Joined April 2014
3,599 Photos and videos
Pinned Tweet
22 Feb 2015
5
3
143
A WhatsApp #E2EE & #OPSEC reminder: 1โƒฃMetadata is not protected by E2EE; WhatsApp knows phone #, profile name, contacts, groups etc. 2โƒฃEven with E2EE, the other end can leak ๐Ÿคท E2EE protects content in transit, not endpoints or metadata CC: @matthew_d_green @thegrugq @RidT
Replying to @jsrailton
3/ Imagine being the guy that accidentally self-snitches your spyware development ops. Honestly impressive. I hope the ramen tasted good. Here's the docket: courtlistener.com/docket/163โ€ฆ
2
11
32
9,121
See Meta's/@WhatsApp's threat hunter @ablaich's declaration storage.courtlistener.com/reโ€ฆ
1
636
Tal Be'ery retweeted
๐Ÿ”ฎPrediction markets are live on @ZenGo - powered by @Polymarket. ๐Ÿ†Predict the 2026 World Football Tournament straight from your phone. โšฝ48 nations. 104 matches. Back your team. Make your call. #PredictionMarkets #WorldCup #CryptoWallet โ†’ zengo.com/prediction-marketsโ€ฆ
6
7
23
2,599
Security nightmare, probably
Get paid to wait The Claude Code spinner might be the most watched line on Earth. So I turned it into an ad marketplace. Advertisers bid on it. You keep 50% of the money. Install the extension โ†’ get cash from ads. Introducing Kickbacks
1
1
323
#OPSEC is hard. CC: @thegrugq
Epic OPSEC fail by NSO Group. @whatsapp recently caught the notorious spyware company hacking across their platform. (NSO is forbidden from doing this by a US court!) In their testing, NSO was sending a test image of a soup cup...on a desktop mat with the NSO Group logo. Making it worse, the image was user-reported to WhatsApp. Cleanest attribution I've seen in a long time.
647
ืจืง ื”ื™ื” ื—ืกืจ ืคื” ื” ืดืžืื™ืจ ืชืจื’ืขืด. ืื•ื”ื‘ื™ื ืื•ืชืš ืฉืžื—ื” ืจื™ื’ืจ.
Jun 11
ืกืœ ื”ื ื™ืฆื—ื•ืŸ ื”ืžื˜ื•ืจืฃ ืฉืœ ื”ื ื™ืงืก ื‘ืฉื™ืœื•ื‘ ืขื ืฉื™ืžื™๐Ÿคฉ
2
283
I was going to write something, but @SwiftOnSecurity said it better: the answer to offensive cyber AI is doubling down on fundamentals. Containment (= network privileges) is the lever. @ZeroNetworks' report (FD: I'm an advisor) shows we still have a lot of work ahead of us.
Today we're releasing the ๐Ÿ๐ŸŽ๐Ÿ๐Ÿ” ๐‹๐š๐ญ๐ž๐ซ๐š๐ฅ ๐Œ๐จ๐ฏ๐ž๐ฆ๐ž๐ง๐ญ ๐„๐ฑ๐ฉ๐จ๐ฌ๐ฎ๐ซ๐ž ๐‘๐ž๐ฉ๐จ๐ซ๐ญ โ€“ the first benchmark measuring how far breaches actually travel inside live enterprise networks. ๐Ÿ“‘ As AI accelerates attacker speed and expands the internal attack surface, the data shows how exposed most enterprises already are: 80% of enterprise servers are reachable from anywhere inside your network. 87% accept inbound RDP or SSH from broad internal sources. The blast radius is bigger than most organizations realize โ€“ and most can't even see it. That's why we built Breach Map. It's a free tool that shows you exactly how far a breach could travel in your environment, before attackers find out first. Dmitri Alperovitch, Co-Founder of CrowdStrike and current President of Silverado Policy Accelerator, put it best: "The organizations that adapt fastest will shift from perimeter-only thinking to containment: limiting lateral movement, reducing blast radius and ensuring attacks cannot bring down a business." Read the press release โ†’ businesswire.com/news/home/2โ€ฆ Get the report โ†’ zeronetworks.com/resource-ceโ€ฆ Map your blast radius โ†’ zeronetworks.com/resource-ceโ€ฆ
1
2
3
1,052

With as much detail as I can share, from top down we are taking Mythos/AI acceleration of cyber threats seriously โ€” by doubling-down on security fundamentals. Sandbagging attack paths using considerable levers of control we already have, w/ AI as our business justification.
1
695
Anyone has experience with setting an organization wide (10s - 100s users) LLM proxy for mainly Claude Code coding agents? What was your motivation? Can you please share setup / results / insights? CC: @claudeai
1
1
1
487
โ€œWe saw the dumbest basketball team in the history of civilization. โ€ฆ The San Antonio Spurs helped the New York Knicks win this game.โ€ Charles Barkley after the Spurs allowed the largest comeback in NBA Finals history ๐Ÿ‘€
222
ื‘ืจื›ื•ืช ืœืจืฉื•ืช ื”ืžืกื™ื ืขืœ ืจืชื™ืžืช ื˜ื›ื ื•ืœื•ื’ื™ื™ืช ื” AI. ืื ื ืจืชืžื• ืืช ื˜ื›ื ื•ืœื•ื’ื™ื™ืช ื”ืืจื™ืชืžื˜ื™ืงื” ืœื˜ื•ื‘ืช ื”ื—ื–ืจื™ ืžืก ืœืฉื›ื™ืจื™ื ื›ืชื•ืฆืื” ืžืฉื™ื ื•ื™ื™ ืžืฉื›ื•ืจืช ื‘ืžืขื‘ืจ ื‘ื™ืŸ ืžืขืกื™ืงื™ื, ืœืœื ืฆื•ืจืš ื‘ื”ื’ืฉืช ื˜ืคืกื™ื. ื”ืžืฆื‘ ื›ื™ื•ื ืคื•ื’ืข ื‘ืขื™ืงืจ ื‘ืฉื›ื‘ื•ืช ื—ืœืฉื•ืช. ื™ืฉ ืœื›ื ืืช ื›ืœ ื”ื“ืื˜ื”. ืžื•ื›ืŸ ืœืชืจื•ื ืืช ื”ืงื•ื“ ืœื—ื™ืฉื•ื‘ ืžืžื•ืฆืข @amsterdamski2 @Idaneretz
ืจืฉื•ืช ื”ืžืกื™ื ืžืฆืื” ืคืขืจ ืฉืœ 20 ืžื™ืœื™ืืจื“ ืฉืงืœ ื‘ื™ืŸ ื”ืฆื”ืจื•ืช ื”ื•ืŸ ืœื“ื™ื•ื•ื—ื™ื ืื—ืจื™ื ื•ืชืฉืชืžืฉ ื‘-AI ืœื‘ื“ื™ืงืช 100% ืžื”ื“ื•"ื—ื•ืช - ื‘ืžืงื•ื 4% ื›ื™ื•ื calcal.ist/2p868ke3 @Shlomo_Tei
6
403
Let them eat Fable
Our Anthropic overlords deciding which prompts the peasants are allowed to use.
5
381
AI does not fix bad data
1
2
401
(Sadly, I'm not the author, so please refer me to the original poster)
2
331
NEW: malware developers added nuclear & biological weapons text to to their spyware. Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner. Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky. When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit. We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted. In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation. H/T to colleagues that shared this with me socket.dev/blog/mini-shai-huโ€ฆ
3
354
Tal Be'ery retweeted
๐Ÿ‘‰ "It not only produced a full chain exploit, but produced eight distinctย exploits, at a cost of $15,700 in API creditsโ€”an average of about $2,000 per privilege escalation. The binding constraint to N-days is now just a few thousand dollars and API access, which expands the pool of capable N-day attackers dramatically."
3
15
102
21,248
Replying to @jan_murray @unherd
Iโ€™m sorry if people have been having a go at you because of my tweet. Not at all the plan. I was very slightly drunk and already upset about something that had nothing to do with you. If itโ€™s any comfort, I got it in the neck too. Iโ€™m a thin-skinned twat, apparently, even though it wasnโ€™t my skin. I was sticking up for the writers who I adored. Obviously I shouldnโ€™t have cited Bach/Kahlo/Moore - asking for trouble - and would have done better to go for the 10,000 blues songs written around the same 12 bar chord structure. Iโ€™ve listened to most of them and will keep doing so. Because we love what we love.
1
380
ืœืขื•ื“ ืื ืฉื™ื ื™ืฉ ืฉืœืœ ื‘ืขื™ื•ืช ืขื ื”ืืชืจ ืฉืœ ื‘ื ืง ืœืื•ืžื™? (ืฉื’ื™ืื•ืช ืžื•ื–ืจื•ืช, ื“ื‘ืจื™ื ืœื ืขื•ื‘ื“ื™ื)
283
Never deleting this app.
Replying to @jan_murray
Thanks for your critique, Janet. We actually tried a couple of episodes where House (Hugh Laurie) (please put the brackets in the right place) gets it right first time, but they were only 6 minutes long. NBC werenโ€™t happy. Then we tried some where House never gets it right and the patient dies. The audience wasnโ€™t happy. One could apply your trenchant analysis to other art forms: JS Bach wrote 30 Goldberg variations on the same chord structure; Frida Kahlo painted 50 portraits of herself; Henry Moore, what?? The point is, or was, variations on a theme; if all you see is hospital, medical blah blah, then it wasnโ€™t meant for you. Nonetheless, I look forward to your first novel!
1
2
431
A possible reply: "A talk is not a security boundary. I'm using automation to respond to MSRC"
Good lord ๐Ÿคฎ
1
630