Principal Security Architect & Partner at https://xitter.cf/t.co/yIU71SfS40, CloudSec Researcher. Find me at bsky

Oslo, Norway
Joined August 2012
Karim El-Melhaoui retweeted
Shai-Hulud 2.0, a tale of 4 graphs: many numbers have made the news in regards to this story - such as 800 compromised packages - but visualizing the data clearly shows the potential impact of hijacking even a small set of key packages (in terms of prevalence or dependents):
1
9
24
2,436
Karim El-Melhaoui retweeted
🚨 New Shai-Hulud-style npm attack hitting 25k+ repos and growing fast. Devs & CI/CD exposed via malicious preinstall. Wiz Research has detection + mitigation. Details: wiz.io/blog/shai-hulud-2-0-o…
4
45
8
89
83,271
Karim El-Melhaoui retweeted
The schedule for fwd:cloudsec Europe is out, with a single track of high-quality talks over 2 days, along with “Birds of a Feather” interactive sessions! fwdcloudsec.org/conference/e… Some sponsorship opportunities are still available
3
1
14
1,543
Karim El-Melhaoui retweeted
📖 CloudSecList Issue 276 just got released, w/ content from @HuntressLabs @elasticseclabs @O3CYBER @InvictusIRand more! cloudseclist.com/issues/issu…
2
5
965
Karim El-Melhaoui retweeted
This looks like another security incident that may have been caused by "request collapsing". If you use AWS CloudFront, I encourage you to read an older blog post I wrote on this "feature" as it does something many don't expect. swedenherald.com/article/nor… wiz.io/blog/preventing-risk-…
1
5
35
2,644
Karim El-Melhaoui retweeted
🎙️ The podcast that CISOs share in their private channels is *back*! 🎊 Thank you to our guests for making the first 2 seasons incredible. This week: @AmitaiCo & Eden Naftali chat with @karimscloud on open-source dangers & stronger security standards. 🎧 Ready for S3?
2
3
12
1,492
Karim El-Melhaoui retweeted
AWS just released RCP examples to prevent OIDC misconfigurations from many third-party vendors. 😍 github.com/aws-samples/resou… This prevents the problem I wrote about here: wiz.io/blog/avoiding-mistake…
13
80
3,914
Karim El-Melhaoui retweeted
So I tried to build a tech company from Norway and here’s what happened: 1. Two years of building without almost any money/funding, better part of a year without salary 2. Raise VC and become one of Norway’s first unicorns 3. Face unrealized gains wealth tax bill of many x my annual net salary. ofc the company is loss making and all the investors have preference shares so I can’t take out any money. 4. Call out publicly that this does not make sense. Independent of level, taxation needs to happen when you actually make money. 5. I move to Switzerland because no politician cares/listens. 6. I still don’t get any tangible and sensible answers to my criticism of unrealized gains tax, BUT I do get put up on the “wall of shame” at the socialist parties offices… I’m Norwegian and I love Norway but the socialist politicians are taking the country down a dark path. It’s a real life Atlas Shrugged.
Here’s how insane things have gotten in Norway: The Socialist Party has a “wall of shame” in their office with “rich people who have left Norway” - due to the outrageous taxes they’re now being charged. Who do you find on that wall? Startup founders like @hagaetc - who was forced to leave the country because he was paying ALL of his income (!!) in taxes. When the Soviet Union is becoming the role model of your country, time to GTFO.
1,808
8,589
1,495
58,874
7,445,746
Karim El-Melhaoui retweeted
My friends at @DuckbillGroup are doing their annual charity t-shirt drive. This year it's about being force-fed AI. Proceeds go to @826National. I've put together a commercial for it. Buy the t-shirt! 💪 store.lastweekinaws.com/
2
5
1
22
2,984
Karim El-Melhaoui retweeted
slightly more manageable attack surface 😅 lots of transparency & details in the linked report. "We completed a full iteration of app lifecycle management for all of our production and productivity tenants, eliminating 730,000 unused apps. We eliminated 5.75 million inactive tenants, drastically reducing the potential cyberattack surface." microsoft.com/en-us/security…
2
6
45
8,072
Karim El-Melhaoui retweeted
Wow, what a crazy few days. I just got home from @fwdcloudsec EU and wanted to share how amazing this journey was. 1/5
2
1
27
1,012
Karim El-Melhaoui retweeted
Huge respect to Ryan Nolette for entering the lion's den that is fwd:cloudsec this past week to present on AWS vuln disclosure. Thank you.
2
5
43
5,064
Karim El-Melhaoui retweeted
Thrilled at the opportunity to kick off the inaugural fwd:cloudsec, as a newly minted European resident 🇸🇪 Slides are live, click all the links! speakerdeck.com/ramimac/scal…
Rami McCarthy is taking the stage away! Watch his talk live at youtube.com/live/oD-d9B71yLo @ramimacisabird
3
11
51
4,958
Karim El-Melhaoui retweeted
Jus starting the #fwdcloudsec in Brussels!
1
15
525
Karim El-Melhaoui retweeted
Replying to @jcfarris
@JCFarris and @KarimsCloud kicking off fwd:cloudsec Europe in Brussels! Don't miss the livestream at youtube.com/live/oD-d9B71yLo
1
8
200
Karim El-Melhaoui retweeted
We're incredibly excited that fwd:cloudsec Europe is happening tomorrow, in Brussels. All the talks will be livestreamed on YouTube starting from 9 a.m. CEST at youtube.com/live/oD-d9B71yLo, don't miss it! Schedule: fwdcloudsec.org/conference/e…
15
2
35
4,630
Karim El-Melhaoui retweeted
The schedule for fwd:cloudsec Europe is out! fwdcloudsec.org/conference/e… @ramimacisabird will be giving the opening talk, "How to 10X Your Cloud Security (Without the Series D)". Talks will be live-streamed on YouTube for free.
16
2
40
6,096