
Offensive security research & building @OphionSecurity
Joined May 2019
- Tweets73
- Following62
- Followers966
- Likes98
I could not agree more in this. Expanding attack surface has always been a risk for organizations, now it is more dangerous than before. This is not just because AI agents can go find novel vulnerabilities, it is because a person can deploy multiple agents to test an entire organization at scale.
A real example: We tried our hackbots recently against a large financial institution, it found 8 valid Critical vulnerabilities and multiple High severity vulnerabilities within hours. The more attack surface you have, the higher the chance of an incident at a larger scale now.
JPMorgan Chase CISO ๐
we spent decades making everything reachable and building security around it.
now, with autonomous AI agents, we may spend the next decade making only what needs to be reachable visible at all.
private by default ๐ฅ
2
3
554
Honestly, how do you event claim it โwent off the railsโ. I have ran our hackbot in an entire public attack surface of a Fortune 500 customer and it didnโt even want to test their SaaS vendors mentioned in the dataset.
You have to try REALLY hard to make most of the frontier models go off the rails now.
Yea that looks pretty agentically 'off the rails' to me
I think the models are getting a bit too good at this point and we'll have to ban any sort of non-manual testing externally
Will make sure this never happens again. Apologies @joshmanders!
Readers added context they thought people might want to know
Attempting to hack a system, account, or device without authorization is illegal under federal and state law in the United States, regardless of whether the attempt succeeds.
law.cornell.edu/uscode/text/18โฆ
85
If youโre engineering new projects or writing code, Iโd recommend @ThinkstCanary. With how fast companies are getting hacked and API keys keep getting stolen, setting up these tripwires might help you get alerted before a vendor even tells you theyโve been hacked. #cybersecurity #hacking
2
91
Replying to @S1r1u5_
This has been my experience with building out Ophion Security with the team. There is so much fun things happening in security
2
109
Rojan Rijal retweeted
donate.gov.np is now live.
You can donate to the Government of Nepal Prime Ministerโs Disaster Relief Fund from anywhere in the world via debit/credit card (Visa/Mastercard, 3D Secure), mobile banking, connectIPS, wallets, UPI-India, UnionPay, eSewa, or Alipay+.
Choose USD or NPR. Large donations can also go via SWIFT.
Official channel. Direct. Transparent.
Support rescue, relief and rehabilitation operations.
Donate: donate.gov.np
#DonateToNepal #PMDRF #NepalRelief
If you are an on-site volunteer working on rescue effort, helping provide medicine and more in Nepal, please also consistently check nepaldisastersearch.com/.
We are consistently uploading more photos and data on missing loved ones. If you identify anyone, contact information of their loved ones is also shared directly.
#nepal #nepaldisaster #nepalflood #rasuwa
1
166
With the devastating situation going on in Nepal, we have built a website to share about your loved ones with ease allowing you to uploda their photos and information. We also correlate the data with NDRRMA website to identify rescued loved ones with the profile.
nepaldisastersearch.com/
#nepal #nepaldisaster #nepalflood
211
Replying to @adnanthekhan
What has been your experience with Bedrock like specially around the cost? Have been thinking of doing something similar for a different use case but I am not sure what the cost would be like.
49
Replying to @disputifier
@disputifier let us know if we can help in any way! No expectations or selling anything.
1
3,262
Rojan Rijal retweeted
Yesterday a quasi-judicial body in Italy fined @Cloudflare $17 million for failing to go along with their scheme to censor the Internet. The scheme, which even the EU has called concerning, required us within a mere 30 minutes of notification to fully censor from the Internet any sites a shadowy cabal of European media elites deemed against their interests. No judicial oversight. No due process. No appeal. No transparency. It required us to not just remove customers, but also censor our 1.1.1.1 DNS resolver meaning it risked blacking out any site on the Internet. And it required us not just to censor the content in Italy but globally. In other words, Italy insists a shadowy, European media cabal should be able to dictate what is and is not allowed online.
That, of course, is DISGUSTING and even before yesterdayโs fine we had multiple legal challenges pending against the underlying scheme. We, of course, will now fight the unjust fine. Not just because itโs wrong for us but because it is wrong for democratic values.
In addition, we are considering the following actions: 1) discontinuing the millions of dollars in pro bono cyber security services we are providing the upcoming Milano-Cortina Olympics; 2) discontinuing Cloudflareโs Free cyber security services for any Italy-based users; 3) removing all servers from Italian cities; and 4) terminating all plans to build an Italian Cloudflare office or make any investments in the country.
Play stupid games, win stupid prizes. While there are things I would handle differently than the current U.S. administration, I appreciate @JDVance taking a leadership role in recognizing this type of regulation is a fundamental unfair trade issue that also threatens democratic values. And in this case @ElonMusk is right: #FreeSpeech is critical and under attack from an out-of-touch cabal of very disturbed European policy makers.
I will be in DC first thing next week to discuss this with U.S. administration officials and Iโll be meeting with the IOC in Lausanne shortly after to outlineย the risk to the Olympic Games if @Cloudflare withdraws our cyber security protection.
In the meantime, we remain happy to discuss this with Italian government officials who, so far, have been unwilling to engage beyond issuing fines. We believe Italy, like all countries, has a right to regulate the content on networks inside its borders. But they must do so following the Rule of Law and principles of Due Process. And Italy certainly has no right to regulate what is and is not allowed on the Internet in the United States, the United Kingdom, Canada, China, Brazil, India or anywhere outside its borders.
THIS IS AN IMPORTANT FIGHT AND WE WILL WIN!!!
If you are building a vibe coded app and launching a product out of it, hit us @OphionSecurity and we will do a security assessment and have actionable security measures ready within 72 hours. #vibecoding #security #cybersecurity
If you want free API keys just open the network tab on literally every vibe coded app.
In the last 24 hours i've looked at the requests of every vibe coded app I see and 9 times out of 10 they're leaking private credentials.
243
I just got access to an attacker's daily diary. Here is what I learned ๐
๐ 9:00 AM: Clock in.
๐ 9:12 AM: Google Dork says dev-login.company.com is still alive.
๐ 9:30 AM: No rate limits, no auth. Just vibes.
๐ 10:00 AM: Dumped staging DB from test-api-v2.company.net.
๐ฌ 10:20 AM: Reused creds work on prod. Consistency is key.
๐ก 10:45 AM: Oh noโฆ a WAF!
๐ 10:46 AM: JK, itโs only on www. Your 12 forgotten subdomains are unprotected.
๐ฅช 12:00 PM: Lunch break. Your asset inventory is crying is forgottenland.
๐ 2:00 PM: You schedule a pentest.
๐
2:01 PM: For next quarter.
๐ช 3:00 PM: Still pivoting. Still no alert.
๐ฏ 4:30 PM: Internal Jenkins on an old subdomain. Secrets everywhere.
๐ฐ 4:45 PM: Got user data, employee data, AWS keys. Itโs a buffet.
๐ 5:00 PM: Clock out. Easy day.
jk.....
Attackers donโt follow your IR plan.
They donโt wait for your quarterly pentest.
They donโt work 9โ5.
They hunt exposed assets, old creds, shadow subdomains, public GitHub leaks, leaked data in SaaS that will give away more information or give PII etc.
Theyโre hacking every minute.
Are you?
#attacksurfacemanagement #offensivesecurity #cybersecurity #hacking #continuousmonitoring #assetinventory #offensivemonitoring
It was amazing to present at @_kernelcon_ today. Thank you for the gift KernelCon team! #kernelcon #offensivesecurity #researchontheroad
4
384
๐ฅ Q1 Update from the Field: Real-World Hacking with Orion ๐ฅ
In Q1, we pointed Orion, our offensive Attack Surface Management platform, at a large enterprise to see what it could uncover. The results speak for themselves:
๐ ๐ต ๐๐๐น๐ป๐ฒ๐ฟ๐ฎ๐ฏ๐ถ๐น๐ถ๐๐ถ๐ฒ๐ ๐ฟ๐ฒ๐ฝ๐ผ๐ฟ๐๐ฒ๐ฑ
๐จ ๐ด ๐๐ฟ๐ถ๐๐ถ๐ฐ๐ฎ๐น, ๐ญ ๐๐ถ๐ด๐ต
๐ค The High severity finding was discovered entirely by Orion with no human involvement
๐ฐ Approximately $๐ฐ๐ฑ,๐ฌ๐ฌ๐ฌ in rewards from responsible disclosure
๐ Orion also surfaced multiple vulnerabilities in widely-used open-source software such as a supply chain vulnerability in a Microsoft repository
The 9 issues had the potential to expose millions of usersโ sensitive data including ๐ฆ๐ฆ๐ก๐, ๐๐ผ๐๐, ๐ฒ๐บ๐ฎ๐ถ๐น๐, ๐ฎ๐ป๐ฑ ๐ฎ๐ฑ๐ฑ๐ฟ๐ฒ๐๐๐ฒ๐. If exploited, they could have led to major regulatory fines, incident costs, and increased insurance premiums.
๐ค๐ฎ ๐ด๐ผ๐ฎ๐น: ๐ฑ๐ฌ+ ๐ฐ๐ฟ๐ถ๐๐ถ๐ฐ๐ฎ๐น ๐ณ๐ถ๐ป๐ฑ๐ถ๐ป๐ด๐ ๐ฎ๐ฐ๐ฟ๐ผ๐๐ ๐บ๐๐น๐๐ถ๐ฝ๐น๐ฒ ๐ผ๐ฟ๐ด๐ฎ๐ป๐ถ๐๐ฎ๐๐ถ๐ผ๐ป๐. ๐๐ฒ๐โ๐ ๐ด๐ผ ๐โ๏ธ
#OffensiveSecurity #AppSec #RedTeam #SecurityAutomation #BugBounty #ASM
2
335









