Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Ben Barnea
Detecting and Mitigating the Apache Camel Vulnerability CVE-2025-27636
The vulnerability is trivial to exploit and could lead to devastating results, including remote code execution. On March 9, 2025, Apache Camel disclosed CVE-2025–27636, a vulnerability that stems from incorrect filtering of request headers that can lead to remote code execution. This vulnerability lies in a library, creating both direct and indirect dependency and complicating detection and mitigation.
Abusing VBS Enclaves to Create Evasive Malware
Virtualization-based security (VBS) is one of the most fascinating recent security advancements. The ability to isolate critical components of the OS has enabled Microsoft to achieve substantial security improvements with features like Credential Guard and Hypervisor-Protected Code Integrity (HVCI).
Arming the Defenders: A SOTI Report for Those Who Protect the Enterprise
The goal is simple: To arm you with the real-world strategies you need to safeguard your systems. Hats off to the defenders. First-line cybersecurity defenders must simultaneously monitor emerging threats, master new defensive technologies, absorb constant research updates, and recognize old threats in new forms — all while maintaining 24/7 vigilance over an organizations' digital assets.
RedTail Cryptominer Threat Actors Adopt PAN-OS CVE-2024-3400 Exploit
Expanded arsenal: Threat actors behind the RedTail cryptomining malware, initially reported in early 2024, have incorporated the recent Palo Alto PAN-OS CVE-2024-3400 vulnerability into their toolkit. Private cryptomining pools: The attackers have taken a step forward by employing private cryptomining pools for greater control over mining outcomes despite the increased operational and financial costs. This mirrors tactics used by the Lazarus group, leading to speculation about attack attribution.
Akamai’s Perspective on May’s Patch Tuesday 2024
In our observations, we’ve seen that approximately 30% of environments had at least one machine with a SharePoint server installed on it. We only have one Star Wars Day a year, but 12 Patch Tuesdays, which is a terrible ratio if you ask me… Anyway, this May’s update contains 59 CVEs, only one of them critical (in Microsoft SharePoint Server), but it also includes patches for two vulnerabilities found in the wild.
Phishing Campaigns Targeting USPS See as Much Web Traffic as the USPS Itself
We began our journey by having a friendly chat with our internal SecOps team. They fetched for us a list of domains that were using the same (confirmed malicious) JavaScript file hashes as the one we saw in our team member’s smishing text message. The SecOps team also sent us a list of domain names for which the HTML was showing the same pattern as the one in the example text message. Thanks to them we now have a list of domain names that are malicious, at the very least.
Safeguarding Patient Health Data Means Balancing Access and Security
No patient wants to receive a healthcare data breach message, and no physician or payer wants to send one. Yet, in 2023, the number of such breaches has more than doubled compared with 2022, and it’s predicted that the number will continue to increase in 2024. The proliferation of digital health tools during the pandemic and the implementation of the 21st Century Cures Act give patients access to and ownership of their own health information for the first time.
Weaponizing DHCP DNS Spoofing — A Hands-On Guide | Akamai
Introduction In the first part of this blog series we introduced a new set of attacks against Active Directory domains that use Microsoft Dynamic Host Configuration Protocol (DHCP) servers. These attacks enable threat actors to spoof DNS records in Active Directory Integrated DNS (ADIDNS) zones by abusing the DHCP DNS Dynamic Updates feature. We explored the feature’s operation and highlighted misconfigurations that could be abused by attackers to spoof sensitive DNS records.
Novel Detection of Process Injection Using Network Anomalies
How much data is enough to draw conclusions? Let’s imagine you see a specific process running on seven machines, making all connections using HTTPS to a specific web server. Will you be able to conclude that the same process should never use any other form of communication? Probably not. To decide on how much data per process is enough to rely on, we take each process-and-port group pair, and count the number of networks we’ve seen it in.
Mute the Sound: Chaining Vulnerabilities to Achieve RCE on Outlook: Pt 1
Akamai researcher Ben Barnea found two vulnerabilities in Microsoft Windows, which were assigned CVE-2023-35384 and CVE-2023-36710. An attacker on the internet can chain the vulnerabilities together to create a full, zero-click remote code execution (RCE) exploit against Outlook clients. The first vulnerability lies in the parsing of a path by the MapUrlToZone function.
Mute the Sound: Chaining Vulnerabilities to Achieve RCE on Outlook: Pt 2
Audio signal processing basics Before diving into the code, let's familiarize ourselves with some of the basics of audio signal processing. If you’re already familiar with these concepts, feel free to skip to the next section. When we hear sound, what we actually hear is vibration that propagates through a transmission medium. Sound is the reception of those vibration waves as picked up by our ears and perceived by our brain. An audio signal is a continuous waveform.
A QUIC Shutdown: DoS Vulnerability in Windows Servers Running SMB over QUIC
Executive summary Akamai researcher Ben Barnea found an important vulnerability in Microsoft Windows Server 2022, which was assigned CVE-2023-24898 with a base score of 7.5. The vulnerability lies in a missing check in a buffer allocation in the srvnet.sys driver. The vulnerability may lead to remote denial-of-service (DoS) attacks against Windows Server 2022 machines. The vulnerability can be triggered by an unauthenticated attacker over the internet.
Exploring Three Remote Code Execution Vulnerabilities in RPC Runtime | Akamai
Akamai researcher Ben Barnea found three important vulnerabilities in Microsoft Windows RPC runtime that were assigned CVE-2023-24869, CVE-2023-24908, and CVE-2023-23405, all with a base score of 8.1. The vulnerabilities can lead to remote code execution. Since the RPC runtime library is loaded into all RPC servers, and these are commonly used by Windows services, all Windows versions (Desktop and Server) are affected.
From One Vulnerability to Another: Outlook Patch Analysis Reveals Important Flaw in Windows API
Among the vulnerabilities addressed as part of March 2023 Patch Tuesday was a critical Outlook vulnerability assigned CVE-2023-23397. The vulnerability allows an attacker to coerce an Outlook client to connect to the attacker’s server. By doing so, the client sends NTLM credentials to the machine, which allows the attacker to crack the password offline, or to use it in a relay attack. This vulnerability can be exploited remotely over the internet without any user interaction (zero-click).
You’ve Crossed the Line — Disturbing a Host’s Rest | Akamai
Introduction Akamai Security Research dove deeply into MS-RPC research this past year. For a protocol that does so much, MS-RPC is largely under-researched, and it can have real-world effects. One of those effects is that vulnerabilities in an RPC interface become exposed. This is what we are focusing on in this blog post: vulnerabilities within the Local Session Manager (LSM) RPC interface. LSM is a service that is part of the Session Manager Subsystem.
Critical Remote Code Execution Vulnerabilities in Windows RPC Runtime
Written by Ben Barnea and Ophir Harpaz April 13, 2022 Microsoft’s April 2022 Patch Tuesday introduced patches to more than a hundred new vulnerabilities in various components.
FritzFrog: P2P Botnet Hops Back on the Scene
Written by Ben Barnea, Shiran Guez, Ophir Harpaz February 10, 2022 Executive summary FritzFrog is a peer-to-peer botnet campaign uncovered by Guardicore Labs (now Akamai Threat Labs) in August 2020 The decentralized botnet targets any device that exposes an SSH server — cloud instances, data center servers, routers, etc.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Ben
Contact Ben, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack