I'm Winston Wolfe. I solve problems. Yersinia author. Founder, CounterCraft https://xitter.cf/t.co/2RLFjoit1C @countercraftsec
San Sebastián
Joined January 2009
- Tweets20.4K
- Following3.6K
- Followers6.5K
- Likes25.1K
Pinned Tweet
Muchas gracias, es un honor recibir este Premio. Es fantástica y puntera la comunidad de ciberseguridad en España y no cabe duda que el @CCNCERT ha sido uno de los principales contribuidores. Vaya sorpresa más bonita!
Finalmente, se ha hecho entrega del Premio a la Trayectoria Profesional en Favor de la Ciberseguridad a David Barroso @lostinsecurity, CEO de @countercraftsec #XVIIJornadasCCNCERT #VJornadasESPDEFCERT ¡Enhorabuena!
David Barroso retweeted
StealMyBitcoin is solved! This is the absolute best explanation you’ll see on how hard #php2shell is to exploit. The author had to trigger a precise memory corruption condition, leak internal memory addresses, bypass aslr, reverse engineer php’s internal memory structures, forge structures to hijack execution, and account for php build differences, worker behavior and timing to get RCE. 20 http requests with a 7 out of 10 success rate. What an amazingly successful CTF. Impressive the creator was able to keep the server up during all the attempts. With all the BS around it’s nice to see something concrete that moves the art forward.
github.com/KillaBoi/StealMyB…
Love this. The💰is still in the wallet. Finally we get some ground truth around how hard php2shell is to exploit. The amount of bullshit flying around from vendors capitalizing on the moment is staggering, And the alert fatigue they’re creating is really going to hurt when a mass exploitable RCE emerges. We still haven’t seen a production site hacked via #php2shell at Wordfence.
David Barroso retweeted
The server was hacked and someone exfiltrated the key. gg. news.ycombinator.com/item?id…
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
David Barroso retweeted
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
David Barroso retweeted
3% of “critical” software security bugs, in all of recorded history, have been found in the last month.
This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total
Do you realize how fucking insane that is?
David Barroso retweeted
IMHO, the Brotli bug (think zlib 20 years ago) is a bigger deal than PHP2Shell and all the "oooh, AI found it! AI found it!" hype.
Node2Shell is a terrible name.
I’m calling it Broccoli. 🥦
David Barroso retweeted
We protect over 5 million PHP sites and when we find a major exploitable vulnerability, we always see site cleanings. We have seen exactly zero hacked sites from php2shell. Zero. Across a population of 5 million PHP sites that our product protects. Draw your own conclusions. #php2shell
David Barroso retweeted
github.com/mitmproxy/mitmpro…
That went fast.
