Vulnerability researcher, ethical hacker, and professional squatter. Part of Cisco Talos.
Joined July 2016
- Tweets752
- Following153
- Followers183
- Likes19.6K
You'd be remiss not to check this out if you're at the CTI Summit. I got to demo this tool and it genuinely covers a notable hole in the threat intel product space: N-day prioritization that isn't just port-forwarding Mitre/NVD. R³ is classic "I didn't know I needed this til now"
🚨 Stop by the Rapid Risk Radar booth at the @SANSInstitute #CTISummit ! 🚨 We’re proud to be a Platinum Sponsor and showcase how RRR transforms #ThreatIntel with cutting-edge CVE prioritization, SBOM filtering, and alert integrations. Let’s talk! 🔍 @sansforensics #CyberSecurity
Mark Bereza 🇺🇦 retweeted
Join me and @aboutsecurity on Friday for a technical conversation on how to make sure you are ahead of the curve in protecting your organizations from current threats!
Recent vulnerabilities in firmware such as Ivanti & Fortinet show the difficulty of securing digital supply chains. Join our technical demonstration on reverse engineering firmware and threat modeling through better #ProductSecurityTesting
Register here: buff.ly/3P8dIjD
happy to see gen z gets its own "penguin of doom" girl
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
Had the pleasure of writing this month's Bug Report, so I made sure to pack it tight with artisan-crafted memes. Oh, and information on May's top vulnerabilities, too, I guess.
Our @TrellixARC team tracks each month’s top CVEs from beginning to end so you can get the need-to-know information in one place — The Bug Report: May 2023 Edition is out now. Read the blog to learn more from @ROPsicle. bit.ly/3NgJVoE
Mark Bereza 🇺🇦 retweeted
The wait is finally over! Our new @SANSOffensive
class on Combating #SupplyChainAttacks with Product Security Testing is now open for registration! Join me and @aboutsecurity in June to learn how to analyze risk of using new hardware and software!
sans.org/cyber-security-cour…
Mark Bereza 🇺🇦 retweeted
Our latest blog explores CVE-2023-23397, an Outlook security vuln observed in the wild which allows bad actors to leak NTLMv2 hashes. @ROPsicle and @JohnDunlap2 explain how to detect if your organization is affected and how to mitigate harm. bit.ly/3Ft9s9N
Mark Bereza 🇺🇦 retweeted
so it turns out nearly every XPC service on macOS and iOS used expressionType to check if a received NSPredicate was safe. The problem was the sender could set this value to whatever they want. This has been fixed in Foundation in iOS 16.3 and macOS 13.2 support.apple.com/en-us/HT21…
To celebrate #GlobalMovieDay, name your…
1) favorite horror film
2) favorite animated film
3) favorite superhero film
4) favorite sci-fi/fantasy film
See what movies are releasing soon: bit.ly/Dates2023
Just how severe is "Severity: High"? @JohnDunlap2 and I take a stab at assessing the actual threat CVE-2023-0286, a type confusion in OpenSSL, poses to organizations
CVE-2023-0286: The OpenSSL Who Cried “Severity: High” – NEW RESEARCH from @ROPsicle & @JohnDunlap2. bit.ly/3jNmWW4
Mark Bereza 🇺🇦 retweeted
Make 2023 the year you consistently update your software. In the January Bug Report, @ravenousbytes explores three CVEs we spotted in the wild, who is impacted and what to do about it. bit.ly/3jo0aUH
Mark Bereza 🇺🇦 retweeted
Demonstrating CVE-2022-37958 RCE Vuln. Reachable via any Windows application protocol that authenticates. Yes, that means RDP, SMB and many more. Please patch this one, it's serious!
securityintelligence.com/pos…
Mark Bereza 🇺🇦 retweeted
Senior Principal Security Researcher Richard Johnson (@richinseattle) will be at Cybersecurity Outlook 2023 presenting his research on #eBPF for Windows. Be sure to catch his keynote on Tuesday, 12/13 @ 2:30pm EST!
Cybersecurity Outlook 2023 | This free, all-day virtual event hosted by Dark Reading, @BlackHatEvents and @OmdiaCyber will offer expert insight on the cyber-threats and technology trends enterprises will face in the coming year. Register now>> vts.informaengage.com/dark-r…
Mark Bereza 🇺🇦 retweeted
Which vuln is giving red teams and malware groups alike a taste of their own medicine? Which bugs received a CVSS score of 9.8?
Find out in the @TrellixARC September Bug Report, from @CGMcFarland: go.trellix.com/3ecMMjv
Mark Bereza 🇺🇦 retweeted
"If a target is vulnerable, it doesn’t matter whether the vulnerability is unknown or has been known for decades. A bad actor can still use it for nefarious purposes." - @CGMcFarland, Trellix Advanced Research Center (@TrellixLabs) go.trellix.com/3QVFFcN
To paraphrase @phLaul, we've entered the next phase of our character ARC >:)
New name, same dedication to insightful and actionable real-time intelligence. go.trellix.com/3QZvJ1F @TrellixLabs