@daniel_rome

Security Enthusiast

linkedin.com/in/daniel-rome
Joined July 2010
  • Tweets766
  • Following327
  • Followers682
2Media
Excited to share my latest research paper on DigiMesh security best practices, providing practical hardening guidance for deployments across industrial, agricultural, smart cities, and critical infrastructure environments: nccgroup.com/research/scalin…

Scaling the Mesh: Best Practices for Securing DigiMesh Environments

Scaling the Mesh: Best Practices for Securing DigiMesh Environments

nccgroup.com
70
Our research paper by @daniel_rome covers the attack surface with practical hardening guidance for XBee module deployments nccgroup.com/research/scalin… #IoTSecurity #DigiMesh #OT #CyberSecurity

Scaling the Mesh: Best Practices for Securing DigiMesh Environments

Scaling the Mesh: Best Practices for Securing DigiMesh Environments

nccgroup.com
1
3
933
Daniel Romero retweeted
0ca@francisco_oca7 Feb 2025
I am starting a new project BoxPwnr, using LLMs to solve HackTheBox machines autonomously 🤖 So far it solves 6 out of 9 of the very easy boxes from Starting Point. github.com/0ca/BoxPwnr/blob/…

BoxPwnr/README.md at main · 0ca/BoxPwnr

A modular framework for benchmarking LLMs and agentic strategies on security challenges across HackTheBox, TryHackMe, PortSwigger Labs, Cybench, picoCTF and more. - 0ca/BoxPwnr

github.com
1
8
2
25
1,992
Daniel Romero retweeted
0ca@francisco_oca29 Mar 2025
Just tried Gemini 2.5 Pro on BoxPwnr against all the HackTheBox StartingPoint machines. It solved 15/25 in one shot! First time solving Tactics, Bike & Base 🦾🤖 Super interesting how it solved Base, it's the longest exploration I have seen with 112 turns...🧵
1
3
9
896
CVE-2025-24071> Windows Explorer automatically initiates an SMB authentication request when a .library-ms file is extracted from a .rar archive, leading to NTLM hash disclosure. The user does not need to open or execute the file... github.com/0x6rss/CVE-2025-2…

GitHub - 0x6rss/CVE-2025-24071_PoC: CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and...

CVE-2025-24071: NTLM Hash Leak via RAR/ZIP Extraction and .library-ms File - 0x6rss/CVE-2025-24071_PoC

github.com
4
146
2
470
32,006
Espressif Systems - ESP32 BluFi Reference Application Vulnerabilities nccgroup.com/us/research-blo…
76
In-depth technical analysis of the Bybit hack (more than $1.4 billion assets): nccgroup.com/us/research-blo… Awesome work @Grifo!!
5
6
454
Behind the hype, missteps, and marketing buzz, there’s great work with USB Bluetooth (github.com/antoniovazquezbla…) and the research that supports it! Congratulations @antonvblanco
1
6
17
1,344
Daniel Romero retweeted
Juan Garrido@tr1ana7 Mar 2025
Today I'm releasing a new minor version of Monkey365. This new version adds some fixes and a new ruleset (CIS Benchmark 4.0) for Microsoft 365 was added. github.com/silverhack/monkey… #azure #EntraID #microsoft365 #cloudsecurity

Release Monkey365 v0.94.6-beta · silverhack/monkey365

What's Changed The following benchmark was added: CIS Microsoft 365 Foundations Benchmark v4.0.0 What's Changed The following rules were updated: CIS 3.0 2.6 Ensure that account 'Loc...

github.com
1
27
97
6,007
🚀 Introducing binaryninja-ollama-plus! A fork of the original Binary Ninja Ollama plugin, now with: • requests replacing ollama for easier integration • Function explanations • Basic vulnerability analysis • Optimized AI interactions @vector35 🔗 github.com/dan1t0/binaryninj…

GitHub - dan1t0/binaryninja-ollama-plus: Enhanced version of binaryninja-ollama and without using...

Enhanced version of binaryninja-ollama and without using the ollama Python library - dan1t0/binaryninja-ollama-plus

github.com
3
16
47
3,317
Daniel Romero retweeted
Juan Garrido@tr1ana8 Jan 2025
I'm thrilled to share that a new release of #Monkey365 is out! With many improvements, including the incorporation of the entire list of CIS controls github.com/silverhack/monkey… #cloudsecurity #azuresecurity #microsoft365security #AzureAD #EntraID #CSPM #microsoft365

GitHub - silverhack/monkey365: Monkey365 is an open-source security assessment tool for Microsoft...

Monkey365 is an open-source security assessment tool for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals identify misconfigurations, review cloud security posture, and...

github.com
13
15
1,268
Daniel Romero retweeted
Juan Garrido@tr1ana13 Nov 2024
I'm thrilled to announce a new release of #Monkey365! This new release contains a lot of improvements and fixes. For example new flags were added to list collectors and CIS benchmarks for both Azure and M365 were updated to 3.0 version. Check it now! github.com/silverhack/monkey…

GitHub - silverhack/monkey365: Monkey365 is an open-source security assessment tool for Microsoft...

Monkey365 is an open-source security assessment tool for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals identify misconfigurations, review cloud security posture, and...

github.com
2
38
98
6,079
Daniel Romero retweeted
Juan Garrido@tr1ana10 Jun 2024
Excited to announce the release of a new version of Monkey365. Multiple bug fixes were fixed and feature enhancements were added. Enjoy! github.com/silverhack/monkey… #cloudsecurity #azuresecurity #microsoft365security #office365security #hardening #PenTest #AzureAD #EntraID #CSPM

Release Monkey365 v0.91.3-beta · silverhack/monkey365

What's Changed Minor update in the ruleset engine. A metadata object with information about collector name, api type, etc.. was added to every single rule Internal funcions for SharePoint Onli...

github.com
19
1
26
2,956
Daniel Romero retweeted
Juan Garrido@tr1ana30 Jun 2023
#Monkey365 dev branch has been updated, introducing a batch of fixes & improvements across the various modules. #Security #Microsoft365 #Office365 #Azure #Compliance #CSPM github.com/silverhack/monkey…
11
16
1,762
#OffensiveCon23 recordings are now live! Hope you enjoy :) youtube.com/playlist?list=PL…

OffensiveCon23

OffensiveCon 2023 Talks

youtube.com
3
265
8
605
136,628
Daniel Romero retweeted
Juan Garrido@tr1ana25 May 2023
Today I'm releasing a new major version of Monkey365. This new version adds a bunch of fixes and include a lot of new improvements to the core module. github.com/silverhack/monkey… #cloud #azure #azuread #microsoft365 #cloudsecurity #compliance
1
25
38
7,051
Daniel Romero retweeted
Jeremy Boone@uffeux11 Apr 2023
Just published details of 5x SMM vulnerabilities in Insyde Software. The bugs span several SMI handlers including a fun parsing bug when performing a BIOS Guard Update. research.nccgroup.com/2023/0…
1
95
4
221
50,457
Daniel Romero retweeted
Jeremy Boone@uffeux15 Mar 2023
I reported a SMM TOCTOU vuln to Intel, but unfortunately it was a dupe of an internally discovered issue. Intel's advisory was vague, so I decided to publish my own detailed analysis. Check it out: research.nccgroup.com/2023/0…
3
46
1
97
21,373
Daniel Romero retweeted
Juan Garrido@tr1ana10 Mar 2023
Working on the new version of #Monkey365. There will be a lot of new features like new rules, support for CIS 1.5 benchmarks, bug fixes and much more. Actually using it right now for bug fixes and other improvements. github.com/silverhack/monkey… #Azure #AzureAD #Office365
13
17
1,874
Daniel Romero retweeted
Jeremy Boone@uffeux8 Feb 2023
We just dropped part 2, wherein @domenpk analyzes whether Rust-based Linux device drivers can be impacted by race condition (TOCTOU) bugs that are common in the C-based driver counterparts. research.nccgroup.com/2023/0…
Jeremy Boone@uffeux7 Feb 2023
My coworker @domenpk has started a series where he deep dives into the Rust for Linux project and tries to understand what kinds of memory safety bugs can persist when a C driver is ported to Rust. Part 1: kernel pointer & structure padding info leaks. research.nccgroup.com/2023/0…
5
1
17
6,422
Load more