security, for the internet, at @wiz_io! opinionated about security. 🇺🇸 in 🇸🇪 (he/him)
Joined June 2019
- Tweets1.2K
- Following967
- Followers5.2K
- Likes5.3K
Pinned Tweet
New year, new job!
I've joined the amazing @wiz_io research team
My goal is the "work for the security industry, at Wiz"
I wrote a blog post explaining why, and what that means: ramimac.me/joining-wiz
Rami McCarthy retweeted
I let AI loose on my security programme linkedin.com/pulse/i-let-ai-…
When it rains it pours: blog.railway.com/p/security-…
> an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents
We (@wiz_io ) continue to update our post on the LiteLLM supply chain incident, which we've been tracking since our crawler identified it this morning (eastern)
🧑🚒 We've begun to see abuse of stolen credentials - initially related to LLMJacking - from the following IPs
* 168.100.8[.]57
* 165.227.201[.]8
Check the blog for full details: wiz.io/blog/litellm-compromi…
Come catch me & friends tomorrow at this summit - excited to have recruited excellent folks (👀@0x4D31, @StuHirstInfoSec 👀) to share how AI is transforming their security program
I'll also chat about how AI is popping up in the work we do at @wiz_io Research 🫡
A thousand news articles on malicious slopped npm packages, and yet no one put me on to this amazing research from @_splitline_ achieving RCE in os package managers: youtu.be/uD3hbSvZYls?is=4XlH…
Building on their great Black Hat talk that focused on package ecosystems: i.blackhat.com/BH-USA-26/Pre…
Rami McCarthy retweeted
AWS has a new sign up experience, which puts new accounts into a sort of a sandbox, but not exactly in the way you might think. This post explores what it does and how it works. wiz.io/blog/exploring-the-ne…
In case you missed it, the spree of supply chain attacks visited Rust, hitting arrayref (245+ million downloads all time)
Our Threat Center Advisory went out to customers a while ago. I wasn't going to blog ... and then we saw the DPRK connection
🇰🇵🤜🦀wiz.io/blog/rust-supply-chai…
arrayref is in 3/4 of environments where Rust is in use.
However, the exposure window was kept short due to the quick work by Rust's Security team (and h/t @nextronresearch for reporting!) and overall impact numbers seem lower than incidents like keyv and axios.
Shout out to the teams who got the word out quickly:
@AikidoSecurity @IlyasMakari
@JFrogSecurity @yairbjfrog
@nextronresearch @marius_benthin
@safedepio & @step_security
Rami McCarthy retweeted
We know attackers are registering devices. They know we know🙃
So they’re getting smarter, and we need to stay one step ahead. @shahardorf & I wrote a new post on how to outsmart them, and it's pretty good! wiz.io/blog/detecting-entra-…
🔧If you are self-hosting Metabase, patch the SQLi urgently.
PoCs are being published, so I wanted to share some more details on the vulnerability, and how we agentically reverse engineered it upon disclosure to better protect customers 1/4
Metabase held back the patch, but agentically reversing has a playbook:
1. Diff vulnerable and patched JARs
2. Decompile relevant class
3. Correlate bytecode to open source
5. Reconsctruct vulnerability
6. Validate against a local instance
3/4
