Justin OLeary

Cloud security research • GCVE GNA 119
Independent vulnerability validation
Kubernetes / Azure / GCP / AWS

[Justin OLeary @olearysec]

I'm now GNA 119 under CIRCL's GCVE system.

I have authority to assign vulnerability IDs to my own cloud security
findings starting today.

I'm choosing not to.

Cloud finding validation shouldn't be one person's judgment. Forming a
consensus panel of practitioners per cloud platform. Charter coming.

https://t.co/PuDgKSPmlv

[Justin OLeary @olearysec]

@RDKLInc https://t.co/aZ6B28ufb6

[Justin OLeary @olearysec]

@iyoushetwt More like this for me 😂

[zodttd @zodttd]

Microsoft ridiculed a researcher reporting very serious bugs to them, deleted his account, and no bug bounties were paid. These should be high payouts. Now $MSFT is threatening legal action and speaking as if a researcher’s proof of concept code is illegal.

This is because the unappreciated researcher released more zero-day vulnerabilities on his own and had those GitHub/Lab accounts banned.

They were serious enough that Microsoft is scrambling to fix them but wasn’t serious enough to be paid or recognized, instead was ridiculed.

News of the Nightmare Eclipse exploits are everywhere but read the personal blog of the researcher, Nightmare Eclipse:

https://t.co/SuSxBr5oT4

[Jason Syversen @JSyversen]

https://t.co/NhTck73jhF

[Justin OLeary @olearysec]

Decentralized identity verification via Keyoxide. This hash cryptographically proves I control this Twitter account, my Mastodon (@[email protected]), and my PGP key — without trusting any central authority.

Verify: https://t.co/OHg4xVTX9T

[Justin OLeary @olearysec]

$argon2id$v=19$m=64,t=512,p=2$qa5PGzsh73ctUvK7Enp65g$GNb+W8w1wbxVehiG7aSISw

[Justin OLeary @olearysec]

https://t.co/4zxYjKTZu8

[Justin OLeary @olearysec]

Confused deputy is everywhere in cloud infrastructure if you know how to look.

Wrote up the full methodology — taxonomy, diagrams, CLI enumeration, 10-question hunting checklist.

#cloudsecurity #infosec

[Justin OLeary @olearysec]

MITRE TL-Root just ruled. No CVE.

CERT/CC's system: "1 Vulnerability Identified"
CERT/CC to MITRE: "We never validated it"

Microsoft described the exact behavior they patched while calling it "intended."

I followed every rule. The system worked exactly as designed.

Full MITRE decision on my page: https://t.co/JZPdmdfw06

[Justin OLeary @olearysec]

@KimZetter Top 50 Security Influencers (sorted DESC by invoice_amount)

[Justin OLeary @olearysec]

MSRC silently rolled out a custom, cluster-wide code modification specifically tailored to break my exact exploit primitive, all while insisting "no product changes were made". Bespoke customer service right there.

[BleepingComputer @BleepinComputer]

Microsoft rejects critical Azure vulnerability report, no CVE issued
https://t.co/2Pckw0B0i0

https://t.co/2Pckw0B0i0

[Justin OLeary @olearysec]

Schrödinger's vulnerability: simultaneously not a bug and quietly patched.

[Kim Zetter @KimZetter]

Researcher @olearysec found privilege-escalation vuln in Azure Backup for AKS and reported to @microsoft. CERT validated it but Microsoft rejected it and asked Mitre not to give it CVE. Then he says Microsoft silently patched it without telling users https://t.co/CL1Jn8vyKL

[Justin OLeary @olearysec]

No CVE? No problem.

@MSFTSecResponse won't give it a CVE but @BleepinComputer will give it a headline.

Article: https://t.co/WprSC4Erce

Video: https://t.co/zxFFAhfr0F

cc @Ax_Sharma

[Justin OLeary @olearysec]

@KDbyProxy @KimZetter @Microsoft Hard to get paid for a bug that was never a bug until it was silently fixed. 😂