“Idan was a student in my International Business Communications course. He came with a lot of skills and personality traits that I push for, but was motivated to fine tune and improve - which he did. His soft skills are great and I am confident and happy to be able to recommend him.”
Activity
-
Imagine deleting an S3 bucket and unknowingly leaving the door open for an attacker to gain control of your #AWS account. 😱 Aqua Nautilus…
Imagine deleting an S3 bucket and unknowingly leaving the door open for an attacker to gain control of your #AWS account. 😱 Aqua Nautilus…
Liked by Idan Revivo
-
If you’re looking to dive deep into understanding Linux malware behavior, I highly recommend the PurpleLabs Linux Attack, Detection, and Live…
If you’re looking to dive deep into understanding Linux malware behavior, I highly recommend the PurpleLabs Linux Attack, Detection, and Live…
Shared by Idan Revivo
-
בתמונה הזו משנת 1994, ביל גייטס הצעיר מדגים את כמות המידע שניתן לדחוס בדיסק סי די רום אחד, בהשוואה לכמות הנייר הנדרשת על מנת להדפיס אותו. - הצילום…
בתמונה הזו משנת 1994, ביל גייטס הצעיר מדגים את כמות המידע שניתן לדחוס בדיסק סי די רום אחד, בהשוואה לכמות הנייר הנדרשת על מנת להדפיס אותו. - הצילום…
Liked by Idan Revivo
Experience & Education
-
Aqua Security
View Idan’s full experience
See their title, tenure and more.
or
Licenses & Certifications
Publications
-
Crypto-Mining Malware Outsmarting Image Scanners
Aqua Security
See publicationIn previous crypto-mining attacks, we observed hackers investing little to no effort in hiding their malicious activities. They just ran the malicious container with all of its scripts and configuration files in clear text. This made the analysis of their malicious intent fairly easy.
One such cryptocurrency-mining attack was previously identified, with a malicious container image that was pulled from a public Docker Hub repository named zoolu2. It contained a number of images including…In previous crypto-mining attacks, we observed hackers investing little to no effort in hiding their malicious activities. They just ran the malicious container with all of its scripts and configuration files in clear text. This made the analysis of their malicious intent fairly easy.
One such cryptocurrency-mining attack was previously identified, with a malicious container image that was pulled from a public Docker Hub repository named zoolu2. It contained a number of images including Shodan and cryptocurrency-mining software binaries. The containers were being deployed as miners. -
Man in the Binder: He Who Controls IPC, Controls the Droid
Black Hat Europe 2014
Big Brother is watching your droid. His name is Binder.
As the only vehicle of IPC in Android, Binder is the system component that makes the operating system tick. A process running in a typical OS will hold dozens of handles to the system's hardware: hard disk, display adapter, network card, and many more. Android's unique architecture, on the contrary, means that a process will achieve the same tasks just by grabbing a file descriptor to the Binder device - greatly minimizing the…Big Brother is watching your droid. His name is Binder.
As the only vehicle of IPC in Android, Binder is the system component that makes the operating system tick. A process running in a typical OS will hold dozens of handles to the system's hardware: hard disk, display adapter, network card, and many more. Android's unique architecture, on the contrary, means that a process will achieve the same tasks just by grabbing a file descriptor to the Binder device - greatly minimizing the attack surface against the kernel. As the god of IPC in Android, Binder controls an application's interaction with just about anything.
From that perspective, it becomes immediately apparent that this system component is a prime target for any Android malware. By controlling any single link in the long chain which leads down from the Java APIs to the native Binder code, an attacker could stealthily implement a keylogger, set up VNC-like functionality, modify sensitive data in transit, and do many other evil deeds.
In this presentation, we will showcase a POC rootkit which provides a basis for all of the above, and more. We will also give a comprehensive overview of Binder at the lowest level. We'll talk about how the data transport buffers are actually constructed, what gets sent down to the kernel, and what comes back up. We believe this is an important contribution to the security community: Binder has simply not been researched enough.Other authors -
Patents
-
System and method for container assessment using sandboxing
US20210312037A1
An example method for a software container includes instantiating the following in a sandbox of a computing device: an operating system, a Berkeley Packet Filter (BPF) virtual machine within a kernel of the operating system, and a software container. The kernel monitors runtime behavior events of the software container, with the monitoring at least partially performed by the BPF virtual machine. Based on the monitoring, a respective risk score is assigned to each of the runtime behavior events…
An example method for a software container includes instantiating the following in a sandbox of a computing device: an operating system, a Berkeley Packet Filter (BPF) virtual machine within a kernel of the operating system, and a software container. The kernel monitors runtime behavior events of the software container, with the monitoring at least partially performed by the BPF virtual machine. Based on the monitoring, a respective risk score is assigned to each of the runtime behavior events that is potentially malicious, with each risk score indicating a likelihood that a corresponding behavior event is malicious. An overall risk score is assigned to the software container that indicates a likelihood that the software container is malicious based on the respective risk scores.
Other inventors -
Courses
-
SyScan'15 Training - Android Security Training
ST1531
-
Technologeeks - Android Internals
-
-
Technologeeks - OS X and iOS Internals - The Reverse Engineer's Perspective
-
Projects
-
Contributor to Mitre Framework
- Present
Containers Matrix
tactics and techniques representing the MITRE ATT&CK® Matrix for Enterprise covering techniques against container technologies. The Matrix contains information for the Containers platform -
Tracee
Linux Runtime Security and Forensics using eBPF
-
CuckooDroid - Automated Android Malware Analysis Framework
Presented at Black Hat Asia: To combat the growing problem of Android malware, we present a new solution based on the popular open source framework Cuckoo Sandbox to automate the malware investigation process. Our extension enables the use of Cuckoo's features to analyze Android malware and provides new functionality for dynamic and static analysis.
Other creators -
-
Cuckoo Android Extension
This is an a extension for Cuckoo Sandbox to Support Android arm Emulator.
Other creators -
-
Presentation for Black Hat: Subverting the Android IPC Framework
See projectPresented at Black Hat Europe: In a journey into Android's internals, we demonstrated how to build a rootkit that will give an attacker near-total control over a device and the user's private data, simply by hooking a single system component.
-
Smart Fitness Trainer
The smart personal trainer developed in this project provides an innovative and simple solution to a need that as of today, has yet to be addressed in the market. As appears in chapter five's description of the project's definition document that is attached as a sixth expansion document for this report – survey of the existing status.
The system provides the trainees an efficient fitness training in an available and convenient manner, without any dependency in the availability of…The smart personal trainer developed in this project provides an innovative and simple solution to a need that as of today, has yet to be addressed in the market. As appears in chapter five's description of the project's definition document that is attached as a sixth expansion document for this report – survey of the existing status.
The system provides the trainees an efficient fitness training in an available and convenient manner, without any dependency in the availability of another person or the gym. The main feature of the system is to maximize the level of the training session. The system tracks the trainee's movements, analyses them and provides feedback for his or her performance.
The system is a software that allows the user to choose a training exercise, and provides a matching visual demonstration of the exercise. In the next stage the system analyses the user's movements using the Kinect motion sensor. In the end of the process the system provides feedback for the user's performance. Additionally, the system saves the data to allow tracking of the user's progress.
Honors & Awards
-
2023 SC Awards Finalist: Innovator of the Year
SC Magazine
Languages
-
English
-
-
Hebrew
-
Recommendations received
1 person has recommended Idan
Join now to viewMore activity by Idan
-
⚠️ Threat alert! Aqua Nautilus researchers have uncovered a new variant of the Gafgyt botnet that’s actively exploiting GPU power to breach cloud…
⚠️ Threat alert! Aqua Nautilus researchers have uncovered a new variant of the Gafgyt botnet that’s actively exploiting GPU power to breach cloud…
Liked by Idan Revivo
-
During Black Hat, Yakir Kadkoda and Mor Weinberger from Aqua Security gave an arsenal presentation on their work exploring how to gain earlier…
During Black Hat, Yakir Kadkoda and Mor Weinberger from Aqua Security gave an arsenal presentation on their work exploring how to gain earlier…
Liked by Idan Revivo
Other similar profiles
Explore more posts
Explore collaborative articles
We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.
Explore More