Asi Greenholts retweeted
New research our team released today, showing how we could push code to highly popular open source projects maintained by Google, AWS, Microsoft, & Red Hat, through a race condition in GitHub Actions.
Go hunt critical #bugbounty issues ;)
by @yaronavital
unit42.paloaltonetworks.com/…
Asi Greenholts retweeted
This Saturday I will be speaking at #DefCon32 about OIDC misconfigurations and abuses in the context of CI/CD 🥴👹.
Come check it out!
info.defcon.org/event/?id=54…
@PaloAltoNtwks
#OIDC #oauth2 #ci #cd
Asi Greenholts retweeted
Two great talks delivered in Vegas this year by our team - again!
In this year’s hacker summer camp in LV, our Research team will stand on the @defcon & @BSidesLV stages again, to share two novel research projects we’ve been working on recently:
#HackerSummerCamp #defcon32
Asi Greenholts retweeted
Right now on stage @TupleType with “The GitHub Actions Worm: Compromising GitHub repositories through the actions dependency tree”!
Join live: youtube.com/live/tlBnIA9FQrg
Asi Greenholts retweeted
📚 tl;dr sec 234
🗡️ Awesome CI/CD Attacks @TupleType
🤖 STRIDE GPT
☁️ Non Production AWS Attack Surface @Frichette_n
🛡️ Secure defaults @ramimacisabird
🛠️ WAF bypass tool @infosec_au
💻 Hacking millions of routers @samwcyo
tldrsec.com/p/tldr-sec-234
![[tl;dr sec] #234 - Awesome CI/CD Attacks, STRIDE GPT, Non Production AWS Attack Surface](https://pbs.twimg.com/card_img/2116562353227534337/oBJ_pmmZ?format=jpg&name=800x419)
Asi Greenholts retweeted
Hi @BlackHatEvents - I was shocked to discover that one of your Cyber Security Trainer and Review Board Members is also an antisemitic, a terror supporter who publicly denies Hamas Terror acts. Please remove @Voulnet from his role immediately!
Asi Greenholts retweeted
Highly inspired by our @owasp Top 10 CI/CD Security Risks project, cool:)
Keep malicious actors out of your pipeline! Follow the NSA and CISA recommended guidance to defend against CI/CD pipeline compromise. nsa.gov/Press-Room/Press-Rel…
ALT Defending Continuous Integration/Continuous Delivery (CI/CD) Environments. Cybersecurity Information Sheet.
Asi Greenholts retweeted
All details are here: cidersecurity.io/blog/resear…
Huge thanks to @TupleType @yaronavital @spaceB0xx @Dkrivelev
9/
Asi Greenholts retweeted
Our @BSidesLV talk is now available -
Climbing the Production Mountain: Practical CI/CD Attacks Using CI/CD Goat
youtube.com/watch?v=w-R2PT2j…
with @TupleType
Asi Greenholts retweeted
Gravity causes planets to orbit around their stars and bodies on Earth to fall towards the ground; however, goats seem they don't care at all [source 📽️: buff.ly/3nrpHe0] nitter.cf/pickover/status/148614…
Asi Greenholts retweeted
I’m proud and honored to present the “Top 10 CI/CD Security Risks” project!
cidersecurity.io/top-10-cicd…
👇 [1/4]
Asi Greenholts retweeted
A @GitHub vulnerability: Bypassing required reviews using GitHub Actions.
medium.com/cider-sec/bypassi…
