Shay Berkovich @sshaybbc

Threat Research at WIZ Israel Joined March 2016

Tweets

102
Followers

155
Following

211
Likes

860

Rami McCarthy @ramimacisabird

4 days ago

More from me on s1ngularity, the Nx supply chain attack. We @wiz_io took advantage of the break in attacker activity to break down: * overall impact * efficacy of the AI usage (not great!) * TTPs and investigation breadcrumbs we've seen to date * our work to notify victims

1 8 38 3K 11

Download Image

Rami McCarthy @ramimacisabird

a week ago

😱Imagine waking up to see all your private github repositories were published publicly ... That's what happened overnight for >400 users/orgs and >5000 repositories s1ngularity (the Nx supply chain attack) continues to bear fruit for attackers. Rotate ASAP!

3 15 80 9K 36

Download Image

Rami McCarthy @ramimacisabird

4 months ago

In light of recent GitHub Actions incidents (Ultralytics, tj-actions...), I wrote up a practical guide to hardening for @wiz_io Covers permissions, secrets, 3rd-party Actions, ++ Use it to avoid learning these lessons the hard way: wiz.io/blog/github-ac…

2 22 59 5K 30

Wiz @wiz_io

4 months ago

🔍IT'S HERE: #ExfilCola, our cloud IR security CTF challenge!🥤 Your mission: - Investigate the cloud environment logs - Research the compromised machines - Secure the files and save the day ⏰ The Cloud Hunting Games are live >> cloudhuntinggames.com

3 16 47 4K 25

Download Video

Shay Berkovich @sshaybbc

6 months ago

Re #IngressNightmare - until yesterday, there have been only one Critical and 12 Highs in K8s according to official CVE feed[k8s.io/docs/reference…] (since 2017). Its 2 and 15 now. This is big.

0 1 7 511 0

Download Image

Rami McCarthy @ramimacisabird

6 months ago

😺 Cat's out of the bag We've updated our blog post on the `tj-actions` / `reviewdog` incident to disclose the target. We also have new details on the root cause of the `reviewdog` element. h/t @sshaybbc for a ton of leg work here

1 23 59 7K 17

Download Image

Shay Berkovich @sshaybbc

6 months ago

Check this out before #KubeCon - we analyzed a huge amount of clusters to get some interesting security stats, like the adoption of the new EKS authentication mode. Hint - its low. Details inside 👇

Wiz @wiz_io

6 months ago

2 5 39 5K 5

Download Image

0 1 4 342 0

Truffle Security @trufflesec

6 months ago

🔥 You can now add TruffleHog to Burp Suite! 🌐 Install it directly from the BApp Store 🔍Scan web traffic for live, verified credentials—active & exploitable Because secrets don’t just leak in code… 😬 Big Thanks to @PortSwigger ! 🙌 🔗trufflesecurity.com/blog/introduci…

3 60 234 15K 83

Download Image

Nir Ohfeld @nirohfeld

7 months ago

Thrilled to finally share this—one of the coolest container escapes I’ve seen! 🔥 wiz.io/blog/nvidia-ai… A subtle logic bug that lets you break out to the host on ANY NVIDIA GPU-supported container 🤯 Can’t believe we had to sit on the technical details for so long! Incredible…

Ronen Shustin @ronenshh

7 months ago

3 17 73 9K 19

1 10 47 5K 13

Download Gif

Wiz @wiz_io

9 months ago

🚨 Supply chain attack alert: The curious case of #Ultralytics. A #GitHub Action compromise led to the release of malicious versions (8.3.41, 8.3.42) of the popular Ultralytics Python package, embedding a cryptominer into systems via PyPI.

1 5 7 1K 3

Download Image

Wiz @wiz_io

11 months ago

🌩️ CLOUD THREAT MONTHLY ROUNDUP 🌩️ 🚨Storm-0501 targets hybrid environments, exploiting on-prem vulnerabilities & Microsoft Entra IDs. 🐧REF6138 hits Linux Apache2 with DDoS, cryptominers & malware. ⚠️perfctl hijacks Linux servers stealthily. Read more: threats.wiz.io

1 4 10 2K 1

Download Gif

Wiz @wiz_io

11 months ago

🎙️ Don't miss the latest #CryingOutCloud episode! @AmitaiCo & Eden dive into cloud security challenges, AI vulnerabilities, Info Stealers Mitigation, and more. Tune in! 📺 youtube.com/watch?v=RjdZgy… 🍏podcasts.apple.com/us/podcast/ai-…

0 2 5 993 0

Download Image

Ronen Shustin @ronenshh

11 months ago

We discovered a container escape vulnerability in the @nvidia Container Toolkit. It allows attackers to gain full access to the host's filesystem and achieve Remote Code Execution (RCE). Here's everything you need to know about CVE-2024-0132 🧵👇

4 71 297 24K 89

Download Gif

Amitai Cohen 🎗️🤟 @AmitaiCo

12 months ago

Check out the first entry in our new blog series on cloud IOCs, a subject I'm quite passionate about. We've also launched a new open source collection of such indicators, available here (we'll be updating this regularly): github.com/wiz-sec-public…

Wiz @wiz_io

12 months ago

0 12 51 10K 16

Download Image

2 12 42 7K 15

Shay Berkovich @sshaybbc

12 months ago

This is gnarly. I think a workflow that is triggered by the new issue creation and performs basic checks (author) or advanced checks (url filtering) should help here.

Ax Sharma @Ax_Sharma

12 months ago

This is gnarly. I think a workflow that is triggered by the new issue creation and performs basic checks (author) or advanced checks (url filtering) should help here.