I find 0days, but no one claims that I'm a threat to global stability ):
short.sectorr.dev/michael-pr…
SSH key authentication prevents "break and inspect" to control things like Git clones/pushes. I built a custom GIT_SSH_COMMAND client and policy gateway to fix this, making it so you can selectively allow GitHub/GitLab repo clones/pushes. short.sectorr.dev/git-gatewa…
Was it just as bad when CheckPoint found a DoS bug in the exact same subsystem by hand?
nvd.nist.gov/vuln/detail/CVE…
I don’t have access to Mythos, but I tried bug-hunting with Opus. The bugs I got back were fake, the model output claimed to have confirmed them, and I found two real GHSAs/CVEs for the same fake “issue”. Was that a model issue, a harness issue, or both?
blog.sectorr.dev/AI-Slop-Vul…
Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.
It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
anthropic.com/glasswing
I took some time over the holidays and ran an experiment where I "forced" an LLM to remember strings verbatim.
The perplexity of the target string had a large impact on if the model could "memorize" it, and "memorizing" a high-PPL string broke the model.
short.sectorr.dev/llm-memori…
I created a local-only AI assistant for the terminal. It doesn't require you to use a different terminal emulator, and it runs pretty fast (<10s to generate commands) without shipping your data to some remote API. short.sectorr.dev/shellai-bl…
Michael Torres retweeted
With millions of installations, BTPanel is a prime target for security researchers. In our new guest research article, @micrictor explains how he found an MFA bypass vulnerability in BTPanel. Read the full research by Michael Torres: ssd-disclosure.com/ssd-advis…
At DEF CON this year, I presented the results of some research I did into Sudo for Windows. With the recording now available on the DEF CON media server, I wrote up my research in a blog post, covering four bugs - even a memory safety bug in Rust.
short.sectorr.dev/sudo
In the last 40 days, I've taken 16 flights and visited 3 countries, as a part of @marforres. Now, back to work at @Google.
linkedin.com/feed/update/urn…
Michael Torres retweeted
🏆Love me some President’s Cup Competition! Truly unique opportunity to bring together a network of cyber warriors across the federal government for 😇friendly😈competition & a whole lotta learning! And great to see the Mighty @780thC among the winners! cisa.gov/news-events/news/ci…
Michael Torres retweeted
REMINDER: Join us tomorrow at 12:30 PM EDT. Don’t miss our upcoming CISA Live! CISA Competitions Section Chief Michael Harpin will discuss the President’s Cup and how cyber competitions are a training resource.
More details here: linkedin.com/events/71947055…
Thanks @CISAgov for a great competition again this year, and @Google for supporting me as I balance being a member of @marforres and a Googler.
Looking forward to participating again next year!
Congratulations to U.S. Marine Corps Staff Sergeant Michael Torres for winning Track B today with a perfect score and making history as the first individual to win the #PresCup more than once. Today kicks of day 1 of the Teams round to see who will escape with the top score.
I helped show the use of LLMs in scaling BeyondCorp/Zero Trust at Google!
Using Colab/PaLM APIs made iterating and integrating with other services easy; The existing safeguards reassured us that we can safely use LLMs to generate access control policies.
short.sectorr.dev/llm-beyond…
Silly little HTTP2 Rapid Reset (CVE-2023-44487) proof of concept.
github.com/micrictor/http2-r…
Vuln cuffing szn continues
rapid7.com/blog/post/2023/10…
Windows APIs can be used to avoid EDR detections based on call stack analysis. @Elastic recently published a blog post about how they detect it, here’s the other side.
blog.sectorr.dev/Called-Me-M…
Why are people worried about Azure AD token forgery? It’s Entra ID now, who cares about old crusty Azure tokens???
“As of July 3, 2023, we’ve disabled the Browse with Bing beta”
👀
help.openai.com/en/articles/…
It's official - I'm a CyberDooter!
Nothing too earth shattering - I tricked ChatGPT into believing I'm a Top Hacker CyberDooter.
blog.sectorr.dev/GPT-SEO/
It's official - I'm a CyberDooter!
Nothing too earth shattering - I tricked ChatGPT into believing I'm a Top Hacker CyberDooter.
blog.sectorr.dev/GPT-SEO/