@roinisimi profile picture
Roi Nisimi @roinisimi

I hack stuff for living at @orcasec || Ex 81 & 8200

Joined May 2017
  • Tweets 20
  • Following 109
  • Followers 28
4 Photos and videos
The hackerbot-claw campaign. My take: AI is phenomenal in exploitation. Vulnerability research = craftsmanship, but exploitation? A guidebook trial-n-error loop, which agents excel at. Maybe novel threat detection should flag LLM-generated content? 🤖
1
97
I've discovered a new supply-chain vector through @github Codespaces. It is straightforward and easy to follow.
1
1
44
more replies
I've been able to use these techniques to 1) Gain full repository control 2) Carry XSS via installed Vscode extension 3) Abuse expensive Premium Copilot models 🤖
1
59
If you're using Codespaces in your daily routine, you must be aware of the potential consequences. Full writeup on our blog 👇 orca.security/resources/blog…

Hacking GitHub Codespaces via VS Code Defaults: A Supply-Chain Attack Vector

Orca Research reveals how GitHub Codespaces enables RCE via malicious VS Code configs. Discover how attackers steal secrets and how to secure your pipelines.

orca.security
1
49
Roi Nisimi retweeted
Yoav Alon@yoavalon
17 Sep 2024
🇵🇱 Polish Security Experts! 🛡️ We're hiring a Security Researcher for our R&D team. Work with cutting-edge tech (eBPF, Linux, K8s, Malware analysis) to fight cybercrime! join.onthespotdev.com/runtim… RTs appreciated for reach! 🙏 #CloudSecurity #CybersecJobs #PolishTech

2
3
16
1,657
Roi Nisimi@roinisimi
24 Jan 2024
Super excited to share the stage with @yonatankhen! Feb 7 || 11am eastern time - Join us
Team Axon@team__axon
22 Jan 2024
After uncovering the #DeleFriend Google Workspace design flaw, it's time to protect against it. Join threat researchers @yonatankhen (Axon) and @roinisimi (@orcasec) as they join forces to demonstrate how to detect and prevent an attack Register here: hubs.li/Q02hgydx0
1
111
Roi Nisimi retweeted
Deborah Galea@deborah_galea
18 Jul 2023
Cloud Threat Researcher @roinisimi from @Orcasec discovered a critical design flaw in the #GoogleCloud Build service that creates a significant #supplychainrisk. orca.security/resources/blog…
3
2
228
Roi Nisimi retweeted
SecurityWeek
@SecurityWeek
11 Apr 2023
Microsoft Azure Users Warned of Potential Shared Key Authorization Abuse securityweek.com/microsoft-a…

Microsoft Azure Users Warned of Potential Shared Key Authorization Abuse

Microsoft Azure shared key authorization can be exploited to access business data and achieve remote code execution.

securityweek.com
1
4
5
2,253
Roi Nisimi retweeted
The Register
@TheRegister
11 Apr 2023
Azure admins warned to disable shared key access as backdoor attack detailed reg.cx/486G?utm_source=twitt…
7
13
4,516
Roi Nisimi retweeted
The Hacker News
@TheHackersNews
11 Apr 2023
🛡️ New flaw in #Microsoft Azure Uncovered! Hackers could exploit this weakness to gain access to storage accounts, move laterally and execute remote code 🕵️‍♂️ 📰 Learn about this "by-design flaw" & how to protect your data: thehackernews.com/2023/04/ne… #CyberSecurity #DataSecurity
38
64
26,527
Roi Nisimi retweeted
Deborah Galea@deborah_galea
13 Apr 2023
Microsoft To Tighten Azure Storage Default Permissions after @Orcasec discovery -- Redmondmag.com redmondmag.com/articles/2023…
1
1
127
Roi Nisimi@roinisimi
13 Apr 2023
Hi #twitter Published on Tuesday, my research and our blog at @orcasec was featured on @TheHackersNews, @TheRegister, @thecyberwire, Redmondmag.com and much more. Thanks for covering this. Getting this final result together with @msftsecresponse was a great pleasure.

Orca Security@orcasec
11 Apr 2023
Our team of researchers continually push the limits to find #securityrisks before bad actors do.🔎 Learn how we discovered a critical exploitation path, utilizing Microsoft #Azure shared key authorization, and how to mitigate this: tryorca.co/43j5hrl
3
377
Load more