Ilay Goldman (@GoldmanIlay) header
Ilay Goldman (@GoldmanIlay) profile picture

Ilay Goldman

@GoldmanIlay

Security Engineer at Meta, Speaker at BlackHat, RSA

 Israel
Joined August 2018
  • Tweets36
  • Following60
  • Followers63
1Media
Photo by Ilay Goldman (@GoldmanIlay)
Replying to @GoldmanIlay
We immediately disclosed these vulnerabilities to the Jenkins team in January 2023, and they responded quickly by issuing a patch for the Jenkins server and the Jenkins Update Center.Read our blog for more information (blog.aquasec.com/jenkins-ser…) #jenkins #cve (5/5)🧵
283
אמ;לק: @YakirKad, @GoldmanIlay מ @AquaSecTeam עשו מחקר מרתק על סיקרטים שלא ניתנים לאיתור ע״י הסורקים הנפוצים כיום. הצוות גילה קרדנשילס לסביבות ענן, תשתיות פנימיות, פלטפורמות טלמטריות, רשתות, מצלמות ועוד, חשופים לעולם. מחקתם את הסיקרט? חושבים שזה מספיק? אולי כדאי לכם לצלול >>
2
3
1
28
1,945
🛑 Ubuntu users, beware! Hackers can exploit a #vulnerability in the command-not-found utility to recommend and trick you into installing rogue packages via snap repositories. Learn more: thehackernews.com/2024/02/ub… Double-check sources before installation. #Linux #Cybersecurity
4
70
2
139
19,366
In our research, we delve into how attackers can manipulate the 'command-not-found' package into suggesting their malicious snap packages. We explain how the suggestion mechanism works and the dangers of installing malicious snap packages. (2/3) 🧵
1
1
85
We also found that 26% of the apt packages' commands could be impersonated by attackers! Understand our findings, implications, and defenses for developers and users alike on our blog. (3/3) 🧵
61
🚨 Snap Trap: The Hidden Dangers Within Ubuntu’s Package Suggestion System 🚨 Attackers could manipulate the package suggestion mechanism in Ubuntu to fool users into installing malicious packages. aquasec.com/blog/snap-trap-t… @AquaSecTeam (1/3) 🧵 #Ubuntu #SSC #CyberSecurity
The Hidden Dangers Within Ubuntu's Package Suggestion System

The Hidden Dangers Within Ubuntu's Package Suggestion System

Aqua Nautilus researchers have identified a security issue that arises from the interaction between Ubuntu's command-not-found package and the snap package repository.

aquasec.com
1
1
2
130
Ilay Goldman retweeted
MrBeast (@MrBeast) profile picture
MrBeast
@MrBeast22 Jan 2024
I’m gonna give 10 random people that repost this and follow me $25,000 for fun (the $250,000 my X video made) I’ll pick the winners in 72 hours
368,743
2,484,373
220,001
1,831,820
286,784,615
🚨Deceptive Deprecation: The Truth About npm Deprecated Packages - new research🚨 8.2% of popular npm packages are officially deprecated. However, our study suggests the real number is closer to 21.2%! @AquaSecTeam @YakirKad blog.aquasec.com/deceptive-d… (1/4) 🧵 #npm #cve

The Truth About npm Deprecated Packages

Researchers at Aqua Nautilus found that 8.2% percent of the most downloaded npm packages are officially deprecated, but the real number is much larger.

aquasec.com
1
2
95
more replies
Moreover, these developers sometimes archived the corresponding repository instead of officially deprecating the package at npm. This behavior led to a discrepancy between the official deprecation status of the package at npm, to the actual deprecation of the package. (3/4) 🧵
1
2
30
In this blog, we detail our criteria for npm package deprecation and introduce Dependency-Deprecated-Checker, our new open-source tool. This tool scans your package.json file and alerts you about deprecated packages. (4/4) 🧵
2
35
Ilay Goldman retweeted
RSAC (@OneRSAC) profile picture
RSAC
@OneRSAC17 Nov 2023
In this #RSAC 2023 presentation, speakers @YakirKad and @GoldmanIlay elaborate on the many attack vectors in the supply chain ecosystem, including integrated development environment (IDE), source code management (SCM), package managers and CI/CD. spr.ly/6014u022j

Exploiting Vulnerabilities and Flaws to Attack Supply Chain

rsaconference.com
2
2
851
Open-source vulnerability disclosure: Exploitable weak spots - helpnetsecurity.com/2023/11/… - @AquaSecTeam @GoldmanIlay @YakirKad #OpenSource #GitHub #VulnerabilityDisclosure #Cybersecurity #CybersecurityNews #InfosecNews
Image from Help Net Security (@helpnetsecurity)
3
4
775
Have you heard of GitHub RepoJacking? 💀 @goldmanilay and @YakirKad from @AquaSecTeam have discovered 37k vulnerable repositories that are at risk of RepoJacking, posing a significant threat to organizations. #bugbounty #bugbountytip #applicationsecurity
Image from Securing Bits (@securing_bits)
1
4
1
11
814
🔐 Unlock the secrets of supply chain vulnerabilities! Check out this informative session from BlackHat Asia 2023, "Breaking the Chain", where the attacker's perspective is examined across 5 phases of the cloud development flow. 👀 Watch now: youtube.com/watch?v=mWgcJxQ7… Presented by: @YakirKad & @GoldmanIlay #supplychainsecurity #cloudsecurity #blackhatasia2023
2
4
880
Even though the video quality isn't the best, I can assure you that the content is the best.
Yakir Kadkoda (@YakirKad) profile pictureYakir Kadkoda@YakirKad12 Sep 2023
Our Black Hat session is now live on YouTube! 🎩🎥 youtube.com/watch?v=mWgcJxQ7… @GoldmanIlay @BlackHatEvents @AquaSecTeam
2
71
🚨PowerShell Gallery: Security Alert- New Research🚨 The PowerShell Gallery stands as a vital registry for modules and scripts (over 9 Billion downloads). However, it is not as protected as we thought it to be. blog.aquasec.com/powerhell-a… (1/2) 🧵

Active Flaws in PowerShell Gallery Expose Users to Attacks

We expose significant flaws in PowerShell Gallery's policy package names and owners, that open potential supply chain attacks on the registry's user base. 

aquasec.com
1
1
41
In our blog, we delve into Microsoft's lack of protection regarding impersonation of popular packages. Additionally, we explore how attacker's unearth hidden packages, potentially exposing secrets. These flaws were confirmed by Microsoft, but they still persist! (2/2) 🧵
28
Ilay Goldman retweeted
Clint Gibler (@clintgibler) profile picture
Clint Gibler
@clintgibler3 Jul 2023
⚔️ GitHub Repositories Vulnerable to RepoJacking Obtaining remote code execution on 37K GitHub repos via RepoJacking: * Exploitation Scenarios * RepoJacking Restrictions and Bypasses * Summary and Mitigations + more! By @goldmanilay and @YakirKad blog.aquasec.com/github-data…
1
5
18
1,689
Check out our new blog about repojacking. We show a massive dataset we used and introduce exploitation scenarios using real repoaitories examples
Aqua Security (@AquaSecTeam) profile pictureAqua Security
@AquaSecTeam21 Jun 2023
Threat Alert! New research by Aqua Nautilus emphasizes the extent of #RepoJacking and exposes potentially millions of vulnerable repositories. Among the repositories found vulnerable to this attack were @Google and @lyft.  Check out the blog here to see the full research + recommended mitigations. blog.aquasec.com/github-data… #cloudnativesecurity
Image from Aqua Security (@AquaSecTeam)
1
5
235
🚨 🚨 The critical chain of vulnerabilities in the widely used Jenkins Server and Update Center have been assigned a score of 9.6, elevating their severity to critical. #CVE Read Aqua Nautilus's research that found these vulnerabilities to understand the impact and what you can do to mitigate your risk. w/@YakirKad and @GoldmanIlay blog.aquasec.com/jenkins-ser…
Image from Aqua Security (@AquaSecTeam)
2
3
394
Load more