvis]

Wat een leuk @DIVDnl eindejaarsfeest! Met vuurspuwen en een lokaal kampioenschap server werpen 🤩

[Martin Gallo 🇦🇷 💚✊🏾🚀 @MartinGalloAr]

🙌🏾
Since I left @SecureAuth, I was looking for new homes to the SAP security open source tools I've been maintaining for the last 10 years.

I got to share that we found new communities to host them! 😀

+ details: https://t.co/AqGXNVUNyZ

(cont)

[Joris van de Vis @jvis]

https://t.co/B1yyVbb0oa is fun to play with. From marketing taglines to even Abap code snippets with great outcome. Yet this is just plain wrong 😂 ⬇️ #ibegtodiffer

[Joris van de Vis @jvis]

@vah_13 Similar to the Erpscan GitHub repo?! Or different?

[Vahagn Vardanian @vah_13]

The SAP SSFS decryptor is ready!

#sapsecurity #penetrationtesting