@GoldmanIlay profile picture
Ilay Goldman @GoldmanIlay
Joined August 2018
  • Tweets 36
  • Following 59
  • Followers 65
1 Photos and videos
Pinned Tweet
Ilay Goldman@GoldmanIlay
8 Mar 2023
Replying to @GoldmanIlay
We immediately disclosed these vulnerabilities to the Jenkins team in January 2023, and they responded quickly by issuing a patch for the Jenkins server and the Jenkins Update Center.Read our blog for more information (blog.aquasec.com/jenkins-ser…) #jenkins #cve (5/5)🧵
281
Ilay Goldman retweeted
Shaked Klein Orbach 🇮🇱
@shakedko
27 Jul 2024
אמ;לק: @YakirKad, @GoldmanIlay מ @AquaSecTeam עשו מחקר מרתק על סיקרטים שלא ניתנים לאיתור ע״י הסורקים הנפוצים כיום. הצוות גילה קרדנשילס לסביבות ענן, תשתיות פנימיות, פלטפורמות טלמטריות, רשתות, מצלמות ועוד, חשופים לעולם. מחקתם את הסיקרט? חושבים שזה מספיק? אולי כדאי לכם לצלול >>
2
3
28
1,942
Ilay Goldman retweeted
The Hacker News
@TheHackersNews
14 Feb 2024
🛑 Ubuntu users, beware! Hackers can exploit a #vulnerability in the command-not-found utility to recommend and trick you into installing rogue packages via snap repositories. Learn more: thehackernews.com/2024/02/ub… Double-check sources before installation. #Linux #Cybersecurity

4
71
139
19,358
In our research, we delve into how attackers can manipulate the 'command-not-found' package into suggesting their malicious snap packages. We explain how the suggestion mechanism works and the dangers of installing malicious snap packages. (2/3) 🧵
1
1
84
We also found that 26% of the apt packages' commands could be impersonated by attackers! Understand our findings, implications, and defenses for developers and users alike on our blog. (3/3) 🧵
61
🚨 Snap Trap: The Hidden Dangers Within Ubuntu’s Package Suggestion System 🚨 Attackers could manipulate the package suggestion mechanism in Ubuntu to fool users into installing malicious packages. aquasec.com/blog/snap-trap-t… @AquaSecTeam (1/3) 🧵 #Ubuntu #SSC #CyberSecurity

The Hidden Dangers Within Ubuntu's Package Suggestion System

Aqua Nautilus researchers have identified a security issue that arises from the interaction between Ubuntu's command-not-found package and the snap package repository.

aquasec.com
1
1
2
128
Ilay Goldman retweeted
MrBeast
@MrBeast
22 Jan 2024
I’m gonna give 10 random people that repost this and follow me $25,000 for fun (the $250,000 my X video made) I’ll pick the winners in 72 hours
376,145
2,529,115
1,862,112
284,634,638
🚨Deceptive Deprecation: The Truth About npm Deprecated Packages - new research🚨 8.2% of popular npm packages are officially deprecated. However, our study suggests the real number is closer to 21.2%! @AquaSecTeam @YakirKad blog.aquasec.com/deceptive-d… (1/4) 🧵 #npm #cve

The Truth About npm Deprecated Packages

Researchers at Aqua Nautilus found that 8.2% percent of the most downloaded npm packages are officially deprecated, but the real number is much larger.

aquasec.com
1
2
93
more replies
Moreover, these developers sometimes archived the corresponding repository instead of officially deprecating the package at npm. This behavior led to a discrepancy between the official deprecation status of the package at npm, to the actual deprecation of the package. (3/4) 🧵
1
2
30
In this blog, we detail our criteria for npm package deprecation and introduce Dependency-Deprecated-Checker, our new open-source tool. This tool scans your package.json file and alerts you about deprecated packages. (4/4) 🧵
2
35
Ilay Goldman retweeted
RSAC@OneRSAC
17 Nov 2023
In this #RSAC 2023 presentation, speakers @YakirKad and @GoldmanIlay elaborate on the many attack vectors in the supply chain ecosystem, including integrated development environment (IDE), source code management (SCM), package managers and CI/CD. spr.ly/6014u022j

Exploiting Vulnerabilities and Flaws to Attack Supply Chain

rsaconference.com
2
2
851
Ilay Goldman retweeted
Help Net Security@helpnetsecurity
9 Nov 2023
Open-source vulnerability disclosure: Exploitable weak spots - helpnetsecurity.com/2023/11/… - @AquaSecTeam @GoldmanIlay @YakirKad #OpenSource #GitHub #VulnerabilityDisclosure #Cybersecurity #CybersecurityNews #InfosecNews
3
4
775
Ilay Goldman retweeted
Securing Bits@securing_bits
20 Sep 2023
Have you heard of GitHub RepoJacking? 💀 @goldmanilay and @YakirKad from @AquaSecTeam have discovered 37k vulnerable repositories that are at risk of RepoJacking, posing a significant threat to organizations. #bugbounty #bugbountytip #applicationsecurity
1
4
12
814
Ilay Goldman retweeted
Aqua Security
@AquaSecTeam
19 Sep 2023
🔐 Unlock the secrets of supply chain vulnerabilities! Check out this informative session from BlackHat Asia 2023, "Breaking the Chain", where the attacker's perspective is examined across 5 phases of the cloud development flow. 👀 Watch now: youtube.com/watch?v=mWgcJxQ7… Presented by: @YakirKad & @GoldmanIlay #supplychainsecurity #cloudsecurity #blackhatasia2023
2
4
877
Even though the video quality isn't the best, I can assure you that the content is the best.
Yakir Kadkoda@YakirKad
12 Sep 2023
Our Black Hat session is now live on YouTube! 🎩🎥 youtube.com/watch?v=mWgcJxQ7… @GoldmanIlay @BlackHatEvents @AquaSecTeam
2
69
🚨PowerShell Gallery: Security Alert- New Research🚨 The PowerShell Gallery stands as a vital registry for modules and scripts (over 9 Billion downloads). However, it is not as protected as we thought it to be. blog.aquasec.com/powerhell-a… (1/2) 🧵

Active Flaws in PowerShell Gallery Expose Users to Attacks

We expose significant flaws in PowerShell Gallery's policy package names and owners, that open potential supply chain attacks on the registry's user base. 

aquasec.com
1
1
41
In our blog, we delve into Microsoft's lack of protection regarding impersonation of popular packages. Additionally, we explore how attacker's unearth hidden packages, potentially exposing secrets. These flaws were confirmed by Microsoft, but they still persist! (2/2) 🧵
28
Ilay Goldman retweeted
Clint Gibler
@clintgibler
3 Jul 2023
⚔️ GitHub Repositories Vulnerable to RepoJacking Obtaining remote code execution on 37K GitHub repos via RepoJacking: * Exploitation Scenarios * RepoJacking Restrictions and Bypasses * Summary and Mitigations more! By @goldmanilay and @YakirKad blog.aquasec.com/github-data…
1
5
18
1,689
Check out our new blog about repojacking. We show a massive dataset we used and introduce exploitation scenarios using real repoaitories examples
Aqua Security
@AquaSecTeam
21 Jun 2023
Threat Alert! New research by Aqua Nautilus emphasizes the extent of #RepoJacking and exposes potentially millions of vulnerable repositories. Among the repositories found vulnerable to this attack were @Google and @lyft.  Check out the blog here to see the full research recommended mitigations. blog.aquasec.com/github-data… #cloudnativesecurity
1
5
235
Ilay Goldman retweeted
Aqua Security
@AquaSecTeam
30 May 2023
🚨 🚨 The critical chain of vulnerabilities in the widely used Jenkins Server and Update Center have been assigned a score of 9.6, elevating their severity to critical. #CVE Read Aqua Nautilus's research that found these vulnerabilities to understand the impact and what you can do to mitigate your risk. w/@YakirKad and @GoldmanIlay blog.aquasec.com/jenkins-ser…
2
3
394
Load more