Or Chechik

Security researcher - Windows internals, Reverse engineering, Low level research.

[BlueHat IL @BlueHatIL]

The triumphant trio of Palo Alto Networks , Or Chechik, Assaf Dahan & Daniel Frank, exposed an Iranian hacking group targeting Israeli entities, and now it's time for them to unveil everything.

[jro @junr0n]

Support for Windows enums has just been added to auto-enum!

[Or Chechik @orchechik]

Here are the slides for my talk "Digital Scorched Earth - Understanding APT-Driven Cyber Destruction" for @bsidesprg
Thanks everyone who attended!

https://t.co/uu4coPq3C5

[Jakub Kroustek @JakubKroustek]

Following up, the presentation by @orchechik was a polished one. Perhaps thanks to all those wipers mentioned in it 🧹, including attacks by Agonizing Serpens in October 2023. Btw, IIRC #NotPetya was decryptable by tools from @CrowdStrike.

[Security BSides Prague @bsidesprg]

Want to get more insight on Iranian #APT in the Middle East and #Cyber #warfare operations backing up their military ones. The destruction in the digital world uncovered by @orchechik from @PaloAltoNtwks is eye-opener and can be seen at #bsidesprg2024. Come, see, and understand

[Alex Plaskett @alexjplaskett]

Continuing on from my previous thread on remote exploits (macOS/Linux) here is the eagerly antipated Windows version!

A small selection from multiple areas!

#cybersecurity #windows

[Or Chechik @orchechik]

@vxunderground Rootkits and Bootkits

[Xyrem @Xyrem256]

https://t.co/zh0byHtIrH
The new blog post is out 👀

[ESET Research @ESETresearch]

1️⃣ It is now possible to start a Jupyter Notebook connected to IDA Python right from IDA. One of the most requested features! 🎉 2/5

[Jack Halon @jack_halon]

Today I am releasing part 2 of my 3-part browser exploitation series on Chrome!

In part 2, we take a deep dive into the V8 compiler pipeline by understanding what happens under the hood in Ignition, Sparkplug, and TurboFan!

Enjoy!

https://t.co/XAnbzdnjeQ

[הסולידית @hasolidit]

תגידו, איפה הייתם ב-2016?

עבדתם באופן לא רציף? שיניתם סטטוס משפחתי? הפכתם להורים? סיימתם תואר? הפסדתם בבורסה? תרמתם סכום גדול?

אם כן, יתכן מאד שנגבה מכם מס עודף באותה שנה.

כש-2022 תסתיים אוטוטו, האפשרות לקבל החזר מס בגין 2016 תיסגר, והכסף שלכם יישאר לנצח באוצר המדינה.

[Unit 42 @Unit42_Intel]

Take a deep dive into the techniques used by banking Trojans to learn how they can help you detect other actions taken by financially motivated threat groups. #malware https://t.co/LnqJvQZ9BQ

[Or Chechik @orchechik]

Check out my blogpost about Banking
Trojan Techniques and their potential
mitigations.

https://t.co/SnieoyDokC

#malware #bankingtrojan #unit42

[晏子霜 @YanZiShuang]

[CVE-2022-38029] ALPC _SECTION UAF https://t.co/xNArO4NxEq

[Gal Z @0xgalz]

My "Reverse Engineering 3011: Reversing C++ Binaries" is released as part of @OpenSecTraining and is available for everyone! 🎉

The class is important to me, I'm happy that after all the time and effort it is finally released, and I hope people would learn and enjoy from it! 😁

[reverseame @reverseame]

Exploit Development: No Code Execution? No Problem! Living The Age of VBS, HVCI, and Kernel CFG https://t.co/XmSFhqS9a5

[sam4k @sam4k1]

So I’m starting a new series on my blog, rambling about all things Linux kernel exploitation related - highlighting modern techniques, mitigations, bypasses and all manner of shenanigans 🤠

https://t.co/MqzjNUEun7

[Jonny Johnson @JonnyJohnson_]

Recently I have found some cool connections between WMI and COM. Before sharing these findings I thought it would be good to write a blog on the basics of WMI internals to establish a baseline of knowledge that will carry into the second blog.
https://t.co/0rNWYF9Wz5

[Gal De Leon @galdeleon]

Here is my blogpost about Windows trust redirection mitigation - preventing junction EoP exploits

https://t.co/J9ALpoPWO5

#vulnerability #exploit #windows

[reverseame @reverseame]

Learning Linux kernel exploitation - Part 1 - Laying the groundwork https://t.co/zKXnzpOdPl