Zero Compromise
Sydney, New South Wales
Joined March 2019
- Tweets25
- Following0
- Followers1.6K
- Likes3
Found SaltStack on a network and don't know how to attack the thing? Check out how a few configuration issues and a new spin on Jinja template injections can undo a network managed by Salt
#SaltStack #cybersecurity #redteam #Pentesting
skylightcyber.com/2023/02/09…
Skylight Cyber retweeted
Researchers disclose details on several critical vulnerabilities affecting Nagios IT monitoring #software that could let attackers hijack corporate networks.
Read: thehackernews.com/2021/05/de…
#infosec #cybersecurity #hacking
Skylight Cyber retweeted
@sam0x21r from @SkylightCyber at #bsidescbr had a good look at Nagios and found, at last count, 13 vulnerabilities! A classic line in the <src> code: “as long as user input is never passed here directly this is safe”.
Skylight Cyber retweeted
Samir Ghanem taking us through his inspirational journey from career amnesia, to how a monitoring tool helped him find a new passion in life. #7 definitely shocked me. @BSidesCbr #bsidescbr
Introducing VNSee, a post-exploitation tool for turning enterprise RealVNC installations to a credential harvesting machine as well as a backdoor. Choose better authentication protocols.
github.com/skylightcyber/vns…
skylightcyber.com/2020/10/20…
It's not every day that you get to find a super simple vulnerability that enables you to gain root privileges on one server. Hang on... make it *all* the servers in a given cloud. Sorry, I meant gazillion servers in thousands of cloud companies! Post here: skylightcyber.com/2019/09/23…
"Rocket League" is the game we've used to deceive Cylance's AI.
We've just updated our write-up of our Cylance universal passive bypass to include information yet to be published. Seems like Cylance SmartAV is still exploitable :-(
skylightcyber.com/2019/07/18…
A Youtube link of our presentation from @BsidesSyd_Org will be available in the next few days. Keep tuned.
AI vendors said they solved end point security. We checked, they didn't.
Check out our rather amusing bypass for @cylanceinc as reported by @KimZetter on @VICE : skylightcyber.com/2019/07/18…
We demonstrate how Right-To-Left-Override tricks can be applied to deceive users and auditors of smart contracts, and discuss mitigation techniques
#ethereum #SmartContracts #vulnerabilities #solidity
skylightcyber.com/2019/05/12…
Skylight Cyber retweeted
What a night! 25 students here from @temasekpoly, Singapore joining ours for an ethical hacking session. Congrats to all the participants and lecturers! @mqintl @SkylightCyber @KPMGSingapore #OMQCSH #cybersecurity #skillsgap
Thanks to a suggestion by
@VessOnSecurity we've uploaded an extended list of targeted MAC addresses to indicate when a single MAC address means you have been targeted and when two MAC addresses are required. #shadowhammer Download at skylightcyber.com/2019/03/28…
Thanks to labsblog.f-secure.com/2019/0… @FSecure we were able to reverse some more hashes out of #shadowhammer target list. The updated list can be found in skylightcyber.com/2019/03/28…
We've published the [almost] full list of MAC addresses targeted by #shadowhammer in plain-text form (based on @Kaspersky's work). Feed into your #threatintel to see if your organization was targeted.
skylightcyber.com/2019/03/28…
Thanks to labsblog.f-secure.com/2019/0… @FSecure we were able to reverse some more hashes. The updated list can be found in skylightcyber.com/2019/03/28…
What is Technical Due Diligence and how it is performed? skylightcyber.com/2019/02/16…
#startup #duediligence #VentureCapital
