SentinelOne Blog

SentinelOne | Backend Developers | Remote (US) | Full-Time | https://sentinelone.com After the successful launch of the new Singularity Marketplace, I am looking for an engineer to join our small Apps engineering team in the United States. We want somebody that has been in the trenches working with medium/big systems, loves functional programming (even if is afraid to say that loudly) and has a solid API background. You’ll be working with a variety of partners and their APIs to supercharge SentinelOne’s threat analysis and detonation. Sometimes we’ll be dealing with nice OpenAPI files, semantic status codes and structured error responses; sometimes the documentation is an email, every API call returns 200 (even if an entire server farm has just crashed) and payloads are so nested that you’ll need a GPS to figure out where you are. Are you up for the challenge? If you: * Have experience with functional programming languages (Clojure, Haskell) or strong desire to learn * Have experience with Node and TypeScript or strong desire to learn * Have experience in designing and implementing (real) RESTful APIs * Have used and survived other people’s API …and you’re interested in * Designing and implementing public APIs for external users * Build and maintain user SDKs in different languages Then please email me at vncz at SentinelOne.com and let's chat.

Props to https://www.sentinelone.com/labs/macos-nimdoor-dprk-threat-actors-targ… for analyzing the hack in great detail.

Original source: https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-a… (https://news.ycombinator.com/item?id=44227755)

It's checking for certificate status, not so much phoning home. To my knowledge, it is only sending some hashes to Apple. It is not sending any personal data. Here is a good write-up on the issue: https://www.sentinelone.com/blog/what-happened-to-my-mac-apples-ocsp-a… I recommend that people not block oscp.apple.com as it has security benefits. If your threat model dictates blocking oscp.apple.com then you probably should not even be running macOS (or Windows).

My understanding is XProtect works off signatures and only for data coming in from certain pathways (registered quarantine agents, chrome/safari etc). This doesn't protect against using a vulnerability in an app (chrome/safari) to trigger another process to download a malicious payload. Being signature based instead of behavior based limits it's ability to detect evolving attacks. The following seems to be a good overview of a specific attack bypassing xprotect. https://www.sentinelone.com/blog/how-malware-bypass-macos-gatekeeper/

> Little Snitch is a malware vector, pretty much like PC "antivirus" software. Is that because the Little Snitch network capture parser can be exploited by magic/malformed network packets to gain kernel privileges? Are there known exploits that were previously patched? Do you recommend any alternative Mac firewall which doesn't have this problem? Can the native firewall perform outbound packet filtering? Edit: https://www.sentinelone.com/blog/shut-snitch-reverse-engineering-explo… (2016)

> Desktop/laptop malware scanners notoriously use up CPU at murphaicly inconvenient moments. This isn't true at all. Sure for many "traditional" AV solutions it might be. But there is a pretty strong growing trend to use "next-gen" endpoint/AV protection that is extremely lightweight, so much so that users won't see any impact at all. https://www.sentinelone.com/ https://www.crowdstrike.com/ https://www.carbonblack.com/

Yup, that seems likely. Their whole shtick is that signature based checks don't cut it and that their behavior based system is the way to go. https://en.wikipedia.org/wiki/SentinelOne#Technology https://www.sentinelone.com

OK, so then you talked to someone at Netflix, and they said, what, "umm... well, we just replaced our anti-virus product with this other thing called SentinelOne that isn't really an anti-virus product", and then you looked at their site and called them and decided they totally weren't an anti-virus product? And that the real story here was that this was the death knell for anti-virus, or the beginning of "post-AV anti-malware", or something? Clearly you have technical chops. But the most technical part of your article, concerning whatever technology somehow separates this product from the rest of the industry (let alone makes it "not anti-virus"), is this single line: "Its end-point security doesn’t rely on signatures, it monitors every process on a device to check for irregularities and does not perform on-system scans or require massive updates like anti-virus..." If SentinelOne is doing something truly new, something that merits coverage from tech journalists, it would be nice to read about it. And btw, you said earlier, "When I contacted SentinelOne after the interview they said they couldn't even go on the record about the Netflix contract", which is an odd thing for them to have told you, since they have a Netflix logo and an official statement from them under the testimonials section of http://www.sentinelone.com/?show_epp=true -- wait a minute, in fact the quote from your article is a word-for-word match for the testimonial on SentinelOne's site: "The direction…

Malicious servers can send malicious terminal escape codes. For example https://www.sentinelone.com/vulnerability-database/cve-2026-41253/

fwiw, the firefox vulnerability seems to be CVE-2026-10702 (type confusion in the ionmonkey jit compiler): https://www.sentinelone.com/vulnerability-database/cve-2026-10702/

From the linked source code [0], the vulnerabilities are: CVE-2026-10702 [1]: A crafted JavaScript payload can trigger JIT miscompilation in Firefox versions prior to 151.0.3, leading to type confusion and potential renderer crashes or memory corruption. CVE-2026-43499 [2]: When the kernel's real-time mutex (rtmutex) component performs a specific operation called 'proxy-lock rollback' during futex requeue, it incorrectly handles task pointers. This can lead to a 'Use-After-Free' (UAF) vulnerability, where the system attempts to use memory that has already been released. A local attacker could potentially exploit this to gain elevated privileges or execute unauthorized code. 0: https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack 1: https://www.sentinelone.com/vulnerability-database/cve-2026-10702/ 2: https://access.redhat.com/security/cve/cve-2026-43499

A couple of posts on how to use LD_AUDIT; Leveraging LD_AUDIT to Beat the Traditional Linux Library Preloading Technique - https://www.sentinelone.com/labs/leveraging-ld_audit-to-beat-the-tradi… rtld-audit and LD_AUDIT - https://vsoch.github.io/2021/ldaudit/

CVE-2021-21703 [0] is a similar class of bug in the PHP interpreter itself that was pretty recent https://www.sentinelone.com/vulnerability-database/cve-2021-21703/

These are very clearly vulnerabilities in the normal sense of the word, and if a security bug means that an app that was supposed to be only accessible to the creator is open to the world that's still quite bad (though the blast radius is small). If you limit to vulnerabilities that get CVEs, however, https://vibe-radar-ten.vercel.app has 34 in March alone including https://www.sentinelone.com/vulnerability-database/cve-2025-55526/

The submitted article appears to be an LLM summary of https://www.sentinelone.com/labs/fast16-mystery-shadowbrokers-referenc…

The _really_ fun bucket squatting attacks are when the cloud providers themselves use deterministic names for "scratch space" buckets. There was a good DC talk about it at DC32 for AWS, although actual squatting was tough because there was a hash they researchers couldn't reverse (but was consistent for a given account?): https://www.youtube.com/watch?v=m9QVfYVJ7R8 GCP, however, has does this to itself multiple times because they rely so heavily on project-id, most recently just this February: https://www.sentinelone.com/vulnerability-database/cve-2026-1727/

FileZilla author was caught red handed, shipping app with IronCore adware downloader, aka installCore from ironSource: https://www.sentinelone.com/blog/osx-ironcore-a-or-what-we-know-about-… As IronCore evolved, it eventually got packed — `+[obj load]` executed prior to entry point — and provided a JavaScript to Objective-C bridge. JS payloads were remotely downloaded and AES encrypted... While offers were the usual suspects back then (Advanced Mac Cleaner, MacKeeper, and a customized Chromium app), the technique could be abused in a couple of ways so to spy on specific targets. Anyhow, I don't know what you do with FZ, I am very much into rsync (OSS) and Transmit app (Panic).

https://archive.is/JGQah Original title which was too long to post, so it was edited for length: > Patents by Silk Typhoon-linked company shed light on Beijing’s offensive hacking capabilities The report, because it wasn’t linked in TFA: https://www.sentinelone.com/labs/chinas-covert-capabilities-silk-spun-… | https://archive.is/TEgpp

My problem is running post install step of 100+ npm packages on my machine. Any of those could be malicious. https://www.sentinelone.com/blog/unseen-threats-in-software-developmen…

We're all very impressed that you're such a 1337 h4x0r that you run Arch Linux and not Windo$e. See also https://www.sentinelone.com/blog/macos-notlockbit-evolving-ransomware-… and https://blog.sekoia.io/helldown-ransomware-an-overview-of-this-emergin…

SentinelOne is hiring for a lot of roles in Distributed Systems, Cybersecurity, and AI. I think a lot of folks on here would be a fit. https://www.sentinelone.com/jobs/

Even with the Epic situation, I'm surprised to see Apple buddying up with Unity after they've merged with a company that used to make Mac-targeted fake "Update Flash Player" adware installers. https://www.sentinelone.com/blog/osx-ironcore-a-or-what-we-know-about-… https://techcrunch.com/2022/11/07/unity-and-ironsources-4-4b-merger-is…

"Real world attacks (e.g., XCSSET) and researchers have consistently shown that TCC, while often a nuisance to users, does not present a significant obstacle to attackers." https://www.sentinelone.com/blog/session-cookies-keychains-ssh-keys-an…

Depends on your definition of big, but there is a multi-billion dollar Cyber insurance industry: https://www.sentinelone.com/blog/cyber-insurance-victims-insurers-figh… https://www.hiscox.co.uk/business-insurance/cyber-and-data-insurance/f… https://www.pwc.nl/en/industries/insurers/cybercrime-in-insurance.html

Here's a demonstration of some example attacks using pdf: executing arbitrary js, and connecting to a samba server: https://www.sentinelone.com/blog/malicious-pdfs-revealing-techniques-b… I'm not sure about this attack specifically, though, and in Ronin's post mortem they aren't really talking about that: https://roninblockchain.substack.com/p/back-to-building-ronin-security… To some extent, the PDF viewer/OS doesn't matter. A dedicated and well resourced attacker like the Lazarus Group will find holes in all of them. The "right" move here would have been for the employee not to download the compromised pdf, and short of that, for the IT Security team at Ronin to quickly detect the weird traffic that resulted and isolate the validators to prevent a compromise of their critical assets.

REMOTE (USA) - Sr/Staff Site Reliability Engineer - SentinelOne SentinelOne is defining the future of cybersecurity through our XDR platform that automatically prevents, detects, and responds to threats in real-time. If building infrastructure for a data platform that handles petabytes of data ingest and millions of queries piques your interest, please apply! Sr SRE Job Description: https://www.sentinelone.com/jobs/?gh_jid=5052900003

A couple of security-research links related to this virus: - (a high-level summary) https://www.welivesecurity.com/2022/02/24/hermeticwiper-new-data-wipin… - (a more-detailed technical analysis) https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/