CipherTechs is a global Cyber Security service provider founded in 2001 that remains privately held with headquarters in New York City.
New York, NY
Joined May 2010
- Tweets692
- Following296
- Followers358
- Likes114
Pinned Tweet
CipherTechs discovered an admin authentication bypass 0day in JFrog Artifactory. ciphertechs.com/jfrog-artifa…. Patches and work around are available. Be sure to find out if your in-house dev team uses Artifactory. Shout-outs to @jfrog for their vuln disclosure process!
CipherTechs, Inc. retweeted
- "... and then he said to sign my malware.exe with faked Microsoft cert to evade AVs/EDRs. Would you believe?"
(￣y▽￣)╭ Ohohoho.....
Sign-Artifact.ps1 - based on @mattifestation research & implementation shamelessly borrowed here:
github.com/mgeeky/Penetratio…
zyxel.com/support/Zyxel-secu… Pedro and Darren from CipherTechs Red Team credited in Zyxel advisory
Months of fun for pentesters - new Confluence exploitable bug cisa.gov/uscert/ncas/current…
cisa.gov/known-exploited-vul… sort by date added. These are actively exploited bugs - good priority list for patching.
cisa.gov/uscert/ncas/alerts/… there's been a few of these. Along with patching, be sure to remove management interfaces from the Internet.
WSO2 exploit for CVE-2022-29464 is now public github.com/hakivvi/CVE-2022-…
Patch details here docs.wso2.com/display/Securi…
CipherTechs, Inc. retweeted
LAPSUS$ extortion group claims to have breached @Okta. They have released 8 photos as proof.
The photos we are sharing has been edited so no sensitive information or user identities are displayed.
Image 1 - 4 attached below.
CipherTechs, Inc. retweeted
Sandy Bacik, Director of Audit and Compliance at @CipherTechs, will present on PCI 4.0 next week at SecureWorld Philadelphia. See the conference agenda and register here: hubs.li/Q0168mQt0 #SWPHL22 #GRC
container escape unit42.paloaltonetworks.com/…. "Containers running with AppArmor, SELinux or Seccomp are protected"
Zabbix RCE xitter.cf/SonarSource/status/149…
Our researchers discovered a high-severity code vulnerability in the open-source monitoring platform Zabbix. Learn more about this authentication bypass in our latest publication🔥
blog.sonarsource.com/zabbix-…
#appsec #cve-2022-23131 #cve-2022-23134
blog.qualys.com/vulnerabilit… Polkit LPE. Reminder to make removing setuid part of your standard Linux builds.
CipherTechs, Inc. retweeted
Can confirm!
➡️Splashtop
SRUtility.exe
➡️AnyDesk
AnyDesk.exe
AnyDeskMSI.exe
➡️Atera
AteraAgent.exe
AgentPackageSTRemote.exe
AgentPackageHeartbeat.exe
AgentPackageWindowsUpdate.exe
AgentPackageADRemote.exe
Thanks for sharing @AltShiftPrtScn!
#Conti ransomware affiliates using AnyDesk, Atera, Splashtop, Remote Utilities and ScreenConnect to maintain network access. During initial stage of IR I recommend blocking ALL remote access tools via Application Control policies, allow only the ones required & monitor their use.
Arbitrary file write on Windows domain controllers bugs.chromium.org/p/project-…. Microsoft guidance here msrc.microsoft.com/update-gu…
This could be like shellshock where it takes weeks to find all the appliances and SaaS that are affected. If you use log4j (and you probably do) check out github.com/nice0e3/log4j_PoC and xitter.cf/search?q=cve-2021-4422…. This is a juicy bug.