Founder & CTO of @DeepSurfaceSec 15 years helping others fix their code. Now fixing the brokenness of vuln management. Opinions are often strong and are my own.
Portland, Oregon
Joined August 2013
- Tweets565
- Following107
- Followers598
- Likes297
Timothy D. Morgan retweeted
Learn more on @Lansweeper’s blog ( lansweeper.com/blog/partners… ), our blog ( deepsurface.com/essential-it… ), or get started now by visiting the Lansweeper - DeepSurface Integration Page ( deepsurface.com/lansweeper-i… ).
2/2
Timothy D. Morgan retweeted
#DeepSurface is thrilled to announce our new Integration Partnership with Lansweeper!
Together we are pushing the boundaries of visibility– giving you a complete view of your assets AND where your #cybersecurity risk really exists.
1/2 🧵
Timothy D. Morgan retweeted
Coming up next on #DRNewsDesk Tim Morgan @DeepSurfaceSec @ecbftw on DeepSurface Adds Risk-Based Approach to Vulnerability Management darkreading.com/DRNewsDesk #bhusa
Timothy D. Morgan retweeted
As mentioned in the blog post, the technique is from @ecbftw in 2013. The old is new again. 2013.appsecusa.org/2013/wp-c…
Timothy D. Morgan retweeted
Check out a recent finding by one of our own, Naveen Sunkavally. CVE-2022-28219 is an unauth RCE for ManageEngine ADAudit Plus.
This XXE -> Deserialization chain often leads to host compromise as well as priv'd AD creds. Check out the blog post and POC: horizon3.ai/red-team-blog-cv…
Timothy D. Morgan retweeted
OWASP's example implementation of check_private_ip() is quite naive. It can be bypassed with 0x7f.0.0.1 #SSRF cheatsheetseries.owasp.org/c…
Timothy D. Morgan retweeted
We’re thrilled to announce our latest $4.5 million #seedfunding. Learn how we’re accelerating product development of our award-winning #vulnerability and risk management platform today #cybersecurity #automation bit.ly/3so2XO5
Timothy D. Morgan retweeted
It’s 2022, and the fix is still “disable the anti malware agent”.
Don’t ever change, infosec/AV industry.
This Post is from an account that no longer exists. Learn more
Timothy D. Morgan retweeted
#Log4J Worm is ITW
@vxunderground has a sample of the self propagating worm using log4j as a vector.
It installs a Mirai bot which makes sense to targeting embedded Linux devices
Looks like it uses user-agent for exploitation and modifies the binary before sending (?)
Timothy D. Morgan retweeted
If you're looking to identify jars vulnerable to the log4j bug, we wrote this tool to help: github.com/yahoo/check-log4j
Timothy D. Morgan retweeted
TIL that http://unix:/var/run/docker.sock:/containers/json is a valid URL for got, the "Human-friendly and powerful HTTP request library for Node.js" 🤯
Timothy D. Morgan retweeted
log4shell: Datadog agent is Go but uses Java jmxfetch to retrieve JVM info. Source code: github.com/DataDog/jmxfetch/… jmxfetch likes to log! but at least it looks difficult for attackers to control the input if they are not already in a privileged position.
Timothy D. Morgan retweeted
The $124B a year spent on InfoSec is the interest only premium on ~30 years of accumlated IT technical debt.
Timothy D. Morgan retweeted
"New Relic has released Java agents 6.5.1 and 7.4.1 to address a critical vulnerability in the open source log4j framework" log4shell docs.newrelic.com/docs/secur…
Timothy D. Morgan retweeted
If you identify a vendor vulnerable to log4Shell and they are not on this list; make a pull request. You'll save some tears from blue teams and IT all over the world:
gist.github.com/SwitHak/b66d…
Not all heroes wear capes...
Timothy D. Morgan retweeted
Diagrams for the #Log4j #Log4Shell that can help people discuss things. Hope this helps...
Timothy D. Morgan retweeted
I should have known Microsoft doesn’t pay. I will sell it to ZDI next time :)
Timothy D. Morgan retweeted
Apache Log4j2 2.14.1 RCE (CVE-2021-44228)
69 CnC Server List is here
->
pastebin.com/BLVG1APM
Timothy D. Morgan retweeted
#log4j Update:
IF YOU WERE DEPENDING ON JAVA VERSIONS TO PROTECT YOU FROM RCE INSTEAD OF DIRECTLY PATCHING LOG4J THAT IS NO LONGER A VIABLE MITIGATION STRATEGY
*ALL* VERSIONS OF JAVA CAN NOW TRIGGER FULL RCE DUE TO A BYPASS
PATCH LOG4J ASAP
teapawt.net/wdormann/status/147040…
Timothy D. Morgan retweeted
Did you know that a normal LED can also receive light? 🚨
It can! In this paper, we point a laser at build-in LEDs of offices devices and transmit data to their firmware. This covert communication can bridge 25m with a throughput of 128 kbps.
intellisec.de/pubs/2021-acsa… 1/3
