@ynvb

Not the droid you are looking for 🤖 VP Research @SaltSecurity | Former Head Of Cyber Research @_cpresearch_ . Opinions are my own.

 In a galaxy far far away
Joined July 2010
  • Tweets1.4K
  • Following555
  • Followers1.4K
66Media
Did you think XSS is dead? So did we... We couldn't be more wrong. XSS is back with a vengeance! 💥 Combined with OAuth, the Salt-Labs team performed a full account takeover on several major online platforms. salt.security/blog/over-1-mi… #XSS #OAuth #cybersecurity #APISec #infosec

XSS Vulnerability Tied to Hotjar Leaks Sensitive OAuth Data

Over 1 million sites face XSS vulnerabilities that leak OAuth credentials via tools like Hotjar. Learn how these threats bypass defenses and impact users.

salt.security
1
6
21
1,922
For example, when using this technique on hotjar.com/ - we got access to screen recordings from millions of users worldwide 🤯
7
236
Hey @elonmusk, our team at Salt Labs just released some very concerning security issues in the ChatGPT ecosystem, which may put a lot of data for a lot of users at risk. Time for OpenAI to step up their security game, don't you think? Full report: salt.security/blog/security-…

ChatGPT Vulnerability - Security Flaws within ChatGPT

Salt Labs researchers identified vulnerabilities in the ChatGPT ecosystem that could have granted access to accounts of users and sensitive data.

salt.security
1
8
26
2,215
Check out our latest research. This time, flaws in GenAI ecosystems and several issues in ChatGPT and its integrated plugins. Kudos, @AviadCarmel, for this wonderful research. salt.security/blog/security-…

ChatGPT Vulnerability - Security Flaws within ChatGPT

Salt Labs researchers identified vulnerabilities in the ChatGPT ecosystem that could have granted access to accounts of users and sensitive data.

salt.security
2
11
771
Looking for a contact in OpenAI security team… anyone here has any leads?
1
4
6
2,147
Just discovered a full account takeover on Grammarly.com, Vidio.com and more using a new OAuth attack technique. This is the last part of the OAuth trilogy; in total, we could take over 1+ BILLION accounts! salt.security/blog/oh-auth-a… #OAuth #hacking

Grammarly: Free AI Writing Assistance

Grammarly makes AI writing convenient. Work smarter with personalized AI guidance and text generation on any app or website.

grammarly.com
4
87
3
272
44,310
Down the OAUth rabbit hole we go... This time it's a framework issue potentially affecting hundreds of online services, including sites like Codecademy and others... More exciting targets are coming next... stay tuned and secure your OAuth implementations! salt.security/blog/a-new-oau…

New OAuth Vulnerability Impacts Hundreds of Online Services

OAuth vulnerability earns CVE-2023-28131. Salt exposes a new vulnerability in the popular OAuth framework, used in hundreds of online services.

salt.security
1
19
1
54
9,015
and ofcourse big kudos to @AviadCarmel for this wonderful research.
1
3
335
Replying to @SaltSecurity
@SaltSecurity's contribution, beyond the sponsorship, warms our hearts. A big shoutout to @ynvb, who contributed ideas and use cases that were quoted in the latest addition. 💖
1
2
291
Nothing like a good visual aid to remember how to assemble a network cable.
MalwareHunterTeam
@malwrhunterteam15 Mar 2023
You aren't into networking if you not recognise the meaning of this immediately... 😂 cc @JAMESWT_MHT
1
17
10,286
Yaniv Balmas retweeted
Dark Reading
@DarkReading2 Mar 2023
Booking.com OAuth Implementation Allows Full Account Takeover: bit.ly/3yosNoN by Elizabeth Montalbano
7
1
5
4,095
Taking over booking.com accounts by abusing OAuth 2.0 youtu.be/IK_AV1UFS-0 Read the technical details here: salt.security/blog/traveling…?
3
33
126
13,447
Just discovered Mandiant has an Urban Dictionary entry. Fantastic stuff. Huge if true. urbandictionary.com/define.p…
4
42
2
271
Vulnerability disclosure with non-technological companies (eg not ms, oracle, meta, etc) is lightyears away in terms of how the reporters are treated. Doing that for a while now, I’ve had a potential law suit from a Fortune 500 company, and insulting responses in many other cases
2
5
30
In my mind this kind of behavior was part of the old dark days of the internet. I’m very surprised to find out this is still happening today (on a large scale)
1
5
This is my account on Mastodon - infosec.exchange/@ynvb - verified by Twittodon.com

ynvb (@[email protected])

5 Posts, 55 Following, 31 Followers · Not the droid you are looking for 🤖 VP Research @SaltSecurity | Former Head Of Cyber Research - Check Point Research. Opinions are my own.

infosec.exchange
1
2
Still not leaving Twitter, but I guess it’s nice to have that around these days
Yaniv Balmas retweeted
securylight@securylight18 Nov 2022
Replying to @ynvb
@ynvb You Rock! Wonderful Talk at OWASP GLOBAL APPSEC SF
1
2
👋 Attending #OWASP Global AppSec San Francisco this week? Don't miss @SaltSecurity VP of Research @ynvb's session "API Security: Stories from the Trenches" Friday, Nov. 18! Get details here: ow.ly/s9i850LCVUf #apisecurity @owasp
8
3
Yaniv Balmas retweeted
Eyal Itkin@EyalItkin5 Oct 2022
I finally had some free time on my hands and decided to extend Scout's support to Nvidia's DPUs. Scout v2.1.0: Now with aarch64 support and improved support when working on a native arm machine. github.com/eyalitki/Scout

GitHub - eyalitki/Scout: Scout - Instruction based research debugger (a poor man's debugger)

Scout - Instruction based research debugger (a poor man's debugger) - eyalitki/Scout

github.com
1
4
16
Load more