@cnotin

😈 Security researcher: Identity (#ActiveDirectory #EntraID) and Cloud 🎉 #CTF @tipi_hack 👨‍💼 Works @TenableSecurity, but opinions my own

 France 🇫🇷🗼
clement.notin.org/
Joined February 2011
  • Tweets8.7K
  • Following991
  • Followers6K
497Media
Have you ever wondered how to decrypt “encrypted stub data” 🔐 fields in Wireshark when analyzing Kerberos, RPC, LDAP... traffic? ➡️ Ask no more! medium.com/tenable-techblog/… 1. get Kerberos keys 2. give keys to Wireshark in a keytab file 3. get decrypted RPC! Works with NTLM too 😉
5
114
2
450
Funny to see the websites that are blocked by @ChatGPT's computer/browser use: mainly russian and chinese websites (including taobao and aliexpress), but also some xxx Check with that API (when authenticated): chatgpt.com/backend-api/aura… feature_status.agent: true -> blocked
2
581
Just discovered "enhanced open" Wi-Fi in Windows which refers to Opportunistic Wireless Encryption (OWE) en.wikipedia.org/wiki/Opport… 🔐 Nice solution against *passive* eavesdropping on public Wi-Fi. Still susceptible to *active* attacks via rogue APs
1
332
💥 Codex hacked my e-bike in 7 minutes! I can lock it with a PIN code via the mobile app. But the bike leaks it in a status command available to anyone even when locked 🙄 Basic vuln but good finding still 👌 I just gave it the APK, few tools, and it wrote the py script for BLE
3
16
792
Spotted the same thing from here. @brevo_official CDN compromise 💥 Be careful out there! virustotal.com/gui/url/545cf…
Michael Bourne@calgarywebdevSep 14
Replying to @brevo_official
@brevo_official I'm seeing a ClickFix malware on your main website when connecting from Canada. You may want to look into that.
1
7
2
10
4,390
Beyond the ClickFix attack (didn't get the paylod), there's a script virustotal.com/gui/url/545cf… to upload a malicious WordPress extension virustotal.com/gui/file/901e… ("wmedia-optimizer" / "Web Media Optimizer") if their malicious JS ran on a site where an admin was connected
1
4
542
Incident is now documented: - sansec.io/research/brevo-sup… - bleepingcomputer.com/news/se… - status.brevo.com/incidents/0…
1
1
343
Entra ID sign-in logs are not accessible via the Graph API in free-tier tenants, but they can still be collected live using diagnostic settings to send them to event hub. The former is documented but not the latter. Is it known or intended?
3
3
2
55
33,071
Graph API returns error "Authentication_RequestFromNonPremiumTenantOrB2CTenant" -> "Tenant is not a B2C tenant and doesn't have premium license" as documented in learn.microsoft.com/en-us/tr…

Tenant Doesn't Have Premium License When You Query User Sign-in Activities By Using Microsoft Graph

Provides solutions to the either tenant is B2C or tenant doesn't have premium license error when you query user sign-in activities by using Microsoft Graph

learn.microsoft.com
1
5
771
Couple years later, @Cymulate_Ltd got a closer look at this oddity and it turned fruitful😉 cymulate.com/blog/kerberos-a… And @tiraniddo's even before projectzero.google/2021/10/u…

Kerberos Authentication Relay Via CNAME Abuse 

Cymulate Research reveals a Kerberos relay technique abusing DNS CNAMEs to enable user impersonation, lateral movement, and RCE in Windows environments.

cymulate.com
Clément Notin@cnotin31 Aug 2020
Just noticed that Kerberos authentication worked with a server's ("server.lab.test") friendly name ("http://serveralias.lab.test") whereas I did not declare any SPN or alias for it. There is only a simple DNS CNAME. I find it surprising! Is it normal? Documented? 🤔
3
16
1,848
For two decades I was used to craft my Google searches properly (words order -if only it still matters-, using operators etc), unlike normal folks who asked questions directly 🙄 And now with the AI mode, which is very convenient, I’m asking questions too and I feel so dirty!
2
635
Great action on Active Directory and Entra ID. Check out their TTPs
@[email protected]@christruncerAug 25
I always look forward to when we, CISA’s red team, gets to publish our reports, and today is one of those days! “A Tale of Two SOCs” - a story where we targeted two different orgs, with the same tradecraft, and very different responses. Read it! - cisa.gov/news-events/cyberse…

A Tale of Two SOCs: Insights From Two Red Team Assessments | CISA

Same tactics, very different results. This advisory compares defensive outcomes from two red team assessments. Learn what drove detection and implement key actions to protect your organization from...

cisa.gov
1
1
11
2,731
Storm-0501 threat actor pivots from Entra ID compromise to Azure cloud takeover, for double extortion ransomware: exfiltration + destruction (or encryption) For @TenableSecurity, I built detection rules to catch this progression. Here’s how Tenable One CDR helps ⬇️
1
11
63
4,930
tenable.com/blog/detecting-c…

How to stop cloud ransomware attacks in Azure

Cloud ransomware actors like Storm-0501 actively target Azure environments. Learn how Tenable One helps find cloud attacks early, neutralize them, and decrease cloud risk.

tenable.com
5
1
13
3,237
"The exploit work itself was the best television I’ve seen in years. My wife watches Real Housewives… I watched a language model’s chain of thought, live, for hours" I feel seen! Same here!
Miguel de Icaza ᯅ🍉
@migueldeicazaAug 23
This is now a GLM 5.3 household: ericpardee.github.io/fire-hd…

Amazon kept shutting down my tablet, so I spent $266 on four AI models to own it

Owning a tablet Amazon kept shutting down: CVE-2022-38181, four AI models, five months

ericpardee.github.io
5
1,294
Has anyone already played with the "microsoft.directory/oAuth2Pe…" Entra ID permission? It's in the "Application Developer" role learn.microsoft.com/en-us/en…, making it privileged, but I'm looking for actual exploitability. @emiliensocchi perhaps?
1
6
807
AD isn't dead!! Not even its tiering model. See also this recently published doc learn.microsoft.com/en-us/wi…

AD DS Tier Model for Privileged Access Security in Windows Server

Learn how the Active Directory Domain Services (AD DS) tier model protects identity systems by preventing credential exposure and privilege escalation.

learn.microsoft.com
Merill Fernando
@merillJul 24
I don't usually post about Active Directory but I'm doing this for @techspence 😂 This is officially from Microsoft. Link below 👇
1
11
1
90
10,550
Send us your best submissions! 🎤
Entrypoint@Entrypoint_frJul 23
The Review Board for Entrypoint 2027 is complete🔒 10 security experts from around the world will be reading your submissions this year ! Reminder: CFP closes on September 20, 2026 at 23:59 UTC Submit your paper now at entrypoint.fr/ Meet the team below (A-Z)👇
7
974
This is crazy! Unsure if loving it or scared
Nathan Lambert
@natolambertJul 21
TLDR: An openai model, during evaluation on a cyber benchmark, exploited a public zero day bug, escaped sandboxing in openai's infra, and got into the internal huggingface infra via an exploit (through a public dataset service) all in the attempt to solve a benchmark problem.
2
705
Clément Notin retweeted
Entrypoint@Entrypoint_frJun 18
We've been working on something for a while. The talks your blue team doesn't want you to see. 🔴 Red Teaming. Initial Access. AD. Cloud & Web exploitation. 📍 Paris - Le Dernier Étage 📅 March 19–20, 2027 entrypoint.fr CFP and additional details coming soon.
1
54
2
101
20,777
"France sovereign cloud" Did I miss something?
Fabian Bader@fabian_baderJun 22
Entra Connect v2.6.79.0 was just released and contains undisclosed security fixes and @Microsoft recommends to update fast. On the bright side, it will finally support FIDO2 based authentication!
2
8
3,276
Load more