Rotem Kerner

maker breaker of things

[Rotem Kerner @kerneronsec]

♫Too many cooks, too many cooks♫ Remote Code Execution in CCTV-DVR affecting over 70 different vendors #0day #CCTV https://t.co/92z7g7fVOl

[Ron Gura @Rongura]

@BoazGolan @AvigdorLiberman @netanyahu אם כבר ארכיון.

[Rotem Kerner @kerneronsec]

@CyTaka_official שימוש ציני במלחמה באקוראינה כטרנד חם לרכב עליו לצרכי פרסום זה באמת נמוך

[Rotem Kerner @kerneronsec]

@GelosSnake windows internals booka are made exactly for this purpose..

[Rotem Kerner @kerneronsec]

@SnapNamesDotCom @netsolcares already did that!

[Rotem Kerner @kerneronsec]

@SnapNamesDotCom and @netsolcares got the worse services ever! Bought a domain at snapnames, they transfer the control to @netsolcares, Which I'm not able to access. now they want a notarized letter to verify its me. And its the same company behind these services!! #domains

[Rotem Kerner @kerneronsec]

@vxunderground These were Times where developing malware was more of weird hobby than a business model

[Rotem Kerner @kerneronsec]

@Nomadtales @NASAPersevere don't you get all acurate on me now.. but if you are already on the case i take molecular compund non the less .. sand is just too vague

[Rotem Kerner @kerneronsec]

@Razael_ @NASAPersevere oh yeah don't take it too seriously.. i love all this space shit.

[Rotem Kerner @kerneronsec]

@TalBeerySec

[Rotem Kerner @kerneronsec]

@malwrhunterteam I've also came by this variant and found out it originated from this repo - https://t.co/34m34RpLMV
which contains an incomplete source code of this malware.
might even be the author behind this.. who knows ;)

[Rotem Kerner @kerneronsec]

@DevishaRochlani Nice addition to that could be their registered protocol handlers. In which enable attackers to identify their presence through web browsers
see this -
https://t.co/AB6leDjgPH

[Rotem Kerner @kerneronsec]

@seanhn @halvarflake you can always covert video to ascii and add subtitles.. techniquly this would still be text communication :)

[Rotem Kerner @kerneronsec]

@lordjerry0x01 @hakluke

[Rotem Kerner @kerneronsec]

@jleyden @DailySwig or being able to remotely detect a wide range of installed apps like: music players, IDE, office applications, crypto-mining, browsers, mail applications, antivirus, video conferencing, virtualizations, database clients, version control clients, chat clients, voice conferencing

[Rotem Kerner @kerneronsec]

@jleyden @DailySwig for once, how about beimg able to determine if a target machine is running an endpoint protection/av.

[Rotem Kerner @kerneronsec]

@yo_yo_yo_jbo if by that you mean trying to measure the difference in timing between existing and non existing url handler - i tried something like that in ff without success

[Rotem Kerner @kerneronsec]

By leaking the existing protocol handlers attackers can identify the presence of the following security vendors
@Bitdefender @TrendMicro @Malwarebytes @avast @GDataPH through the web browser

[Rotem Kerner @kerneronsec]

TLDR; A new blog post about two information disclosure vulnerabilities affecting three of the major web browsers which can be leveraged to leak out a vast range of installed applications, including the presence of security products

https://t.co/5kMbte8zd8