The secure enterprise browser extension for the AI era. Combining browser telemetry and autonomous agents to stop advanced advanced attacks and secure AI usage.
Joined November 2019
- Tweets307
- Following71
- Followers728
- Likes100
Push retweeted
📢 Sponsor: Join Push Security researchers + incredible guests for a new webinar series on the State of Browser Attacks. The browser is the place where modern breaches happen, powered by new PhaaS kits and AI tools. Get ahead—register now:
hubs.li/Q049468f0
Push retweeted
I'm pumped to join @PushSecurity for a live chat on browser attacks -- actually, a new series they're starting, with folks way cooler than me: @troyhunt & @mattjay ! My show is with @jukelennings to dig into today's tradecraft, April 16th at 11am ET! Link: jh.live/push-security-webina…
Push retweeted
1/ A new class of phishing - how verification phishing and cross-idp impersonation can bypass your SSO.
Here is a video demo, but this is one where you really need to read the full article too - pushsecurity.com/blog/a-new-…
I'll summarize the key points in this thread.
Push retweeted
Some of my research on SaaS attacks, including ghost logins and other persistence vectors, made it on to @DarknetDiaries
Achievement unlocked.
Push retweeted
I wrote a blog post on the many defense mechanisms phishing kits are using to avoid discovery and analysis now.
I used a recent instance of NakedPages and cover 9 different techniques, including Cloudflare Workers and Turnstile abuse.
IOCs included.
pushsecurity.com/blog/how-ai…
Push retweeted
If you missed my Snowflake webinar yesterday and you’re impacted by the recent breach, you can check out this link to the demo segment from the webinar, where I show how to disable ghost logins in Snowflake.
Remember, this is not just a Snowflake problem
pushsecurity.com/resources/v…
Push retweeted
Is the Snowflake breach, touted as the biggest in history, identity security’s WannaCry moment?
Join Luke Jennings, VP R&D at @PushSecurity, to explore what Snowflake shows us about the complexity of the identity attack surface, and discuss the practical steps that organizations can take to investigate and respond effectively.
Register for the webinar here: go.thn.li/snowflake-webinar-…
Push retweeted
7/ Well, when we investigated, we discovered that if you enable SAML SSO for a Snowflake account for a local account with no MFA, the local password still works unless you explicitly create an authentication policy to prevent it.
Push retweeted
1/ The ongoing Snowflake situation has made me realize just how dangerous ghost logins – a SaaS-based persistence technique that I coined last year – can be as an initial access vector.
So what is a ghost login, exactly?
Push retweeted
Now you can detect and block identity attacks directly inside any web browser.
1. Stop corp password reuse and phishing
2. Detect EvilGinx/EvilNoVNC
3. Session Hijacking detection
... and more.
Hear the full announcement on @riskybusiness
risky.biz/snakeoilers19pt2/
Push retweeted
Bypass MFA, own an Okta account, then persist after you are shut down.
1. Trick employee to auth to Okta via a transparent VNC session
2. Persist on downstream SaaS
3. SAMLJacking for "lateral movement"
Check it out:
youtube.com/watch?v=xZIQd_0v…
#redteam #blueteam
Push retweeted
Can admins steal cloud password manager secrets?
Tl;dr - Yes!
I use Dashlane as an example but it’s a generic approach and may end up a hash dumping equivalent for the SaaS-native world.
It’s worth understanding the details!
pushsecurity.com/blog/can-my…
Push retweeted
DISCOVER | What does the cyber kill chain look like in the SaaS revolution? Luke Jennings from @PushSecurity explores what a new cyber kill chain looks like for modern orgs that are fully SaaS native. #SOCON2024
Push retweeted
📖 CloudSecList Issue 217 just got released, w/ content from @expel_io @PushSecurity @datadoghq @CadoSecurity @wolfeidau @PaloAltoNtwks and more!
cloudseclist.com/issues/issu…
Push retweeted
I'm glad to announce I'll be at #SOCON2024 talking about SaaS attacks.
I might be biased but I think it's looking like a good line-up! :)
Registration for #SOCON2024 is now open! 🙌
Join us to dive into the latest in attack path management, engage w/ industry experts, and expand your knowledge & skills in the field. For a limited time, secure your summit spot at 50% off.
Register: specterops.io/so-con/
Push retweeted
📣SPEAKER ANNOUNCEMENT📣
Our next #BlueHat speaker is Luke Jennings @jukelennings from Push Security! Luke will present a talk titled "The new SaaS cyber kill chain." 👏
ALT 📣SPEAKER ANNOUNCEMENT📣 Our next #BlueHat speaker is Luke Jennings @jukelennings from Push Security! Luke will present a talk titled "The new SaaS cyber kill chain." 👏
Push retweeted
I feel like shadow workflows are the closest equivalent of offensive PowerShell for the SaaS world.
Check out the second post in my series on chaining SaaS attacks and come see me speak about this and a lot more at #44con on Thursday 14th September!
pushsecurity.com/blog/nearly…
Push retweeted
(5/8) Push Security - “SaaS App Security at Internet Scale” - see the 30,000 cloud apps used by employees today and understand their risk using LLMs (@PushSecurity, @metall0id, @ajaybateman, @jacques_sec)
Push retweeted
One of the questions we hear often is, “Can’t I just block my employees from using SaaS that we haven't vetted?” You can. You can block the apps we find your employees using, but the real question is...should you? buff.ly/41SWL0R
#SaaSsecurity #shadowIT #RiskManagement
Push retweeted
Paved paths, Salt-N-Pepa, Little Shop of Horrors, and hamster-wheels-of-pain. This post has it all: Why I'm excited to join @PushSecurity's board! //O
"In the modern day, you either design a paved path for your users to be able to move quickly and safely, or you risk the consequences when they go off-roading." Check out @jonoberheide blog: buff.ly/40h1QhY
#security #shadowit #saassecurity #infosec
