Yuval Avrahami ✓

@yuvalavra

Vulnerability research @wiz_io

3 692Followers

442Following

192Posts total

2.1MViews on collected posts

Ultimi post

Yuval Avrahami ✓@yuvalavra15 Jan

@yuvalavra @awscloud Break into someone’s home, straight to jail Break into someone’s servers, “thanks for showing us that” 45.5K views · 594 likes · 8 reposts · 15 replies Open on X →

Yuval Avrahami ✓@yuvalavra15 Jan

We @wiz_io responsibly disclosed this to @AWSSecurityInfo, who promptly fixed the issue in under 48 hours! They also implemented new safeguards in CodeBuild to prevent similar attacks. For the full story, check out our blog >>> https://t.co/T1IHfjy4B8 89.7K views · 1.3K likes · 43 reposts · 19 replies Open on X →

Yuval Avrahami ✓@yuvalavra15 Jan

With our new GitHub account bypassing CodeBuild’s filter, we submitted a pull request, successfully triggering a build running our code! This gave us access to CodeBuild’s GH token - enabling full admin control over the JavaScript SDK repo 🔑💥 https://t.co/qALqKUC937

97.6K views · 539 likes · 7 reposts · 1 replies Open on X →

Yuval Avrahami ✓@yuvalavra15 Jan

With our newfound access, we could now approve PRs, exfiltrate repo secrets, and push code directly to main 👾 The potential blast radius here was massive: not only is the SDK installed in 66% of cloud envs, but it’s used in the heart of the cloud - the AWS Console itself ☁️🤯 htt

90.1K views · 508 likes · 8 reposts · 2 replies Open on X →

Yuval Avrahami ✓@yuvalavra15 Jan

But the regex had a major flaw: it was unanchored ⚓️ Any ID containing a maintainer ID would pass the filter and trigger a build! We found that every ~5 days an eclipse occurs: a new account gets an ID overlapping with a maintainer ID. Raising the question: can we capture it? 🎯

207.3K views · 473 likes · 9 reposts · 6 replies Open on X →

Yuval Avrahami ✓@yuvalavra15 Jan

This was a race condition against the world, with ~2 GH accounts created every second. To win the race, we waited until the live ID count neared our target, and then created hundreds of GH accounts simultaneously. Finally, one of our accounts captured the target ID! 🎉 https://t

GIF

93.6K views · 647 likes · 7 reposts · 4 replies Open on X →

Yuval Avrahami ✓@yuvalavra15 Jan

Following a surge in CI/CD attacks, we decided to scan for public CodeBuild projects, and noticed a strange auth setting in core AWS repos. When verifying if a @GitHub account could trigger a build, it didn’t check for specific account IDs - it matched against a regex filter 🤔 h

112.2K views · 613 likes · 8 reposts · 2 replies Open on X →

Yuval Avrahami ✓@yuvalavra15 Jan

We hacked the AWS JavaScript SDK, a core library powering the entire @AWScloud ecosystem - including the AWS Console itself 🤯 How did we do it? Just two missing characters was all it took. This is the story of #CodeBreach 🧵👇 https://t.co/ba9jqgFrLJ

1.4M views · 7.4K likes · 838 reposts · 160 replies Open on X →

Growth & engagement

How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.

Views per post

1.4M15 Jan

112.2K

93.6K

207.3K

90.1K

97.6K

89.7K

45.5K

Last 8 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.

Engagement rate per post

0.64%15 Jan

0.56%

0.71%

0.24%

0.58%

0.56%

1.49%

1.36%

Reactions — likes, reposts, replies and quotes — divided by views.

What the audience does

Likes69.7%12 025 in total

Reposts5.4%928 in total

Replies1.2%209 in total

Quotes1.4%235 in total

Bookmarks22.3%3 856 in total

Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.

The follower curve appears once this account has two daily snapshots — we take one a day, and this one is on its first.

Ultimi post

Growth & engagement

Views per post

Engagement rate per post

What the audience does

Account simili