Pinned
Tal Be'ery
16.1K posts
Tal Be'ery
@TalBeerySec
Security Research Manager.
Co-Founder, CTO @ZenGo.
Advisor @ZeroNetworks.
x-VP Research Aorato, acq by @Microsoft.
10 times @BlackHatEvents speaker.
- Just published a blog explaining the root cause of the recent #win10 crypto vulnerability (CVE-2020-0601 / #curveball ?) using some "Load Bearing Analogies" to make it more accessible. CC: @tqbf @grittygrease @dakami
- Yikes! Tomorrow @ZenGo will publish about a vulnerability we had found in @coinbasewallet and others. We had responsibly disclosed to CB many weeks ago, they fixed and awarded us multiple bug bounties. Today we informed them we are going to publish. This is the reaction we got:
- Unauthenticated Remote Code Execution (RCE) on Domain Controllers (DC). It does not get worse than that. Probably will be included in #ransomware campaigns. Any technical analysis of CVE-2024-49112 published? CC: @gentilkiwi @harmj0y @_wald0
00:00
- 1/ A DoS exploit demo for CVE-2024-49112 by @safebreach. RCE exploit is probably coming soon. Patch!
00:00Unauthenticated Remote Code Execution (RCE) on Domain Controllers (DC). It does not get worse than that. Probably will be included in #ransomware campaigns. Any technical analysis of CVE-2024-49112 published? CC: @gentilkiwi @harmj0y @_wald0 - Did Hamas trade on terror and shorted Israeli ETFs before #7octobermassacre yielding profit in the Billions? Very Likely, say the former SEC commissioner @SECJackson et al. img.haarets.co.il/bs/0000018c-30… via @haaretzcom
- 1/ A world first reverse engineering analysis of AWS Session Tokens. Prior to our research these tokens were a complete black box. Today, we are making it more of a glass box, by sharing code and tools to analyze and modify AWS Session Tokens.
- Replying to @TalBeerySecA bug bounty is not a gag order. We will not be bullied or intimidated. #CoinbaseWallet you can have your money back. CC: @brian_armstrong
- "apt-get install bloodhound" FTW! #BloodHound was recently added to @kalilinux Thanks @GotMilk, sbrun CC: @_wald0 @harmj0y @CptJesus
- Replying to @TalBeerySecThis is NOT the way to treat security researchers. We conducted this research to increase the security of the ecosystem and not for some bug bounties. Bug bounties are mostly tokens of appreciation. So, YES, we will publish. And, YES, we name CB and share a video of an exploit.
