Rojan Rijal

Offensive security research & building @OphionSecurity

[Rojan Rijal @mallocsys]

@adnanthekhan What has been your experience with Bedrock like specially around the cost? Have been thinking of doing something similar for a different use case but I am not sure what the cost would be like.

[Rojan Rijal @mallocsys]

@disputifier @disputifier let us know if we can help in any way! No expectations or selling anything.

[Matthew Prince 🌥 @eastdakota]

Yesterday a quasi-judicial body in Italy fined @Cloudflare $17 million for failing to go along with their scheme to censor the Internet. The scheme, which even the EU has called concerning, required us within a mere 30 minutes of notification to fully censor from the Internet any sites a shadowy cabal of European media elites deemed against their interests. No judicial oversight. No due process. No appeal. No transparency. It required us to not just remove customers, but also censor our 1.1.1.1 DNS resolver meaning it risked blacking out any site on the Internet. And it required us not just to censor the content in Italy but globally. In other words, Italy insists a shadowy, European media cabal should be able to dictate what is and is not allowed online.

That, of course, is DISGUSTING and even before yesterday’s fine we had multiple legal challenges pending against the underlying scheme. We, of course, will now fight the unjust fine. Not just because it’s wrong for us but because it is wrong for democratic values.

In addition, we are considering the following actions: 1) discontinuing the millions of dollars in pro bono cyber security services we are providing the upcoming Milano-Cortina Olympics; 2) discontinuing Cloudflare’s Free cyber security services for any Italy-based users; 3) removing all servers from Italian cities; and 4) terminating all plans to build an Italian Cloudflare office or make any investments in the country.

Play stupid games, win stupid prizes. While there are things I would handle differently than the current U.S. administration, I appreciate @JDVance taking a leadership role in recognizing this type of regulation is a fundamental unfair trade issue that also threatens democratic values. And in this case @ElonMusk is right: #FreeSpeech is critical and under attack from an out-of-touch cabal of very disturbed European policy makers.

I will be in DC first thing next week to discuss this with U.S. administration officials and I’ll be meeting with the IOC in Lausanne shortly after to outline the risk to the Olympic Games if @Cloudflare withdraws our cyber security protection.

In the meantime, we remain happy to discuss this with Italian government officials who, so far, have been unwilling to engage beyond issuing fines. We believe Italy, like all countries, has a right to regulate the content on networks inside its borders. But they must do so following the Rule of Law and principles of Due Process. And Italy certainly has no right to regulate what is and is not allowed on the Internet in the United States, the United Kingdom, Canada, China, Brazil, India or anywhere outside its borders.

THIS IS AN IMPORTANT FIGHT AND WE WILL WIN!!!

[Rojan Rijal @mallocsys]

If you are building a vibe coded app and launching a product out of it, hit us @OphionSecurity and we will do a security assessment and have actionable security measures ready within 72 hours. #vibecoding #security #cybersecurity

[Pop Punk @PopPunkOnChain]

If you want free API keys just open the network tab on literally every vibe coded app.

In the last 24 hours i've looked at the requests of every vibe coded app I see and 9 times out of 10 they're leaking private credentials.

[Rojan Rijal @mallocsys]

I just got access to an attacker's daily diary. Here is what I learned 👇

🕘 9:00 AM: Clock in.
🔎 9:12 AM: Google Dork says https://t.co/PpN8LQE7bz is still alive.
😎 9:30 AM: No rate limits, no auth. Just vibes.
🗃 10:00 AM: Dumped staging DB from https://t.co/aa8ZDOvcp3.
😬 10:20 AM: Reused creds work on prod. Consistency is key.
🛡 10:45 AM: Oh no… a WAF!
😈 10:46 AM: JK, it’s only on www. Your 12 forgotten subdomains are unprotected.
🥪 12:00 PM: Lunch break. Your asset inventory is crying is forgottenland.
💀 2:00 PM: You schedule a pentest.
📅 2:01 PM: For next quarter.
🪄 3:00 PM: Still pivoting. Still no alert.
🎯 4:30 PM: Internal Jenkins on an old subdomain. Secrets everywhere.
💰 4:45 PM: Got user data, employee data, AWS keys. It’s a buffet.
🕔 5:00 PM: Clock out. Easy day.

jk.....
Attackers don’t follow your IR plan.
They don’t wait for your quarterly pentest.
They don’t work 9–5.
They hunt exposed assets, old creds, shadow subdomains, public GitHub leaks, leaked data in SaaS that will give away more information or give PII etc.
They’re hacking every minute.
Are you?

#attacksurfacemanagement #offensivesecurity #cybersecurity #hacking #continuousmonitoring #assetinventory #offensivemonitoring

[Rojan Rijal @mallocsys]

I hacked UberEats in 2017. Here is the story.

#ubereats #hacking #uber #cybersecurity #bugbounty

[Rojan Rijal @mallocsys]

It was amazing to present at @_kernelcon_ today. Thank you for the gift KernelCon team! #kernelcon #offensivesecurity #researchontheroad

[Rojan Rijal @mallocsys]

💥 Q1 Update from the Field: Real-World Hacking with Orion 💥

In Q1, we pointed Orion, our offensive Attack Surface Management platform, at a large enterprise to see what it could uncover. The results speak for themselves:
🔍 𝟵 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗿𝗲𝗽𝗼𝗿𝘁𝗲𝗱
🚨 𝟴 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹, 𝟭 𝗛𝗶𝗴𝗵
🤖 The High severity finding was discovered entirely by Orion with no human involvement
💰 Approximately $𝟰𝟱,𝟬𝟬𝟬 in rewards from responsible disclosure
🌐 Orion also surfaced multiple vulnerabilities in widely-used open-source software such as a supply chain vulnerability in a Microsoft repository

The 9 issues had the potential to expose millions of users’ sensitive data including 𝗦𝗦𝗡𝘀, 𝗗𝗼𝗕𝘀, 𝗲𝗺𝗮𝗶𝗹𝘀, 𝗮𝗻𝗱 𝗮𝗱𝗱𝗿𝗲𝘀𝘀𝗲𝘀. If exploited, they could have led to major regulatory fines, incident costs, and increased insurance premiums.

𝗤𝟮 𝗴𝗼𝗮𝗹: 𝟱𝟬+ 𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗳𝗶𝗻𝗱𝗶𝗻𝗴𝘀 𝗮𝗰𝗿𝗼𝘀𝘀 𝗺𝘂𝗹𝘁𝗶𝗽𝗹𝗲 𝗼𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻𝘀. 𝗟𝗲𝘁’𝘀 𝗴𝗼 🔍⚔️

#OffensiveSecurity #AppSec #RedTeam #SecurityAutomation #BugBounty #ASM

[Rojan Rijal @mallocsys]

RT @uraniumhacker: We are doing #VibeSecurityForAI

If you are an AI startup (pre-seed or seed ) we will test your application for free. We…

[Rojan Rijal @mallocsys]

Not yet a full multiplayer but doing some basic "Simon Says" style game with increasing difficulties. Will add leaderboard style system soon. Open to ideas to improve it further @levelsio https://t.co/H7LfymszAt

[Rojan Rijal @mallocsys]

@aidenybai Not even kidding, @aidenybai you should look into integrating this into a phishing platform that security teams can use. It is killer to deploy quick phishing exercises in pentests.

[Rojan Rijal @mallocsys]

tj-actions compromise is a great reminder that pinning the action/dependency to a commit SHA instead of a version tag is safer and securer. We monitor repositories of some public organizations, and most of them are safe because they use a SHA like tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf.

However, if an organization is pinning the malicious commit they are still vulnerable: 0e58ed8671d6b60d0890c21b07f8835ace038e67

https://t.co/QKhwswitVD #github #supplychain

[Charlie Marsh @charliermarsh]

Oh wow, a popular GitHub Action (tj-actions/changed-files) was fully compromised. Someone committed a base64-encoded payload that runs a script that in turn prints out encoded secrets…

Stay safe out there!

[Rojan Rijal @mallocsys]

🚨 Continuous Monitoring Prevents Million-Dollar Breaches 🚨

In cybersecurity, threats evolve but so should our defenses. At Ophion Security, we continuously monitor Fortune 500 companies’ public assets not just domains and IPs, but also SaaS services, cloud assets, and web applications that often slip under the radar.

In October, we identified a vulnerability in a Fortune 500 subdomain that exposed highly sensitive PII (DoB, SSN, Addresses, Phone Numbers) to unauthenticated users.

Fast forward a few months: Our continuous monitoring flagged a new but similar asset: a different domain, but familiar API patterns in its JavaScript. Recognizing the fingerprint of a shared infrastructure, we re-tested the vulnerability from October. It was still exploitable. We immediately reported it.

💡 Key takeaway? Cyber risks don’t end when you fix a single issue. Without continuous monitoring, this vulnerability could have gone unnoticed until an attacker found it first.

🛡️ Proactive security isn’t just an option it’s a necessity.

If you’re not continuously monitoring your entire attack surface, someone else is. And they may not have your best interests in mind.

#CyberSecurity #ContinuousMonitoring #BreachPrevention #AttackSurfaceManagement #CTEM #Pentest

[Rojan Rijal @mallocsys]

I reached level 11 in Taptastic! 🎮

Final speed: Super Fast
Tiles: 9

The pattern that defeated me: 🟩 🟨 🟨 🟨 🟦 🟦 🟦 🟨 🟦 🟩 🟩 🟨

Can you beat my score? #Taptastic #memorygame #challenge https://t.co/Cy4xhtaohH

[Rojan Rijal @mallocsys]

🧵 Securing Your @DecagonAI Chat Bot 🧵

We've seen a growing number of organizations using https://t.co/0shEeZqrsv's chat bot to enhance customer support with AI. A quick post on how to make sure you deploy it securely based on a recent issue we saw.

🚨 The issue?
If X-Decagon-Auth-Signature isn't required, chat history can be accessed solely using X-Decagon-Auth-User-Id—which is often just a User ID from the core application.

🔍 Example scenario we tested:
1️⃣ Log into the company's core app.
2️⃣ Extract our User ID from the application.
3️⃣ Use it in Decagon's SDK to authenticate and load past chat history.
4️⃣ Identified ways to disclose User ID of other users in the company's core app.
5️⃣ Used other user's User ID to get their chat history.

💡 Why does this matter?
User IDs, even if UUID-based, are often not private and can be exposed in various parts of an application. If the same User ID is used for Decagon authentication without a secure signature mechanism, an attacker could extract and replay it to access someone else's chat history.

🔐 Solution: Ensure your Decagon integration requires X-Decagon-Auth-Signature for proper authentication and does not rely solely on User IDs.

⚠️ Important: This is NOT a Decagon vulnerability, it's a misconfiguration that security teams should be aware of as companies rapidly integrate AI-powered tools.

#genai #aisecurity #attacksurfacemanagement

[Rojan Rijal @mallocsys]

Announcing: Ask Us Anything Security - A free security advisory for startups

Security often gets pushed to the back burner at startups until something breaks or a big deal requires it. But what if you could get expert security guidance without the overhead?

At Ophion Security, we have worked with startups and large enterprises to secure their products, cloud environments, and compliance posture without slowing down growth. As part of that mission, we’re offering free security advisory ask us anything, and we’ll personally reply with actionable advice.

✅ Worried about SOC 2, ISO 27001, or customer security questionnaires?
✅ Unsure if you’re protecting customer data correctly?
✅ Need guidance on securing your cloud infra, SaaS stack, or engineering workflows?
✅ Question about getting the right pentest done and what should be in scope?

Drop your security questions here, and we’ll respond within 24 hrs, no strings attached: https://t.co/pNyBnLONfU

#startupsecurity #growth #founders #security #TechStartups #CloudSecurity

[Ophion Security @OphionSecurity]

Live chat histories contain treasure trove of data. From answers to security questions to credentials and more. We found a way to access it all in Cisco's Webex Connect. Read here: https://t.co/JcEA5TkyIE #vulnerability #vulnerabilitydisclosure #attacksurfacemanagement

[Rojan Rijal @mallocsys]

As we build Orion actively, we run it against real world targets with disclosure policy. We did the same for Microsoft. Checkout the demo page to see how we are monitoring more than 4,000 users and 160,000 repositories of Microsoft and other organizations. https://t.co/1fRq4AfcjX

#githubactions #githubsecurity #bugbounty #attacksurfacemanagement