Picture

Exposure Security @ExposureSec

A security consultancy specializing in Virtual CISO, AppSec & SecDevOps staffing. exposuresecurity.com San Francisco Bay Area Joined February 2014
  • Tweets
    74
  • Followers
    94
  • Following
    1K
  • Likes
    43
ExposureSec Profile Picture

Exposure Security @ExposureSec

6 years ago

More than 30 police vans have rolled in to the area surrounding the HK Police HQ. I’m guessing things will get interesting in the next 4-5 hours. #HongKongProtests

ExposureSec Profile Picture

Exposure Security @ExposureSec

6 years ago

At HK Police HQ

Exposure Security retweeted
theevilbit Profile Picture

Csaba Fitzl @theevilbit

6 years ago

@_RastaMouse @_xpn_ @Cneelis This is also pretty useful ;) bypasses many products by unhooking NtReadVirtualMemory github.com/hoangprod/Andr…

Exposure Security retweeted
_xpn_ Profile Picture

Adam Chester 🏴‍☠️ @_xpn_

6 years ago

If you are using MiniDumpWriteDump to extract memory from lsass, remember that under the hood, it still uses ReadProcessMemory. Worth knowing if the target AV/EDR is alerting based on this.

Exposure Security retweeted
Bugcrowd Profile Picture

bugcrowd @Bugcrowd

6 years ago

Have you joined Bugcrowd's @Discordapp server? Bugcrowd's Discord community chat server is a great way to meet researchers & talk #infosec 🎉 #ItTakesACrowd See you there: discord.gg/YNwkNKr

ExposureSec Profile Picture

Exposure Security @ExposureSec

6 years ago

CVE-2018-15664: Docker Container(all versions) is vulnerable to a symlink-race attack seclists.org/oss-sec/2019/q…

Exposure Security retweeted
ExploitWareLabs Profile Picture

ExploitWareLabs @ExploitWareLabs

6 years ago

Attack Surface Analyzer 2.0 – Free Microsoft Tool to Detect Changes in Operating Systems While Installing Apps github.com/Microsoft/Atta…

ExposureSec Profile Picture

Exposure Security @ExposureSec

6 years ago

Bypassing PAN Traps: c0d3xpl0it.com/2019/01/bypass…

Exposure Security retweeted
jennablan Profile Picture

Jennifer Ablan @jennablan

6 years ago

Warren Buffett lunch bid still $3,500,100

Exposure Security retweeted
matthewdunwoody Profile Picture

Matthew Dunwoody @matthewdunwoody

6 years ago

After years of IR and hunting, if I were to deploy malware, I would make it look like an HP print driver.

M_haggis Profile Picture

The Haag™ @M_haggis

6 years ago

After years of IR and hunting, if I were to deploy malware, I would make it look like an HP print driver.

Exposure Security retweeted
M_haggis Profile Picture

The Haag™ @M_haggis

6 years ago

Query I've found useful lately: (observed_filename:"c:\windows\system32\" OR observed_filename:"c:\windows\syswow64\") is_executable_image:"true" digsig_result:"Unsigned" Modify is_executable_image and digsig_result as you see fit, but you'll start to pick up the patterns.

Exposure Security retweeted
Cryptolaemus1 Profile Picture

Cryptolaemus @Cryptolaemus1

6 years ago

#Emotet Notes and IoCs for 2019/05/27. Late start, E1 elusive DOC, E2 pumping out ~160 URLs. New naming convention for dropped executable. paste.cryptolaemus.com/emotet/2019/05… pastebin.com/vSL0MyhH

Exposure Security retweeted
mylifeasageek Profile Picture

Byoungyoung Lee @mylifeasageek

6 years ago

Any guess how to find races through fuzzing? Here's our approach, Razzer (github.com/compsec-snu/ra…), which found 16 new race bugs in the Linux kernel

Exposure Security retweeted
pmelson Profile Picture

Paul Melson @pmelson

6 years ago

Obfuscated base64 string reverse/reorder in VB to reflectively load a .NET PE payload that checks Pastebin and then decodes and loads another PE payload from a reversed base64 string. All that, just to drop njRat (with localhost C2 even).

ScumBots Profile Picture

ScumBots @ScumBots

6 years ago

Obfuscated base64 string reverse/reorder in VB to reflectively load a .NET PE payload that checks Pastebin and then decodes and loads another PE payload from a reversed base64 string. All that, just to drop njRat (with localhost C2 even).

Exposure Security retweeted
ErrataRob Profile Picture

Robert Graham @ErrataRob

6 years ago

So I've posted both Windows and macOS binaries (self-contained, statically linked) for scanning for CVE-2019-0708 bluekeep. Just click on the badge at the top of the readme. github.com/robertdavidgra…

Exposure Security retweeted
BufferOv3rride Profile Picture

bufferov3rride @BufferOv3rride

6 years ago

win10 1903 Tamper Protection Feature is pretty cool been playing around with it all night. cant kill defender with Set-MpPreference -DisableRealtimeMonitoring $true anymore but, using Set-MpPreference -DisableScriptScanning $true and everything else works.

Exposure Security retweeted
zer0pwn Profile Picture

Dominik Penner @zer0pwn

6 years ago

Fun with custom URI handlers, featuring another Origin RCE and a bypass for the first one. zeropwn.github.io/2019-05-22-fun…

Exposure Security retweeted
buffaloverflow Profile Picture

Rich Warren @buffaloverflow

6 years ago

Confirming SandboxEscaper's latest AppXSvc LPE (aka CVE-2019-0841-BYPASS) is indeed a 0day and works up to the latest 1903 build (but no collector abuse anymore 😢) . Weaponised demo on 1809..

Exposure Security retweeted
pmelson Profile Picture

Paul Melson @pmelson

6 years ago

That thing where your detection detects other detection. 🤣 (cc @cyb3rops)

Exposure Security retweeted
fransrosen Profile Picture

Frans Rosén @fransrosen

6 years ago

Here are my slides from my talk at the Facebook/Google-hosted BountyCon 2019 in Singapore earlier this year: Live Hacking like a MVH – A walkthrough on methodology and strategies to win big speakerdeck.com/fransrosen/liv…

Trends for United States

PlayWildcard
1.598 posts
Adore
28,6 B posts
Dodgers
104 B posts
#GhostofYotei
13,4 B posts
Roki
12,5 B posts
#RUNSEOKJIN_epTOUR_ENCORE
44,4 B posts
#Mawari
Guardian Nodes
Reds
37,2 B posts
#Jin_TOUR_ENCORE
41,1 B posts
Billy Jack
Mookie
6.532 posts
#LoveIsBlind
2.085 posts
Andrade
22,5 B posts
Yamamoto
22,8 B posts
Tito
12,3 B posts
Cancel Netflix
391 B posts
Sheehan
2.075 posts
Kardi
1.589 posts
Harmless
9.627 posts

You might like

Threat intelligence solutions for businesses of all sizes
RST Cloud
@rst_cloud
473 Followers
Senior IT, Security and Training Generalist at @ISOintheSun #riskmanagement #informationsecurity #businesscontinuity #iso31000 #iso27001 #iso22301 etc.
Martin Holzke
@mholzke
391 Followers
Financial/Business Development Consultant| Privacy Consultant| Data Protection Compliance Auditor| Digital Trust Professional Consultant
Stephen Alaekwe
@StephenAlaekwe
65 Followers
Cheerful chap from Reading, Berkshire. Security/Safety Manager and ex-1st Aid Instructor. TRiM Practitioner. Loves following the work of the Emergency Services.
Ivan Barefield
@Skippy_1966
402 Followers