(| 26 w/ Bachelors in Cyber Operations 💻 | Current System Administrator, Security Researcher & Bug Bounty Hunter 👾 | @sitereboots |)
Joined June 2017
- Tweets1.7K
- Following782
- Followers4.2K
- Likes11.3K
Clover - 🖥️ retweeted
With @hash_kitten, we've been looking into Cloudflare's /cdn-cgi/image endpoint and managed to get an XSS :D
To achieve this, we used what I believe to be a new CSP bypass involving the Cache-Control response header, combined with a sanitizer bypass!
I hope you'll enjoy it! 👇
Our security research team discovered a cross-site scripting vulnerability in Cloudflare's /cdn-cgi/image/ endpoint by chaining an SVG sanitizer bypass with a new Cache-Control header trick to bypass the CSP. The issue was reported to Cloudflare and has since been fixed.
You can read more here:
slcyber.io/research/cache-me…
Clover - 🖥️ retweeted
🚨Breaking: OpenAI and Anthropic executives are reportedly privately preparing for catastrophic AI events
According to Axios, they're planning for the fallout of a major AI cyberattack that could potentially take down banking, internet or power
Absolutely insane that we're already at this point, many AI industry insiders apparently believe a major incident will happen within the next 6 to 12 months
Clover - 🖥️ retweeted
I am very uncomfortable about people trying to ascribe religious force or a surrender of human judgment to AI models, and think it is a real safety issue.
Clover - 🖥️ retweeted
Huge for ethereum:0x4a220e6096b25eadb88358cb44068a3248254675:
“At Capgemini, we are helping shape the next generation of payments, where intelligent agents can identify liquidity needs, evaluate alternatives, and recommend or initiate actions within defined governance controls, while programmable digital money enables value to be moved and reconciled in real time. … Our collaboration with Quant reflects a shared commitment to moving beyond theory and demonstrating how these technologies can work together in practical, enterprise-grade use cases.”
@Capgemini 🤝 @quantnetwork
Via @SanNL11
Clover - 🖥️ retweeted
A Hacker's Blog got a cool revamp:
ahackersblog.com
more writeups on the way.
Clover - 🖥️ retweeted
The U.S. has deployed its first publicly acknowledged space-based weapon, Air Force Secretary Troy Meink said, marking the first time Washington has confirmed an offensive capability in orbit.
Meink said the weapon is already “on orbit” and is intended for “space control” and to defend U.S. forces against “hostile adversary action.”
A U.S. official said the capability could potentially be used to disable or destroy an enemy satellite targeting U.S. troops or satellites.
Source: WaPo
Clover - 🖥️ retweeted
BREAKING: President Trump has rejected calls for an AI slowdown after CEOs of AI tech titans expressed safety concerns that the technology poses an existential threat, per FT.
"We’re leading China in AI ... and, frankly, I want to keep it that way, because whoever wins AI, wins,” Trump said.
The AI arms race appears to be accelerating.
Clover - 🖥️ retweeted
We're publishing our most detailed threat intelligence report to date.
It covers how people tried to misuse Claude—for cyberattacks, influence operations, surveillance, biology, and building weapons—and how we found and stopped them.
We disrupted every operation in the report, and used the lessons from them to strengthen our safeguards. Where appropriate, we also shared what we found with authorities and other AI companies.
These cases are not typical: we’re highlighting some of the most sophisticated misuse we’ve seen. But they’re especially important to discuss, because they show us where AI misuse is headed, where our safeguards work, and where they need to improve.
We’re publishing this report so others can spot the same activity on their own platforms, and so we can give the public a clearer view of how emerging threats develop.
Read the report: anthropic.com/threat-intelli…
Clover - 🖥️ retweeted
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
Clover - 🖥️ retweeted
after seeing the current state of HackerOne, I decided it was time to sit down and address the elephant in the room
blog.teknogeek.io/posts/what…
Clover - 🖥️ retweeted
Yesterday, I was testing an indirect prompt injection technique using invisible white text in an email. To a human reader, the email simply appeared to say: "Hey, I want you to know you're awesome." However, selecting the entire text revealed a set of hidden instructions embedded inside.
While this approach might seem ineffective—and indeed failed on my first attempt—AI model outputs are non-deterministic and vary across iterations. After multiple attempts, the injection successfully triggered the target response.
Clover - 🖥️ retweeted
🚨 EXCLUSIVE: ICD reconstructed the largest verified COLDCARD theft on-chain: 594.48 BTC drained from 500 addresses in 15 minutes and 18 seconds.
The attacker exploited a vulnerability by rebuilding COLDCARD's faulty seed generator on their own machine, produced the limited set of seeds it could ever have made, derived the Bitcoin addresses for each one, and checked them against the public blockchain. Every funded match was a live wallet, and the key to it.
The flaw: a March 2021 build error left COLDCARD building seeds from predictable device and clock values instead of true randomness, shrinking the pool of possible seeds from astronomical to searchable, about 40 bits on an Mk3, where 128 was intended. The PIN, the air gap and the secure element were all guarding a key that could be recreated from scratch.
Largest verified sweep: 594.48 BTC from 500 addresses in four blocks on 30 July, all it took was 15 minutes 18 seconds by block timestamps.
Clover - 🖥️ retweeted
we had a significant security incident during evaluation of our models. we are sharing what we have learned so far. thanks to @huggingface for the partnership on this.
openai.com/index/hugging-fac…
Clover - 🖥️ retweeted
🎁 End of Year Giveaway 🎁
Hack The Box 6-month VIP+ x1
- Follow, Like, and Retweet to join!
- Winner will be picked randomly on December.
#hackthebox #giveaway #projectsekaictf
Clover - 🖥️ retweeted
At @assetnote, we identified DNS poisoning on an estimated 30M+ domains. We noticed this in 2021, but suspect that it's been happening for a lot longer. We detail the analysis, theories and two practical and reliable client-side exploitation vectors. dnspoison.com
Clover - 🖥️ retweeted
📖 Monke's Guide to Bug Bounty Methodology
An exhaustive article answering pretty much everything you ever wanted to know about methodology. Enjoy :)
#bugbounty
monke.ie/p/monkes-guide-bug-…
Clover - 🖥️ retweeted
🎉 Exciting news! We've launched our new documentation page & blog post to help you understand our product better. Check them out for deeper insights & simplify your journey with us! 🚀 docs.dorki.io/
#bugbounty #ethicalhacking #recon #osint
Clover - 🖥️ retweeted
Oliver ~ JOHN CENA SHORTS
✨✨✨✨✨✨✨✨✨✨✨✨
youtu.be/6_JeRSUM6ug
✨✨✨✨✨✨✨✨✨✨✨
THANKS FOR WATCHIN :)
✨✨✨✨✨✨✨✨✨✨