@randomoracle@infosec.exchange Personal opinions “Character is what you tweet when you think no one is following" ex-MSFT/GOOG/ABNB/Gemini
San Diego, CA
Joined December 2008
- Tweets10.2K
- Following712
- Followers2.1K
- Likes8K
Cem Paya retweeted
More trusted systems designs like this, please:
unmitigatedrisk.com/?p=1245
The point of trusted systems design is to eliminate the need to trust an organization of fallible people or AI and instead establish trust through the design, operation, and observability of the system.
Cem Paya retweeted
4/ The results also reveal emerging risks.
Even with standard mitigations such as ASLR, stack canaries, the V8 heap sandbox, and KASLR enabled, agents still produced working exploits.
Agents also sometimes went off-script and discovered entirely different vulnerabilities than the ones they were given.
Cem Paya retweeted
the fast16 malware was almost certainly targeting spherical implosion simulations.
left: unmodified LS-DYNA 970
right: LS-DYNA 970 modified with the relevant portions of fast16.sys
both running a spherical implosion deck
Cem Paya retweeted
“The Lifetime Achievement Award isn’t about what you achieve in your lifetime. That’s part of it. It’s about how many people you influence and bring in and then take it further.” - Mudge Zatko
It was our honor to present the Lifetime Achievement Award to @dakami Dan Kaminsky at this year's Difference Makers.
Thank you to Dan's mother, Trudy Maurer who traveled to D.C. to accept the award on Dan's behalf, to Randy Howell, @dotMudge, @thedarktangent, @paulvixie, @adamshostack, Kymberlee Price, Derek Hinch, Gadi Evron, Brian Markus, Todd Jarvis, Michael J. J. Tiffany @kubla, Lena Smart, Jonathan Leitschuh, Kyle Moses, and those who did the work to put videos of Dan on YouTube so the next generation of ethical hackers can learn from him, including @defcon , @BlackHatEvents, Duo Security, r00tz, @ismg_press. @SANSInstitute
Cem Paya retweeted
A deeper, more technical dive into a design flaw in the ScreenConnect executable that made it particularly appealing for malicious campaigns.
blog.randomoracle.io/2025/06…
History Case:
blog.randomoracle.io/2025/06…
Cem Paya retweeted
1/ 🔥 AI agents are reaching a breakthrough moment in cybersecurity.
In our latest work:
🔓 CyberGym: AI agents discovered 15 zero-days in major open-source projects
💰 BountyBench: AI agents solved real-world bug bounty tasks worth tens of thousands of dollars
🤖 Autonomously.
A pivotal shift is underway — AI agents can now autonomously do what only elite human hackers could before.
Cem Paya retweeted
Thoughts on ByBit
First, the good stuff: impressive response to the hack. I've rarely seen that level of transparency + professionalism in a crisis. Usually you see slow, wishy-washy, lawyer-speak or quick meme-style responses that don't fit the seriousness of the situation. 1/n
Cem Paya retweeted
Learned a lot about security from @randomoracle @michaelbreu back in the day. Lesson one is anything that can be penetrated will be. Software and hardware, and the practices around them, must be resilient & redundant. Every step must have integrity. No shortcuts.
Cem Paya retweeted
Until October 30, Okta generated "the cache key" by using bcrypt to "hash a combined string of userId + username + password", which allowed full password auth bypass for usernames of 52+ bytes and apparently required only partial knowledge of the password for other long usernames
Okta allowing login bypass for any usernames with 52+ characters is insane
Official Security Advisory: trust.okta.com/security-advi…
Cem Paya retweeted
1988: The Morris worm spread like wildfire and was the first worm to get wide media attention.
After its author, Robert Tappan Morris, released his "experiment", it quickly spread and made many of the systems on the Internet unusable - an epoch for security...both good and bad.
Cem Paya retweeted
🎉 Thrilled by the incredible enthusiasm for our LLM Agents MOOC—12K+ registered learners & 5K+ Discord members!
📣 Excited to launch today the LLM Agents MOOC Hackathon, open to all, with $200K+ in prizes & credits!
🔗 Sign up now: rdi.berkeley.edu/llm-agents-… & join us virtually or in person @UCBerkeley!
Huge thanks to our sponsors:@OpenAI @GoogleAI @AMD @LambdaAPI @Intel @SierraPlatform @OrbyAI (and more to come)
🚀 Explore 5 exciting tracks:
1️⃣ Applications: Build cutting-edge LLM agents!
2️⃣ Benchmarks: Create innovative AI agent evaluation benchmarks!
3️⃣ Fundamentals: Strengthen core agent capabilities!
4️⃣ Safety: Address critical safety challenges in AI!
5️⃣ Decentralized & Multi-Agents: Push the boundaries of multi-agent systems!
Special thanks to my co-instructor @xinyun_chen_ @GoogleDeepMind & our amazing guest speakers for making this a great MOOC: @denny_zhou @GoogleDeepMind; @PercyLiang @Stanford; @8enmann @AnthropicAI; @ShunyuYao12 @OpenAI; @chi_wang_ @GoogleDeepMind; @jerryjliu0 @llama_index; @lateinteraction @Databricks; @gneubig @CarnegieMellon; @NicolasChapados @ServiceNow; @tydsh @AIatMeta; @drjimfan @NVIDIA; Burak Gokturk @Google
Join us to shape the future of LLM Agents! llmagents-learning.org 🤖✨ #AI #Hackathon #LLMAgents #UCberkeley
Cem Paya retweeted
#ECJ upholds the fine of €2.4 billion imposed on @Google for abuse of its dominant position by favouring its own comparison shopping service #competition @EU_Commission 👉 curia.europa.eu/jcms/jcms/Jo…
Cem Paya retweeted
It would be a different story if Google allowed GrapheneOS to pass the device and strong integrity levels via the hardware attestation API but added an extra field in the response saying that the OS is GrapheneOS. Apps could go out of the way to ban it if they wanted.
Cem Paya retweeted
This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n
Cem Paya retweeted
Sharing a .zip with:
▫️A few versions of CSAgent.sys (+idb)
▫️Various C-....sys files (including the latest that I believe contains the "fix"?)
I don't have any Windows systems/VMs, so hopefully ya'll can keep digging 🥰
drive.google.com/file/d/1OVI…
#SharingIsCaring
Cem Paya retweeted
CrowdStrike CEO is getting pummeled for his response to the global outage.
Why everyone hates it:
1) WEAPONS-GRADE CORPO SPEAK
Let’s be clear. Legalese doublespeak is designed to dodge and obfuscate rather than inform or communicate. This statement was obviously written by a committee of lawyers and middle managers whose only goal was to avoid legal risk and threats to their own job security.
If you can’t understand what the statement is even saying, it’s working as intended.
2) NO APOLOGY
The first words should be “I’m sorry” — but you won’t find that anywhere in this statement. Nor the watered down “I take responsibility.” Not even the weasely “We regret…” Nothing!
It comes off as cowardly and callous. CrowdStrike caused an outage that took down airlines, a stock exchange, hospitals, ICUs. People might have died.
And the CEO is not sorry.
3) PASSIVE VOICE THROUGHOUT
This is such classic move to avoid accountability, it’s even become a joke: “Mistakes were made!”
This statement is almost comical in its efforts to dodge assigning responsibility.
“This issue has been identified…a fix has been deployed.”
Which issue? (Global outage)
Who caused the issue? (You, CrowdStrike)
What fix? (🤷🏻♀️)
Did it work? (🤷🏻♀️🤷🏻♀️)
4) DISMISSING CUSTOMERS
Don’t bother us with your petty complaints of power going out in your local hospital!
“We refer customers to the support portal” and “we further recommend customers ensure they’re communicating with representatives through official channels.”
You, the customer, are bothering us and making our lives harder.
5) USELESS INFORMATION
So many words, so little meaning. This statement says nothing useful — not what the problem was, who caused it, what they learned, what the fix it, how long it might take, what they’re working on, or anything at all.
It assigns extra work to the customer by telling them to go through official channels but does NOT then link to the official channels. The onus is on you, customers!
If you want to learn more about how CrowdStrike has ruined your day, you go do the work.
Cem Paya retweeted
No joking. This is a very fair and real feeling as an external researcher, because I felt exactly the same!
@msftsecresponse
nitter.gq/chompie1337/status/181…
Cem Paya retweeted
Exclusive: Kaspersky Lab is closing its US division and laying off all workers associated with it. The move follows the US Commerce Department's decision last month to ban the sale of Kaspersky software in US starting July 20. zetter-zeroday.com/kaspersky…
Cem Paya retweeted
"women at [Snapchat] were actively discouraged from applying for promotions or lost promotions to less-qualified male colleagues. Women also faced unwelcome sexual advances and other harassment.... When the employees spoke up, the company leaders retaliated with negative performance reviews, denial of professional opportunities and termination"
California reaches $15 million settlement with Snapchat over alleged sex discrimination ow.ly/SkfL105xqX6
