Yaniv Balmas

Not the droid you are looking for 🤖
VP Research @SaltSecurity | Former Head Of Cyber Research @_cpresearch_ .
Opinions are my own.

[Yaniv Balmas @ynvb]

For example, when using this technique on https://t.co/Afl2VoQwwo - we got access to screen recordings from millions of users worldwide 🤯

[Yaniv Balmas @ynvb]

Did you think XSS is dead? So did we...
We couldn't be more wrong.
XSS is back with a vengeance! 💥
Combined with OAuth, the Salt-Labs team performed a full account takeover on several major online platforms.
https://t.co/yDA4sLMzBR
#XSS #OAuth #cybersecurity #APISec #infosec

[Yaniv Balmas @ynvb]

Hey @elonmusk, our team at Salt Labs just released some very concerning security issues in the ChatGPT ecosystem, which may put a lot of data for a lot of users at risk.

Time for OpenAI to step up their security game, don't you think?

Full report: https://t.co/0YCOUIxqT9

[Yaniv Balmas @ynvb]

Check out our latest research. This time, flaws in GenAI ecosystems and several issues in ChatGPT and its integrated plugins.
Kudos, @AviadCarmel, for this wonderful research.

https://t.co/JAZtDlKOcS

[Yaniv Balmas @ynvb]

@IdoNaor1 Nothing, it was that way when I found it 🤷🏼‍♂️

[Yaniv Balmas @ynvb]

Looking for a contact in OpenAI security team… anyone here has any leads?

[Yaniv Balmas @ynvb]

@ClausHoumann Moving to DM ;)

[Aviad Carmel @AviadCarmel]

Just discovered a full account takeover on https://t.co/9dAKCEpkrV, https://t.co/3b6VWzGVsC and more using a new OAuth attack technique.

This is the last part of the OAuth trilogy; in total, we could take over 1+ BILLION accounts!

https://t.co/TRCljIp6iB

#OAuth #hacking

[Yaniv Balmas @ynvb]

and ofcourse big kudos to @AviadCarmel for this wonderful research.

[Yaniv Balmas @ynvb]

Down the OAUth rabbit hole we go...
This time it's a framework issue potentially affecting hundreds of online services, including sites like Codecademy and others...
More exciting targets are coming next... stay tuned and secure your OAuth implementations!
https://t.co/SKik65Wf9h

[OWASP API Security Top 10 @APItop10]

@SaltSecurity @SaltSecurity's contribution, beyond the sponsorship, warms our hearts.
A big shoutout to @ynvb, who contributed ideas and use cases that were quoted in the latest addition.
💖

[Yaniv Balmas @ynvb]

Nothing like a good visual aid to remember how to assemble a network cable.

[MalwareHunterTeam @malwrhunterteam]

You aren't into networking if you not recognise the meaning of this immediately...
😂
cc @JAMESWT_MHT

[Dark Reading @DarkReading]

https://t.co/v9u69Kbj1b OAuth Implementation Allows Full Account Takeover: https://t.co/OYY4YTX4ZT by Elizabeth Montalbano

[Yaniv Balmas @ynvb]

@zhouxinan Very similar indeed. Thx for sharing!

[Yaniv Balmas @ynvb]

Taking over https://t.co/8iTZAzeBkQ accounts by abusing OAuth 2.0

https://t.co/g3wRGeTDR5

Read the technical details here:

https://t.co/u1AJcTtlfH?

[Yaniv Balmas @ynvb]

@megabeets_ Wow @megabeets_ , that’s amazing. Congrats!!

[Yaniv Balmas @ynvb]

@Shiftreduce @cryptodavidw It also requires a strange peripheral called Mouse… does not sound hygienic to me…

[Yaniv Balmas @ynvb]

@inbarraz מדהים ענבר! מחכה להמשך…

[Yaniv Balmas @ynvb]

@aCaltum 🤦‍♂️bad call dude, nothing good ever comes out of it… (from experience ofcourse)
You definitely need a vacation ;)

[Jamie Collier @TheCollierJam]

Just discovered Mandiant has an Urban Dictionary entry. Fantastic stuff. Huge if true. https://t.co/jgbHPFdmTP