Omri Herscovici

Developer, Hacker & Lover | Security Researcher at @Intel | Former @_CPResearch_ Vulnerability Research TL | Opinions are non-existent

[Omri Herscovici @omriher]

We released the technical details behind "Hacked in Translation" – from subtitles to RCE
https://t.co/NGAdPNgb12

[Omri Herscovici @omriher]

Due to a schedule conflict, I have 2 tickets for the 37C3 conference available for sale. Available in DM. #37C3

[Reshef Shay @Rereshef]

The day the music died.

#HamasisISIS

[Omri Herscovici @omriher]

ChatGPT doesn't only pass Turing's test, but would also slide into his DMs, tell him to meet them at the make-out point and then ghost him

[Omri Herscovici @omriher]

If the OpenAI chat color isn't orange, you're doing it wrong

[Omri Herscovici @omriher]

This was basically the summary of my last paper.
At least it got a sense of humor.

[Omri Herscovici @omriher]

I stopped maintaining CapTipper 4 years ago since the decline of exploit kits.
To my surprise, I learned the tool is still being used in DFIR toolkits and networking courses in colleges.
So I found some time to fix a few bugs and port the code to Python3:
https://t.co/JwEs8VIUye

[Omri Herscovici @omriher]

@executemalware @lennyzeltser So I had a couple of days to make the transition to Python3. pushed it to GitHub in a new branch:
https://t.co/JwEs8VIUye

I made sure the major capabilities work fine and also fixed a few bugs. probably would still need some work but I think this version is pretty stable.

[Check Point Research @_CPResearch_]

A malicious picture can trigger an Instagram vulnerability potentially resulting in RCE on mobile devices.
Read our full technical paper here:

https://t.co/lkvDSPkCUj

[Omri Herscovici @omriher]

After 7 years at Check Point Research, I'm moving on to my next endeavor. Leading the vulnerability research team at @_CPResearch_ was an inspiring position, and it is truly one of the best places in infosec. See you guys down the road!

[Omri Herscovici @omriher]

@executemalware @lennyzeltser Hi! I stopped maintaining the code a while ago, as I was under the impression it's not really used since exploit kits drive-by attacks has decreased substitantly. I'm really glad to hear it still provides some value, so will try to find time soon and update. I'll keep you posted

[Check Point Research @_CPResearch_]

[CPR-Zero] CVE-2020-6008, CVE-2020-6009 & CVE-2020-6010 (Learning Management Systems): Multiple critical vulnerabilities (SQLi + File Write) in the 3 leading WordPress LMS Plugins
https://t.co/sJnYM6F4kN
https://t.co/aRLaswbU3W
https://t.co/6vwXlG25V5

[Omri Herscovici @omriher]

@ZephrFish @ZoomerX @CheckPointSW Being familiar with the trend of creating malicious fake exploits, I was mainly interested in warning against downloading malicious POCs. I was wrong including your POC in this statement, my apologies

[Omri Herscovici @omriher]

@da_667 You are correct, signatures should include RRSIG as well

[Omri Herscovici @omriher]

It seems that RRSIG-Records parsing indeed leads to the vulnerable function, therefore can also be used to trigger the vulnerability

[Omri Herscovici @omriher]

We're getting asked whether the registry workaround for SIGRed works on Windows Server 2003 and the answer is YES.

However, if your organization still runs it there are probably multiple other ways to pwn it other than using CVE-2020-1350

[Omri Herscovici @omriher]

Congrats @NetanelBenSimon for being listed on Top MSRC 2020 Q2 Security Researchers. well-deserved! @_CPResearch_
https://t.co/MFFKiPGi5F

[Omri Herscovici @omriher]

@famato @shodanhq @_CPResearch_ @sagitz_ @faradaysec Depends, how many organizational Windows domains exist in the world?

[Omri Herscovici @omriher]

Turning ON Analytical Logs in Windows DNS could allow for the detection of the SIGRed vulnerability. Looks like the logging of the crafted SIG query is written even if the exploitation fails and the server crashes

[Samir @SBousseaden]

this is an e.g. of MS DNS Logs (256, 257) for Query and Response, contains good info for hunting and detection (Packet details, QTYPE will be eq to 24 for SIG and res-packet size can be also deducted with some manips (if >64KB + maybe DNSEC!=1) ->

https://t.co/KWYuI7B0uy

[Omri Herscovici @omriher]

@da_667 @sagitz_ It seems that RRSIG-Records parsing indeed leads to the vulnerable function, therefore can also be used to trigger the vulnerability

[Omri Herscovici @omriher]

We just disclosed SIGRed (CVE-2020-1350): Critical Vulnerability in all Windows DNS Servers (by @sagitz_).

Bonus: can also be triggered using the browser through a malicious link. #SIGRed
https://t.co/MMnjPwIUAp