For the last 3 months my wife and I have been working on a new way to tell a story.
Welcome Novella! A platform that turns your stories, memories, and moments into beautifully designed hardcover books.
novella.ink
🚨 We know the real target behind the attack on tj-actions/changed-files!
Coinbase!
The first publicly known exploitation of the technique I presented at DEFCON 31: The GitHub Action Worm.
Read the full story:
unit42.paloaltonetworks.com/…
By @omer_gil @yaronavital @_0xffd and I
Asi Greenholts retweeted
New research our team released today, showing how we could push code to highly popular open source projects maintained by Google, AWS, Microsoft, & Red Hat, through a race condition in GitHub Actions.
Go hunt critical #bugbounty issues ;)
by @yaronavital
unit42.paloaltonetworks.com/…
Asi Greenholts retweeted
This Saturday I will be speaking at #DefCon32 about OIDC misconfigurations and abuses in the context of CI/CD 🥴👹.
Come check it out!
info.defcon.org/event/?id=54…
@PaloAltoNtwks
#OIDC #oauth2 #ci #cd
Asi Greenholts retweeted
Two great talks delivered in Vegas this year by our team - again!
In this year’s hacker summer camp in LV, our Research team will stand on the @defcon & @BSidesLV stages again, to share two novel research projects we’ve been working on recently:
#HackerSummerCamp #defcon32
Thank you @HoffmanYaniv for inviting me to discuss about CI/CD security and my "Awesome CI/CD Attacks" project.
We explored challenges, solutions, and key insights in this critical area of cybersecurity.
youtube.com/watch?v=FiTERoz9…
Asi Greenholts retweeted
Right now on stage @TupleType with “The GitHub Actions Worm: Compromising GitHub repositories through the actions dependency tree”!
Join live: youtube.com/live/tlBnIA9FQrg
Asi Greenholts retweeted
📚 tl;dr sec 234
🗡️ Awesome CI/CD Attacks @TupleType
🤖 STRIDE GPT
☁️ Non Production AWS Attack Surface @Frichette_n
🛡️ Secure defaults @ramimacisabird
🛠️ WAF bypass tool @infosec_au
💻 Hacking millions of routers @samwcyo
tldrsec.com/p/tldr-sec-234
I'll be speaking at @BsidesTLV !!!
Join my session about a novel supply chain attack technique abusing @github Actions intended behavior to spread a worm 🪱.
bsidestlv.com/agenda/the_git…
What do you think is an important routine for a Security Researcher?
I think it is reading Cyber news daily.
Here are the most unique and high quality resources I've found about CI/CD attacks in the past 3 years:
github.com/TupleType-1/aweso…
Thanks @omer_gil for the review!
Asi Greenholts retweeted
Hi @BlackHatEvents - I was shocked to discover that one of your Cyber Security Trainer and Review Board Members is also an antisemitic, a terror supporter who publicly denies Hamas Terror acts. Please remove @Voulnet from his role immediately!
How a worm 🪱 can be used to compromise @github repositories at scale through the Actions dependency tree🌲?
The blog details a public disclosure out of many reported to #bugbounty programs
This was first reveled at @defcon 31 and @BSidesLV
paloaltonetworks.com/blog/pr…
The GitHub Actions Worm: Compromising GtHub repositories through the actions dependency tree!
🕜 Sat 1:30 pm PT, Track 3 at @defcon
📺 Watch live here:
twitch.tv/defcon_dctv_three
Asi Greenholts retweeted
Highly inspired by our @owasp Top 10 CI/CD Security Risks project, cool:)
Keep malicious actors out of your pipeline! Follow the NSA and CISA recommended guidance to defend against CI/CD pipeline compromise. nsa.gov/Press-Room/Press-Rel…
ALT Defending Continuous Integration/Continuous Delivery (CI/CD) Environments. Cybersecurity Information Sheet.
My submission got accepted to @BSidesLV!!
Join me at the underground track 🤫 where I'll talk about:
The GitHub Actions Worm: Compromising GitHub repositories through the action dependency tree 🌳
If you're going to @RSAConference this year and you want to see a new attack method, come see @omer_gil and myself talk about:
Abuse of Repository Webhooks to Access Hundreds of Internal CI systems.
rsaconference.com/usa/agenda…
Check out my new blog "How to secure your Open Source Project – A quick guide for developers" with examples for @github 🥳
cidersecurity.io/blog/resear…
🔥 The CI/CD Goat 🐐 just got wilder 🔥
Beat our new challenge and win a Gaming Keyboard!!!
Thanks to @yaronavital and @omer_gil
for co-writing the challenge! github.com/cider-security-re…