Cyber security enthusiast. Ex-Quarkslab Security Researcher. #VulnerabilityResearch in #AppSec #CloudSec
Joined November 2011
- Tweets53
- Following98
- Followers48
- Likes445
Sébastien Rolland retweeted
🏴☠️ I can finally share a VMware 0day I discovered that led to CVE-2026-41702 (LPE as root). Funny enough, I found the bug in my hotel room after the second day of attending Csaba Fitzl (@theevilbit) & Gergely Kalman (@gergely_kalman) training at Zer0con.
therealcoiffeur.com/c111000.…
My new blog post is released. It explains in detail how applications (App Registrations, Service Principals, MI) and their permissions really work, why they can introduce several subtle paths for privilege escalation, and presents my open-source tool designed to uncover them.
Do you know how Entra ID applications work?
What about the security mess they can bring and what they can quietly break?
New blog post on Entra ID application permissions, the audit nightmare they create, and QAZPT, our OSS tool built to make sense of it:
blog.quarkslab.com/auditing-…
ALT Auditing Azure permissions will make your head spin Use the QAZPT, Luke!
Sébastien Rolland retweeted
Do you know how Entra ID applications work?
What about the security mess they can bring and what they can quietly break?
New blog post on Entra ID application permissions, the audit nightmare they create, and QAZPT, our OSS tool built to make sense of it:
blog.quarkslab.com/auditing-…
ALT Auditing Azure permissions will make your head spin Use the QAZPT, Luke!
Sébastien Rolland retweeted
Rise and shine, it's @GrehackConf time! Doors should already be open and at 9:10 we kick off with Nicolas Kovacs and Sébastien Rolland and their talk Google Apps Script: This Talk Requires Access To Your E-mails.
They ain't getting mine...hopefully...
ALT The GreHack logo for this year.
Petition from Mozilla to stop France from forcing browsers censor websites. ☑️
foundation.mozilla.org/en/ca…
Sébastien Rolland retweeted
Currently on stage at @sth4ck , @_cryptocorn_ with her colleague @Mad5quirrel for sharing their research on firmware done for #pwn2own 🤩
#proudfather ❤️
Sébastien Rolland retweeted
After lunch, @_cryptocorn_ and @Mad5quirrel will present at @sth4ck their adventure at @Pwn2Own_Contest and how they tried to break randomness with statistics in less than 5minutes #Sthack23
Sébastien Rolland retweeted
WhatsApp has been using the microphone in the background, while I was asleep and since I woke up at 6AM (and that's just a part of the timeline!) What's going on?
Readers added context they thought people might want to know
WhatsApp has clarified they believe it to be a bug in Android's Privacy Dashboard (twitter.com/WhatsApp/statu…)
Today with @lestutosdenico we presented Google App Script and several different scenarios in order to possibly exfiltrate data from enterprise which use Google Workspace at annual @quarkslab conference; Quarks in the Shell. Was a great day 👌
Nice competition, finished 4th out of 28 team the first day :D
The @EuCyberCup, the first eSport competition dedicated to ethical #hacking during the #FIC2023 (International #Cybersecurity Forum), will start in a few minutes ! Our team is setting up and preparing for these two intense days ! Stay tuned ;-)
Sébastien Rolland retweeted
Microsoft OMI is an open source systems management framework for Linux and UNIX used on-premise and Azure. In this blog post @blindevy and @mtardy_ give a brief introduction to it and tell us how they found some bugs while fuzzing the project. #omi #Azure
blog.quarkslab.com/a-gentle-…
ALT "Many Linux servers controlled by a monkey" by Stable Diffusion, 2023
Another great article of @cryptonitemmk on OCI image specification ;)
Do not get stuck trying to understand container specifications!
Here is a blog post by @cryptonitemmk that dissects the OCI Image Specification with practical examples and hints 😉at why it is Not A Good Idea to leave any secrets in them
blog.quarkslab.com/digging-i…
ALT A container ship stuck in the Suez channel. Not A Good Thing.
Sébastien Rolland retweeted
Our 2022-2023 internship season is open! Looking for a 6-month immersion in a top-notch security research environment? Searching for final answers to "pain au chocolat or chocolatine", "emacs or vi"?
Check out these other important topics & apply soon
blog.quarkslab.com/internshi…
Sébastien Rolland retweeted
A mobile application that send your GPS coordinates regurlaly to a server owned by a government is a surveillance system.
#AarogyaSetu is a surveillance system
Sébastien Rolland retweeted
1/ Le 23 Avril dernier, je vous parlais de StopC19, l'application de contact tracing Française faite en catimini par Orange et Sopra Stéria. Cette application, qui ne verra probablement jamais le jour, n'est pas public. Le monde étant petit, j'ai reçu une version de l'app.
I’m proud to announce that my first discovered vulnerability has been published under CVE-2020-11883. It affects API components of VueStorefront PWA and lead to information disclosure.
