Roi Nisimi

I hack stuff for living at @orcasec || Ex 81 & 8200

[Roi Nisimi @roinisimi]

The hackerbot-claw campaign. My take: AI is phenomenal in exploitation. Vulnerability research = craftsmanship, but exploitation? A guidebook + trial-n-error loop, which agents excel at.

Maybe novel threat detection should flag LLM-generated content? 🤖

[Roi Nisimi @roinisimi]

If you're using Codespaces in your daily routine, you must be aware of the potential consequences. Full writeup on our blog 👇

https://t.co/ew795wM0j3

[Roi Nisimi @roinisimi]

I've discovered a new supply-chain vector through @github Codespaces. It is straightforward and easy to follow.

[Roi Nisimi @roinisimi]

I've been able to use these techniques to
1) Gain full repository control
2) Carry XSS via installed Vscode extension
3) Abuse expensive Premium Copilot models 🤖

[Yoav Alon @yoavalon]

🇵🇱 Polish Security Experts! 🛡️
We're hiring a Security Researcher for our R&D team. Work with cutting-edge tech (eBPF, Linux, K8s, Malware analysis) to fight cybercrime!
https://t.co/FKKmVf31ZQ

RTs appreciated for reach! 🙏

#CloudSecurity #CybersecJobs #PolishTech

[Roi Nisimi @roinisimi]

Super excited to share the stage with @yonatankhen!
Feb 7 || 11am eastern time - Join us

[Team Axon @team__axon]

After uncovering the #DeleFriend Google Workspace design flaw, it's time to protect against it.

Join threat researchers @yonatankhen (Axon) and @roinisimi (@orcasec) as they join forces to demonstrate how to detect and prevent an attack

Register here: https://t.co/Uce8OqM2n9

[Deborah Galea @deborah_galea]

Cloud Threat Researcher @roinisimi from @Orcasec discovered a critical design flaw in the #GoogleCloud Build service that creates a significant #supplychainrisk.

https://t.co/odrc62emdj

[SecurityWeek @SecurityWeek]

Microsoft Azure Users Warned of Potential Shared Key Authorization Abuse https://t.co/utVljbWgvY

[The Register @TheRegister]

Azure admins warned to disable shared key access as backdoor attack detailed https://t.co/CubEAnZRFd

[The Hacker News @TheHackersNews]

🛡️ New flaw in #Microsoft Azure Uncovered! Hackers could exploit this weakness to gain access to storage accounts, move laterally and execute remote code 🕵️‍♂️

📰 Learn about this "by-design flaw" & how to protect your data: https://t.co/AsqAj76gJP

#CyberSecurity #DataSecurity

[Deborah Galea @deborah_galea]

Microsoft To Tighten Azure Storage Default Permissions after @Orcasec discovery -- https://t.co/6TApZqpjWu https://t.co/ULha0TrXr3

[Roi Nisimi @roinisimi]

Hi #twitter

Published on Tuesday, my research and our blog at @orcasec was featured on @TheHackersNews, @TheRegister, @thecyberwire, https://t.co/6auGfKOvw1 and much more.

Thanks for covering this.
Getting this final result together with @msftsecresponse was a great pleasure.

[Orca Security @orcasec]

Our team of researchers continually push the limits to find #securityrisks before bad actors do.🔎 Learn how we discovered a critical exploitation path, utilizing Microsoft #Azure shared key authorization, and how to mitigate this: https://t.co/MzgHxSKzNU

[Roi Nisimi @roinisimi]

@NadavClaude לא בטוח שהבנתי את המשפט הראשון. באיזה סיטואציה לא משלמים מס רווחי הון (מחוץ ל context של הדיבידנד של צים). יש לי החזקות במניה בחשבון פרטי באינטראקטיב - ואכן ראיתי את ההורדה בחשבון. אז אני מניח שבמקרה הזה אין זכאות?