Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz) header
Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz) profile picture

Yiannis (John) Kozyrakis | @[email protected]

@ikoz

security engineer | https://nitter.gq/t.co/4md7HaGx5W

 London, UK
Joined August 2008
  • Tweets2.4K
  • Following1K
  • Followers1.3K
70Media
Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)Photo by Yiannis (John) Kozyrakis | @ikoz@infosec.exchange (@ikoz)
Let's try this: @ikoz@infosec.exchange
1
1
Yiannis (John) Kozyrakis | @[email protected] retweeted
HD Moore (@hdmoore) profile picture
HD Moore@hdmooreMar 30
Tom Ptacek posted a great writeup titled "Vulnerability Research Is Cooked", covering the state of vulndev and its rapidly accelerating future: sockpuppet.org/blog/2026/03/…

Vulnerability Research Is Cooked

Vulnerability discovery has always been gated by elite attention. Elite attention is now abundant. What happens next?

sockpuppet.org
2
33
131
12,889
I’m super excited about this blogpost. The approach is so counterintuitive, and yet the results are so much better than anything else that we’ve tried for memory safety. We finally understand why. security.googleblog.com/2024…
Eliminating Memory Safety Vulnerabilities at the Source

Eliminating Memory Safety Vulnerabilities at the Source

Posted by Jeff Vander Stoep - Android team, and Alex Rebert - Security Foundations Memory safety vulnerabilities remain a pervasive threa...

security.googleblog.com
6
73
9
269
54,796
Yiannis (John) Kozyrakis | @[email protected] retweeted
Brendan Dolan-Gavitt (@moyix) profile picture
Brendan Dolan-Gavitt
@moyix8 Mar 2024
I gave Claude 3 the entire source of a small C GIF decoding library I found on GitHub, and asked it to write me a Python function to generate random GIFs that exercised the parser. Its GIF generator got 92% line coverage in the decoder and found 4 memory safety bugs and one hang.
34
228
48
2,090
813,309
We are excited to announce that Google, Microsoft, and Meta are formally partnering as the founding steering committee to improve app security through a newly restructured App Defense Alliance, under the Joint Development Foundation. Learn more: hubs.la/Q02873mh0
Image from The Linux Foundation (@linuxfoundation)
2
7
15
8,663
Security Engineering roles in mobile security also open, do reach out!
This quoted post is unavailable.
Try viewing anyway · View on X
1
8
23
8,651
Some more info on this, positions open onsite in Meta engineering offices in the US and London. Remote also possible depending on seniority within US, UK, France, Germany, Spain, Italy, Ireland, Netherlands, Poland.
3
257
Yiannis (John) Kozyrakis | @[email protected] retweeted
LLM Security (@llm_sec) profile picture
LLM Security@llm_sec10 Jun 2023
* People ask LLMs to write code * LLMs recommend imports that don't actually exist * Attackers work out what these imports' names are, and create & upload them with malicious payloads * People using LLM-written code then auto-add malware themselves vulcan.io/blog/ai-hallucinat…
Cybersecurity Snapshot: New Guide Details How To Use AI Securely, as CERT Honcho Tells CISOs To...

Cybersecurity Snapshot: New Guide Details How To Use AI Securely, as CERT Honcho Tells CISOs To...

Cyber agencies from multiple countries published a joint guide on using artificial intelligence safely. Meanwhile, CERT’s director says AI is the top skill for CISOs to have in 2024. Plus, the UK’s...

tenable.com
76
1,988
499
7,257
1,794,832
not every day 4 world-class security teams (all from Google, though that's not all of them...TAG, Mandiant, CrOS Security, and more) co-author a doc... #powerofopen storage.googleapis.com/gweb-…
9
14
3,344
Yiannis (John) Kozyrakis | @[email protected] retweeted
Ahn Ki Chan (@Externalist) profile picture
Ahn Ki Chan@Externalist16 Apr 2023
Here are the slides for my keynote, 'Mobile Exploitation, the past, present, and the future' at #Zer0Con2023. Zer0con was a blast as always, thank you @POC_Crew!! 🚀💫 github.com/externalist/prese…
12
138
1
415
91,229
The Android team has open sourced our internal Rust Training! It's a four day course covering the full spectrum of Rust, from basic syntax to advanced topics like generics and error handling. It also includes Android-specific content on the last day. google.github.io/comprehensi…
49
694
51
2,932
418,911
Yiannis (John) Kozyrakis | @[email protected] retweeted
Casey Newton (@CaseyNewton) profile picture
Casey Newton
@CaseyNewton10 Nov 2022
According to messages shared in Twitter Slack, Twitter’s CISO, chief privacy office, and chief compliance officer all resigned last night. An employee says it will be up to engineers to “self-certify compliance with FTC requirements and other laws.”
808
10,180
5,724
49,962
Yiannis (John) Kozyrakis | @[email protected] retweeted
Nasko Oskov (@nasko) profile picture
Nasko Oskov@nasko4 Nov 2022
The folks in Chrome who work on securing the web platform API have compiled a great guidelines doc based on their experience. chromium.googlesource.com/ch… Thanks @mikewest et al!
1
13
46
Yiannis (John) Kozyrakis | @[email protected] retweeted
Kees Cook (@kees_cook) profile picture
Kees Cook@kees_cook3 Nov 2022
If you can't switch your C to Rust immediately, consider at least enabling all the sanity checking the compiler can already do for free: -Wall -D_FORTIFY_SOURCE=2 -fsanitize=bounds fsanitize-undefined-trap-on-error -fstrict-flex-arrays (GCC 13+, Clang 16+)
12
71
3
433
Yiannis (John) Kozyrakis | @[email protected] retweeted
Benjamin Lewis (@tc1415) profile picture
Benjamin Lewis
@tc141522 Sep 2022
I believe HMG are trying to legislatively prohibit SQL injection attacks on the register of companies!
Image from Benjamin Lewis (@tc1415)
17
44
20
147
Yiannis (John) Kozyrakis | @[email protected] retweeted
Tim Strazzere (@timstrazz) profile picture
Tim Strazzere@timstrazz16 Jun 2022
Breaking Secure Boot on Google Nest Hub (2nd Gen) to run Ubuntu fredericb.info/2022/06/break… < what an awesome write up

Breaking Secure Boot on Google Nest Hub (2nd Gen) to run Ubuntu

In this post, we attack the Nest Hub (2nd Gen), an always-connected smart home display from Google, in order to boot a custom OS. First, we explore both hardware and software attack surface in search...

fredericb.info
16
64
Yiannis (John) Kozyrakis | @[email protected] retweeted
Philippe Oechslin (@tradeoph) profile picture
Philippe Oechslin@tradeoph19 May 2022
We have finally published Tproxy (objectifsecurite.gitlab.io/t…) our generic TCP interception proxy (think Burp for TCP): TLS handling, wireshark dissection, intercept and modify by hand or with scripts in GUI or CLI. There is a complete doc with demos (objectifsecurite.gitlab.io/t…)
2
58
1
119
Up for an rootkit implementation on ARM's TrustZone? Read this! "Abusing Trust: Mobile Kernel Subversion via TrustZone Rootkits" by Daniel Marth et al. @ESSE_research @reed_solomon
Image from USENIX WOOT Conference on Offensive Technologies (@wootsecurity)
1
39
5
133
Yiannis (John) Kozyrakis | @[email protected] retweeted
Seán Burke (@SeanBurkeShow) profile picture
Seán Burke@SeanBurkeShow28 Jan 2022
Antiques Roadshow: NFT Edition
354
7,031
1,022
34,595
Yiannis (John) Kozyrakis | @[email protected] retweeted
Parsia Hakimian (@CryptoGangsta) profile picture
Parsia Hakimian@CryptoGangsta20 Dec 2021
The writeup for the Visual Studio Code WSL Remote RCE or CVE-2021-43907 is here. Hope you have 30 minutes to read it or just read the `Summary` section. It was yet another open local WebSocket server just like `PlayStation Now`. parsiya.net/blog/2021-12-20-…
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

The Visual Studio Code server in Windows Subsystem for Linux uses a local WebSocket WebSocket connection to communicate with the Remote WSL extension. JavaScript in websites can connect to this...

parsiya.net
3
52
1
158
Load more