Security Research Manager. 10 times @BlackHatEvents speaker. Co-Founder @ZenGo acq by @etoro Advisor @ZeroNetworks. x-VP Research Aorato, acq by @Microsoft.
Israel
Joined April 2014
- Tweets17K
- Following2.1K
- Followers11.3K
- Likes14K
אני בא!
בואו גם אתם
בואו לפגוש אותנו במתחם שרונה!
לדבר על התוכניות לעתיד המדינה
לדבר על ההייטק
לדבר על מהפכת המשרתים.
שיחה פתוחה על קפה טוב
יום א׳ בבוקר בשרונה עם נבחרת הביצועיסטים של ביחד. רק ביחד, רק בנט 🇮🇱💪
@KerenTernerEyal @Estiayalonkovo @VladimirBeliak
להרשמה: go.be-yahad.org.il/rsvp25102…
Data point from a call with an infosec expert who talks to multiple cyber-insurers: no increase in losses.
So why does IR feel busier?
Noise created by AI, including orgs' own internal AI, not more actual breaches
IR folks (@GelosSnake @ProferoSec @Mandiant @Volexity @attrc @uuallan @TalosSecurity others, please tag): trying to put numbers on breaches.
Vs. a year ago (or whatever makes sense), how many more cases are you seeing?
Are you really "turning away work" as @RGB_Lights says?
Even OpenSSH, the poster child of security-oriented architecture, benefited from this attack-surface hardening
Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.
This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.
anthropic.com/research/attac…
Small D Energy
arstechnica.com/security/202…
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
Tal Be'ery retweeted
Yes. What he said. And, if you look close, all very knowable in advance when you're able to distinguish between what's possible vs what's probable.
1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?"
TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are.
medium.com/@TalBeerySec/why-…
גם אני מתכוון להצביע בנט @naftalibennett
Tal Be'ery retweeted
We were turning away work before AI. What changed is the mix, not the exploit curve.
We’re not seeing more 0-days or 1-days in our cases. That CVE spike barely shows up in our IR queue.
What’s driving volume is AI inside the house:
AI-written code shipping more vulns and logic flaws
AI-generated configs leaving things exposed
Agents misbehaving and breaking things on their own. We call it AI-induced destruction.
So yes, AI is the root cause, just not the way people think. Breaches aren’t rising because attacks got better. They’re rising because what we ship got worse.
IR folks (@GelosSnake @ProferoSec @Mandiant @Volexity @attrc @uuallan @TalosSecurity others, please tag): trying to put numbers on breaches.
Vs. a year ago (or whatever makes sense), how many more cases are you seeing?
Are you really "turning away work" as @RGB_Lights says?
Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…
The @elder_plinius mystery continues..
Will present @BlackHatEvents Europe event, but remotely
blackhat.com/europe/briefing…
#BHEU #BHEU26
Tal Be'ery retweeted
Ironically, after Hillary Clinton got her leaked emails authenticated by DKIM signing, Matt went on to write a blog post "Ok Google: please publish your DKIM secret keys"blog.cryptographyengineering…
1/ "Your Number Is Up: When 3.5 Billion Strangers Can Exploit Your WhatsApp Devices"
Our @BlackHatEvents Asia 26 talk video is live.
youtube.com/watch?v=FXV0LWPc…
#bhasia #bhasia26
Old but gold from @matthew_d_green: OTR/Signal/WhatsApp's "plausible deniability" property — what enables chat history forging — is mostly a vanity feature.
"'Dammit, they used a deniable key exchange protocol' said no Federal prosecutor ever."
blog.cryptographyengineering…
Burning a possible @BlackHatEvents submission just to make a point:
I modified WhatsApp to permanently rewrite its own chat history by editing the local message DB. Kill the app, reopen it — the altered history is still there. For good.
Even the DB cannot prove authenticity.
מעולה!
בן שנתיים כמעט, אבל העצה של @DannyLeshem (עם קרדיט ל @OmerAlali7) ירוקת-עד.
טריויאלי: לעשות סטארטאפים רק אם יש לך יתרון לא הוגן.
לא טריויאלי, ללחוץ על ההדק כשיש הזדמנות נכונה: להכין לעצמך עתודות (כסף ו/או זמן) כדי שתוכל טכנית , ולהתאמן דרך הימורים כדי שתוכל מנטלית.
בפרק 21 של הפודקאסט ״כסף חכם״ דיברתי עם @brand_yona93102 על סטארטאפים, פאונדרס, ניצול הזדמנויות (תודה @OmerAlali7!), השקעות הון סיכון, ולמה משתלם לשחק פוקר ולאמן את המוח ב-degenerate gambling.
מוזמנים לצפות פה, או להאזין בפלטפורמה המועדפת עליכם :)
youtube.com/watch?v=1DCg8TD9…
Finally, the Linux networking stack achieves five nines
The details of the long awaited KVM Escape are published. PwnEscape leads to VM escapes across multiple hypervisors due to a super cool Linux networking bug.
CVE-2026-99999 is a 9.3 CVSS critical rated KVM escape ⛓️
pwn.ai/blog/pwnescape