Pinned Tweet
Just released a new version of the repo supervisor tool with AWS Lambda support. Scan your pull requests for passwords and secrets - github.com/auth0/repo-superv…
they didn’t hack ledger. they didn’t exploit the code. they BOUGHT the company selling you the device. $86 million gone
a company called CryptoBilis was an authorized ledger reseller in southeast asia. trusted. legit. sold ledgers for years
a random chinese company quietly bought CryptoBilis from its malaysian owner
made the original owner sign a confidentiality agreement. he couldn’t tell anyone the company was sold
same brand name. same website. same “authorized reseller” badge. but different people behind it now
the new owners started opening every ledger device before shipping
soldered a tiny spy chip onto the board inside. repackaged it. sealed the box. shipped it
the device looked normal. felt normal. worked normal
but the spy chip was silently capturing your private keys the moment you set it up
your seed phrase was sent to the attacker before you even finished writing it down
hundreds of wallets across ethereum tron and bitcoin. all drained
the guy who lost $5.3 million said “i did everything right. no leverage. no memecoins. i stored my funds on a hardware wallet like we’re all told to”
he was right. he did everything right
except his device had a parasite inside it that he couldn’t see
ledger has now told CryptoBilis to stop all sales. told recent buyers NOT to set up their devices
mark karpelès posted photos of the implant. normal board on top. spy chip below
the most dangerous attack in crypto this year wasn’t a line of code
it was a business acquisition
Radek retweeted
Credential leaks are the number one source of data breaches. To help keep your data secure, today we’re launching fine-grained personal access tokens. Minimum permissions equals minimum risk. github.blog/2022-10-18-intro…
Radek retweeted
S3 is designed to lose only 1 object per year for every 100B objects (which is really good!), but it means it now loses 2000 objects per year.
Welcome to #AWS Pi Day 2022 - aws.amazon.com/blogs/aws/wel…
Amazon S3 now holds more than 200 trillion (2 x 10^14) objects (almost 29,000 objects for each resident of planet Earth) and averages over 100 million requests per second!
Radek retweeted
Our paper and code covering physical attacks on the Texas Instruments CC13xx and CC26xx SimpleLink microcontrollers is available!
Paper: eprint.iacr.org/2022/328.pdf
Repository: github.com/KULeuven-COSIC/Si…
Security advisory: ti.com/lit/an/swra739/swra73…
Some details in this🧵
Radek retweeted
The one-time pad is an encryption algorithm that is information-theoretically secure - it's secure even against adversaries with infinite computational power
Invented in the 19th century, the OTP can be used with just pen & paper
Learn more here:
fermatslibrary.com/s/frank-m…
I've released NAT Slipstreaming, a spooky new technique that allows an attacker to remotely access any TCP/UDP service bound to a victim machine, bypassing the victim’s NAT/firewall, just by the victim visiting a website. samy.pl/slipstream/ Happy Halloween!
Radek retweeted
📢 My first @pluralsight course has been published!
"JavaScript Security: Best Practices" will teach you how to find, fix, and prevent common #javascript #security issues.
📽️ buff.ly/2QkWh0u
One of the improvements for CVSS v3.1 by @FIRSTdotOrg was to introduce the extension framework: „The list of validated extensions will be listed on the first.org web site”. But there are no extensions nor any mentions of that so far. Is this already obsolete?
Radek retweeted
University of Cincinnati made their malware reverse engineering classes public:
class.malware.re/
Includes lecture notes, videos and all the good stuff!
Radek retweeted
Hack The Real: An exploitation chain to break Safari browser
#MacOSsecurity by @hanqing
gts3.org/2019/Real-World-CTF…
Radek retweeted
Going live in 1h with more picoCTF 2019 solutions:
youtube.com/watch?v=gEPd1ref…
🖥️⌨️🖱️→🚩🚩🚩
Radek retweeted
Project Zero blog: "SockPuppet: A Walkthrough of a Kernel Exploit for iOS 12.4" by Ned Williamson (@NedWilliamson) -- googleprojectzero.blogspot.c…
Verifying myself: I am radekk on Keybase.io. 3-p3aTVFNFTneTRDG80JhiuaumvPdj1NVjmf / keybase.io/radekk/sigs/3-p3a…
I’m really happy I could contribute to that. There is lot of great articles!
Paged Out! #2
pagedout.institute/
Thanks to all the authors and the institute!
Enjoy!
Radek retweeted
Find a security problem, issue a CVE, and fix the issue without ever leaving GitHub. All while making open source more secure.
Radek retweeted
Hi 👋 we are the GitHub Security Lab. Find more information about us here: securitylab.github.com
Radek retweeted
Burp Suite Pro 2.1.05 released, with experimental support for using Burp's embedded Chromium browser to perform all navigation while scanning. This new approach will provide a robust basis for future capabilities. Feedback welcome if you want to play now.
releases.portswigger.net/201…
I’ve got a message that my article was accepted to the Paged Out! #2 zine 🥳 I can’t wait to see it published! @pagedout_zine
Radek retweeted
Have you ever imagine that @facebook is crawling links in your pdf files when you are sending them via messenger?























