Product Security @island_io. Tinkerer, Hacker, Public Speaker; @ShabbatCon Co-Founder. Alignment: Lawful-Gray. Ex: Apiiro, Akamai, Verint Opinions are my own.
38.6537378, -80.3789785
Joined July 2012
- Tweets9.4K
- Following1.3K
- Followers4K
- Likes14.4K
DC9723 is back!
November 30
Where: Ignite Deeptech Offices in Tel-Aviv (Azrieli Center, Triangle Tower 27th floor, Tel Aviv)
Agenda:
19:00 – Arrival
19:15 – Short opening
19:25 – The Imposter Commit: Abusing GitHub Trust for Delivering Clever Malware - Yoav Zemah and Gal Bitensky (@galb1t)
Weekend tinkering → unexpected habit → unexpected results.
Just wrapped this quarter ranked in the Top 10 Israeli hackers on @Hacker0x01 👀
Didn’t plan it, but I’ll take it 😎🧑💻
Somewhat depressing news tbh, making you think of the trch developments and their nonlinearity as well as market demand driving it rather then vision
indiandefencereview.com/some…
One less tracking instrumentation..
TIL - unload event is being (slowly) deprecated
developer.chrome.com/docs/we…
📝 Protip: vuln research isn’t just about breaking stuff
it’s about figuring out what the dev thought they built
the real bugs are usually in their mental model, not the code
many criticals are in fact spec bugs wearing implementation as a disguise
Thats great, but I'd personally prefer burp will update their tech stack, everytime I see that Swing UI i get the shivers – at Israel
Burp AI is here ✨
We believe AI has the power to transform pentesting - not by replacing human testers, but by augmenting them.
Burp AI, a set of powerful features designed to enhance your workflow, reduce noise, and give you deeper insight into vulnerabilities is now available. 🧵
#BurpAI
Some quick reflections on our Product Security journey at @island_io —the last quarter flew by, but security stayed front and center. A few key takeaways (and some do-it-yourself tips): 🧵👇 – at Israel
👥 Openness Beats Blame
Blame kills security culture. Transparency wins.
Set up a Slack/Discord channel where anyone can drop security concerns—no shame, no BS, just good discussions. Smart engineers will hand you gold. – at Israel
dalmoz retweeted
Congratulations to the legendary Adi Shamir on his Levchin Prize win! Dr. Shamir donated the $10K prize money to students sponsorships.
POV: Democracy by the greatest democracy in the world:
Total of 19 honorees -
12 democrat
6 apolitical
1 republican
#medaloffreedom #Biden #Democracy #America #USA
whitehouse.gov/briefing-room…
Research: Global, Passive Detection of Connection Tampering | Proceedings of the ACM SIGCOMM 2023 Conference
Can you guess which country is leading the charts?
Research paper - dl.acm.org/doi/10.1145/36032…
dalmoz retweeted
The FBI apprehended the cyber criminal that took over the @SECGov Twitter account and manipulated markets with their post.
Here’s my thread about the attack at the time where we discuss SIM swap risk, how phone numbers are required for verified accounts which increases risk, etc
A vulnerability on Twitter is that many high profile accounts must add a phone number to become “verified” (even if they choose to hide their checkmark). Then, if you don’t go and remove your phone number after the verification process, you’re at risk for SIM swap account takeover thru phone number password reset flow (especially if you don’t have MFA enabled). Many high profile accounts don’t realize this risk is possible after they apply for “verification” under the new pay-to-verify scheme.
help.twitter.com/en/managing…
