@TupleType

Building bootstraped B2C

novella.ink
Joined September 2021
  • Tweets49
  • Following82
  • Followers187
5Media
Asi Greenholts retweeted
Omer Gil@omer_gil13 Aug 2024
New research our team released today, showing how we could push code to highly popular open source projects maintained by Google, AWS, Microsoft, & Red Hat, through a race condition in GitHub Actions. Go hunt critical #bugbounty issues ;) by @yaronavital unit42.paloaltonetworks.com/…
2
3
22
1,549
Asi Greenholts retweeted
Aviad@_0xffd5 Aug 2024
This Saturday I will be speaking at #DefCon32 about OIDC misconfigurations and abuses in the context of CI/CD 🥴👹. Come check it out! info.defcon.org/event/?id=54… @PaloAltoNtwks #OIDC #oauth2 #ci #cd
3
4
21
1,226
Asi Greenholts retweeted
Omer Gil@omer_gil31 Jul 2024
Two great talks delivered in Vegas this year by our team - again! In this year’s hacker summer camp in LV, our Research team will stand on the @defcon & @BSidesLV stages again, to share two novel research projects we’ve been working on recently: #HackerSummerCamp #defcon32
1
1
4
496
Asi Greenholts retweeted
BSIDES TLV@BsidesTLV27 Jun 2024
Right now on stage @TupleType with “The GitHub Actions Worm: Compromising GitHub repositories through the actions dependency tree”! Join live: youtube.com/live/tlBnIA9FQrg
2
10
397
Asi Greenholts retweeted
Clint Gibler
@clintgibler6 Jun 2024
📚 tl;dr sec 234 🗡️ Awesome CI/CD Attacks @TupleType 🤖 STRIDE GPT ☁️ Non Production AWS Attack Surface @Frichette_n 🛡️ Secure defaults @ramimacisabird 🛠️ WAF bypass tool @infosec_au 💻 Hacking millions of routers @samwcyo tldrsec.com/p/tldr-sec-234

[tl;dr sec] #234 - Awesome CI/CD Attacks, STRIDE GPT, Non Production AWS Attack Surface

Practical resources for offensive CI/CD research, AI threat modeling tool, bypassing CloudTrail through non-prod endpoints

tldrsec.com
1
8
18
1,926
Asi Greenholts retweeted
Omer Gil@omer_gil16 Apr 2024
Use CVE-2024-27198 to freely access internal TeamCity instances, create admin access tokens, and steal secrets and configurations - even if the server is not exposed to the internet. How? 🧵 #1/10
1
31
1
119
23,927
Asi Greenholts retweeted
PnL@PnL6396220025 Oct 2023
Hi @BlackHatEvents - I was shocked to discover that one of your Cyber Security Trainer and Review Board Members is also an antisemitic, a terror supporter who publicly denies Hamas Terror acts. Please remove @Voulnet from his role immediately!
128
239
23
1,012
365,706
Asi Greenholts retweeted
Omer Gil@omer_gil3 Jul 2023
Highly inspired by our @owasp Top 10 CI/CD Security Risks project, cool:)
NSA/CSS
@NSAGov28 Jun 2023
Keep malicious actors out of your pipeline! Follow the NSA and CISA recommended guidance to defend against CI/CD pipeline compromise. nsa.gov/Press-Room/Press-Rel…
Defending Continuous Integration/Continuous Delivery (CI/CD) Environments. Cybersecurity Information Sheet.

ALT Defending Continuous Integration/Continuous Delivery (CI/CD) Environments. Cybersecurity Information Sheet.

1
4
20
2,889
Asi Greenholts retweeted
Omer Gil@omer_gil21 Sep 2022
All details are here: cidersecurity.io/blog/resear… Huge thanks to @TupleType @yaronavital @spaceB0xx @Dkrivelev 9/
6
1
14
Asi Greenholts retweeted
Omer Gil@omer_gil5 Sep 2022
Our @BSidesLV talk is now available - Climbing the Production Mountain: Practical CI/CD Attacks Using CI/CD Goat youtube.com/watch?v=w-R2PT2j… with @TupleType

GF - Climbing the Production Mountain: Practical CI/CD Attacks Using...

GF - Climbing the Production Mountain: Practical CI/CD Attacks Usin...

youtube.com
3
6
Asi Greenholts retweeted
Omer Gil@omer_gil1 Jul 2022
Join our CI/CD Goat talk in the upcoming @BSidesLV! bsideslv.org/talks#1269469 @TupleType

Talks - BSides Las Vegas

BSides Las Vegas is a nonprofit organization formed to stimulate the Information Security industry and community.

bsideslv.org
Massimo
@Rainmaker197330 Jun 2022
Gravity causes planets to orbit around their stars and bodies on Earth to fall towards the ground; however, goats seem they don't care at all [source 📽️: buff.ly/3nrpHe0] xitter.cf/pickover/status/148614…
3
6
Asi Greenholts retweeted
Omer Gil@omer_gil16 Mar 2022
I’m proud and honored to present the “Top 10 CI/CD Security Risks” project! cidersecurity.io/top-10-cicd… 👇 [1/4]
6
117
9
288
Asi Greenholts retweeted
Rotem Bar@rotembar10 Dec 2021
What to do now that we know that there is a Critical Remote code injection in Log4j?? 1. Check where do you have log4j < 2.15.0 in your Software Bill of Materials - You probably have some.. 2. Upgrade all software components using log4j to its latest version
2
2
5
Asi Greenholts retweeted
Omer Gil@omer_gil4 Nov 2021
The COA NPM package was hacked 😬 COA is highly popular, with ~9M downloads per week, used as a dependency for high-profile projects (like React). Your workstations / Build servers might be infected. [THREAD] 🧵 1/
2
5
8
Asi Greenholts retweeted
Omer Gil@omer_gil12 Oct 2021
A @GitHub vulnerability: Bypassing required reviews using GitHub Actions. medium.com/cider-sec/bypassi…
9
55
7
222
Load more