Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Ori David
Cryptominers’ Anatomy: Analyzing Cryptominers
In the following case studies, we will cover some of the cryptominer samples we identified in the wild. This is the second installment of our three-part blog series called Cryptominers’ Anatomy. In part one, we discussed cryptocurrencies in general, their various attributes, and what makes some of them more attractive than others for threat actors. In this part, we’ll dive into the analysis of various cryptominer samples to understand their inner cogs and gears.
Detecting and Mitigating the Apache Camel Vulnerability CVE-2025-27636
The vulnerability is trivial to exploit and could lead to devastating results, including remote code execution. On March 9, 2025, Apache Camel disclosed CVE-2025–27636, a vulnerability that stems from incorrect filtering of request headers that can lead to remote code execution. This vulnerability lies in a library, creating both direct and indirect dependency and complicating detection and mitigation.
The Year in Review 2024: Today’s Insights, Tomorrow’s Outlook
For 10 years, Akamai has published State of the Internet (SOTI) reports — in-depth analyses of the latest cybersecurity research and trends. These reports provide valuable insights into the evolving threat landscape and cybersecurity challenges faced by organizations worldwide.
Battling the Emotional Toxicity Within Games: How to Digitally Thrive
Since we slant toward pessimism naturally, those of us raised without a feeling of safety experience a particularly bleak version of reality. We begin to believe our judgments (which are inherently personal and subjective) are objective truths — and act accordingly. You may believe that if someone is a “bad” person, they deserve to be treated poorly. If you believe every person is bad, then everyone is an enemy.
Akamai’s Perspective on November’s Patch Tuesday 2024
The CVE notes mention that the MSHTML platform was the affected component, so that’s what we’ll focus on. MSHTML is a web page renderer for the Windows operating system. It exposes a Component Object Model (COM) interface to allow programs to add web-rendering capabilities. It is used by Internet Explorer, Microsoft Edge’s Internet Explorer mode, Microsoft Outlook, and various other programs.
Akamai’s Perspective on August’s Patch Tuesday 2024
The TCP/IP stack in Windows is a core component of the operating system's networking functionality. It handles the transport of data across networks using the TCP/IP protocol suite, which is the foundation of communication over the internet and most local networks. In the Windows operating system, the TCP/IP stack is implemented in tcpip.sys driver. This kernel module is responsible for handling network protocols, including TCP over transport layers such as IPv4 and IPv6.
Git-Syncing into Trouble: Exploring Command Injection Flaws in Kubernetes
This design flaw can cause either data exfiltration of any file in the pod (including service account tokens) or command execution with the git_sync user privileges. To exploit the flaw, all an attacker needs to do is apply a YAML file on the cluster, which is a low-privilege operation.
Improving Apache httpd Protections Proactively with Orange Tsai of DEVCORE
CVE-2024-38472 — Apache HTTP Server on Windows UNC SSRF CVE-2024-39573 — Apache HTTP Server: mod_rewrite proxy handler substitution CVE-2024-38477 — Apache HTTP Server: Crash resulting in denial of service in mod_proxy via a malicious request CVE-2024-38476 — Apache HTTP Server may use exploitable/malicious back-end application output to run local handlers via internal redirect CVE-2024-38475 — Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem...
XZ Utils Backdoor — Everything You Need to Know, and What You Can Do | Akamai
CVE-2024-3094 is a vulnerability discovered in the open-source library XZ Utils that stems from malicious code that was pushed into the library by one of its maintainers. CVE-2024-3094 is a vulnerability discovered in the open-source library XZ Utils that stems from malicious code that was pushed into the library by one of its maintainers.
Observed Scanning Activity for CVE-2024-22024 - XXE Vulnerability in Ivanti Products
Over the last few weeks, Ivanti has disclosed numerous critical CVEs. The most recent — CVE-2024-22024 — is no different. Although it does not have as high a CVSS score as previous vulnerabilities, CVE-2024-22024 will still likely be a prime target for attackers. On February 8, 2024, Ivanti published an advisory for CVE-2024-22024. Ivanti originally reported that this flaw was discovered during internal testing.
You Had Me at Hi — Mirai-Based NoaBot Makes an Appearance | Akamai
We can see there are some other function calls before the function call to build the XMRig configuration. If it fails, the miner terminates, but otherwise it goes to the standard XMRig miner logic. (You can compare the decompilation above to the actual XMRig source code.) Why do we as researchers care about the XMRig configuration? Usually, it contains details about the mining pool it connects to, as well as the wallet address to receive mining payments.
Safeguarding Patient Health Data Means Balancing Access and Security
No patient wants to receive a healthcare data breach message, and no physician or payer wants to send one. Yet, in 2023, the number of such breaches has more than doubled compared with 2022, and it’s predicted that the number will continue to increase in 2024. The proliferation of digital health tools during the pandemic and the implementation of the 21st Century Cures Act give patients access to and ownership of their own health information for the first time.
Weaponizing DHCP DNS Spoofing — A Hands-On Guide | Akamai
Introduction In the first part of this blog series we introduced a new set of attacks against Active Directory domains that use Microsoft Dynamic Host Configuration Protocol (DHCP) servers. These attacks enable threat actors to spoof DNS records in Active Directory Integrated DNS (ADIDNS) zones by abusing the DHCP DNS Dynamic Updates feature. We explored the feature’s operation and highlighted misconfigurations that could be abused by attackers to spoof sensitive DNS records.
Spoofing DNS Records by Abusing DHCP DNS Dynamic Updates
Akamai researchers discovered a new set of attacks against Active Directory domains that use Microsoft Dynamic Host Configuration Protocol (DHCP) servers. These attacks could allow attackers to spoof sensitive DNS records, resulting in varying consequences from credential theft to full Active Directory domain compromise. The attacks don't require any credentials, and work with the default configuration of Microsoft DHCP server. The number of impacted organizations can be significant.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Ori
Contact Ori, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack