|
Tal Be'ery
@
TalBeerySec
Israel
|
|
All things #CyberSecurity. Security Research Manager. Co-Founder @ZenGo (KZen). Formerly, VP of Research @#Aorato acquired by @Microsoft (#MicrosoftATA.)
|
|
|
6.814
Tweetovi
|
990
Pratim
|
5.706
Osobe koje vas prate
|
| Tweetovi |
|
Tal Be'ery
@TalBeerySec
|
39 min |
|
@jeremiahg the prophet
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
5 h |
|
When attackers compromise a browser they don't necessarily need to go deeper and escape the sandbox.
They can stay within the sandbox and steal victims data by shutting down SOP and create UXSS.
An innovative concept by @itszn13 @BlueHatIL #bluehatil pic.twitter.com/Y5Ry3Zgj1f
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
7 h |
|
#FunFact even @gentilkiwi cannot remember all #mimikatz flags 🤣
#bluehatil @BlueHatIL pic.twitter.com/0wRoCRolaU
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
7 h |
|
Then calling me from stage: "Tal, don't sleep."
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
8 h |
|
"0days are expensive; mistakes are free"
Excellent quote by @n0x08 @BlueHatIL pic.twitter.com/3rJrLmLVTC
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
22 h |
|
Poe's law.
At full power. twitter.com/nic__carter/st…
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
Chekhov's phone.
"If in the registration a phone number is required, then it will be used".
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
on se voit là-bas, mon ami
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
Thanks!
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
6/ Network capture files can be found here github.com/talbeerysec/Cu…
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
5/ and one exploit based detection rule to detect @ollypwn exploit of the degenerate case (private key = 1) pic.twitter.com/w6K1FR5qIq
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
4/ Detecting rogue certificates with a trusted public key (with an idea stolen from @gentilkiwi 😋) pic.twitter.com/inlR9NHS7Z
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
3/ Detecting non-standard base points (but standard a and b parameters) pic.twitter.com/EX1x1dn5Pt
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
2/ detecting non-standard elliptic curve params pic.twitter.com/yz1c2B0zvO
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
3. velj |
|
1/ I just published Hitting a CurveBall Like a Pro!
Using #wireshark to detect and hunt #curveball exploits by following the NSA advisory
link.medium.com/JarIb0qQM3
|
||
|
|
||
| Tal Be'ery proslijedio/la je tweet | ||
|
Mason & Co.
@masonic_tweets
|
30. sij |
|
But honestly I prefer @ZenGo due to the combination of usability and security. World class cryptography.
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
30. sij |
|
For reference, "named curve" vs "specified curve" pic.twitter.com/OqZuQNHeu1
|
||
|
|
||
|
Tal Be'ery
@TalBeerySec
|
30. sij |
|
And you can too, if you DL #wireshark nightly 🌙🌃🌉
twitter.com/Lekensteyn/sta…
|
||
|
|
||