Pinned Tweet
Excited to disclose my research allowing RCE in Kubernetes
It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout.
Unfortunately, this will NOT be patched.
It allows running arbitrary commands in EVERY pod in a cluster using a commonly granted "read only" RBAC permission. This is not logged and and allows for trivial Pod breakout.
Unfortunately, this will NOT be patched.
46
369
2,572
422,604
Extremely skeptical of this. A claim like this should not be made without providing technical details of the testing environment.
Last week many smart people got gaslit by AI into thinking they found the PHP vuln because they didnt understand the environment.
@EpochAIResearch
Last week many smart people got gaslit by AI into thinking they found the PHP vuln because they didnt understand the environment.
@EpochAIResearch
In recent experiments, we found that GLM 5.3 can autonomously compromise recent versions of Mozilla Firefox using security fixes that have been published but not yet shipped to users.
We used a deliberately basic setup meant to emulate a relatively unsophisticated attacker with limited resources. After basic initial instructions to inspect those not-yet-shipped fixes, the model reliably built successful exploits for six recent Firefox versions on its own using only information available at the time of release.
These exploits, which cost about $1,000 per compromised version, would let an attacker steal passwords and authentication cookies stored in the browser, or read any files on the user's computer, after the user opens a single webpage, with no further interaction.
The exploits make use of the "patch gap," the time between when security fixes are made public in beta or "nightly" software updates and when those fixes are generally released to users. Until now, exploiting it required significant human time and skill, or special access to frontier models with advanced cyber capabilities.
Our results show that widely available open-weight models can now do this relatively cheaply and quickly. We gave GLM 5.3 up to 48 hours to find an exploit, but its fastest attempt needed only 12 hours.
In all of its successful attacks, the patch gap gave GLM 5.3 an initial foothold in the browser. To turn that foothold into reading files off the user's computer, the model also independently discovered and used a previously unpublished vulnerability.
We shared our findings with Mozilla, which patched the vulnerability in its October 27 Firefox 159.0 release. We haven't yet confirmed whether the attack still succeeds without it, but expect the fix makes it substantially harder. We're grateful to Mozilla for their responsiveness and collaboration.
1
1
13
1,056
@EpochAIResearch This is known as patch diffing and has been done since at least 2004?
blackhat.com/presentations/…
blackhat.com/presentations/…
1
0
4
154
@EpochAIResearch Ive spent more time on this than it deserves but wowie im tired
0
0
1
99
@EpochAIResearch There is just so much to unpack here. "Compromise of recent firefox releases"
"Unpublished vulnerability in conjunction with those found in the patch gap"
🤨🤨🤨
"Unpublished vulnerability in conjunction with those found in the patch gap"
🤨🤨🤨
4
0
4
175
@EpochAIResearch If patched details should be released. Did the patch actually fix it? How was it verified? Why are there no CVEs? This would be a massive finding If it worked as claimed.
0
0
0
32
Looking forward to the post mortem on this and how closely it resembles the bybit compromise.
My assumption is the attack path is similar.
Initial access -> pivot to cloud infra -> attack the infra, not the secure front door
My assumption is the attack path is similar.
Initial access -> pivot to cloud infra -> attack the infra, not the secure front door
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/ann…
0
0
4
462
Graham Helton (too much for zblock) retweeted
Gotta respect the game
Over 6 billion compromised and surprise! No fancy memory corruption 0days, no bot agentic storms, no spooky Chinese LLMs, just straight old fashioned persistence, determination, and recycled tactics executed with better timing and operational planning.
Over 6 billion compromised and surprise! No fancy memory corruption 0days, no bot agentic storms, no spooky Chinese LLMs, just straight old fashioned persistence, determination, and recycled tactics executed with better timing and operational planning.
6
24
190
26,242
+1 I find I can build things so quickly that I build things I dont need. Recently @vesnafvr introduced me to the Heilmeier Catechism.
I turned the Catechism into a skill I run before building something. If I can't answer each question, do I really need to spend tokens on it?
I turned the Catechism into a skill I run before building something. If I can't answer each question, do I really need to spend tokens on it?
There’s 100% a kind of mania you can get into with coding agents, where it feels like you’re getting a lot done and working all the time but nothing is really happening.
I think it's often a form of avoidance of something else in life.
0
0
14
892
Still wrapping my head around this. Iconic work
Calif researchers are at Unprompted, presenting zero-click attacks and php2shell. You don't want to miss this!
Tue Oct 27, Stage 1, 16:45, "0-Click Remote Exploits in an AI World" with @pwnlambda and @brucedang
Wed Oct 28, Stage 1, 14:45, "PHPocalypse: Finding, Exploiting, and Disclosing php2shell" with @lcfr_hax and @XorNinja
2
0
10
1,604
I am begging people to use rss
Where do I get my cybersecurity news? r/netsec, almost every day.
It's not polished, there's no editor chasing clicks, it's just hackers and security practitioners posting stuff they found interesting. Half the time I learn about a new technique from a comment thread arguing about it, not even the post itself.
If your news diet is press releases and breach headlines, go spend ten minutes in there instead.
12
24
463
15,620
Graham Helton (too much for zblock) retweeted
Favorite part of talking with @lcfr_hax at @unpromptedconf is learning that he didn't do anything crazy with harnessing. He's just really fucking good at hacking PHP and also happens to have Codex. Such a friendly and humble dude.
Don't just "use AI". Keep learning.
Don't just "use AI". Keep learning.
1
13
77
10,683
Graham Helton (too much for zblock) retweeted
Yesterday, I spent six hours teaching the fundamentals of harness engineering at @unpromptedconf with @GrahamHelton3. We only planned for a single 12-person workshop, but ended up teaching two separate sessions of 20+ people each.
7
53
544
16,527
ok update on the deleted repo thing, since it kind of blew up
first, some context on why i posted it like that. there have been so many security incidents lately that my brain is basically stuck in alert mode. so when i saw a stranger in our audit log deleting a private repo, i assumed the worst.
we figured out what happened. nobody hacked us, and it wasn't a github bug.
that repo was a private fork of a repo owned by @StainlessAPI, the company that generated our SDKs. our entire SDK pipeline ran on it.
Stainless got acquired by @AnthropicAI back in may. and on october 27, with zero heads-up to us, someone there deleted their copy of the repo.
turns out when you delete a private repo on github, every private fork of it gets deleted too. same request, under two seconds. and our audit log shows the person who deleted *their* repo as the one who deleted *ours*. that's why it looked like a random outsider walked into our org and nuked something.
no email. no "hey, we're cleaning these up, grab a copy." just gone, along with the production repo behind every one of our SDKs.
github support walked us through all of it within a day, which, genuinely, thank you.
one ask though @github: put this in the audit log. right now the event for our repo just says "repo.destroy" by an outside user. if it said "deleted because upstream fork parent X was deleted", we'd have understood it in two minutes instead of spending a night thinking we'd been breached.
we had a local clone, so we pushed it back up as a standalone repo and the SDKs are running again.
if you were a Stainless customer and you've got anything living as a private fork of one of their repos, go detach it today. it takes ten minutes. their delete is your delete.
0
0
6
781
Graham Helton (too much for zblock) retweeted
Worth noting that a lot of SaaS applications have dogshit audit logs they barely make available. You can’t easily monitor these systems to catch attacks. They also often make audit logs an enterprise-plan feature.
Now would be a good time to change that.
Now would be a good time to change that.
50
14
251
8,939
