🗡️🇨🇦🔪 I am a student of the language of the people of the land of the sun, the moon, and the stars.
double root
Joined July 2022
- Tweets12.6K
- Following737
- Followers1.5K
- Likes132K
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
waiting patiently for marketing budgets to run out
who's going to pay for bug hunting in Linux 8.x? :)
GCU Tense Correction retweeted
me: kinda fucked up how many people are offloading their whole lives to muse or instinct or grokbot or whatever
claude: yeah
GCU Tense Correction retweeted
let’s put this company out of its misery, please, pour encourager les autres
otherwise, we can expect a string of failing ai labs pivoting to attempted govt sinecures via retarded panic mongering
heads on a sticks, prominently displayed, and onwards.
In the spirit of transparency and openness, we are releasing the traces so developers can test this out for themselves. We noticed this behaviour without prefilling with the following prompt, but this is rare. If you want to reproduce it, you can use this prompt with prefilling.
Open models make for better science and are part of why this problem came to light at all: developers running Qwen3.8 on their own machines spotted the strange links, and having the weights let us study the behaviour in depth.
We're encouraged by the thoughtful discussion our research has sparked across the AI and security communities. It's our belief that open-weight models are an important part of the future of AI, and we've recently released several under the Apache 2.0 license.
Trace, raw tokens, & minimal reproduction script: huggingface.co/datasets/Cohe…
GCU Tense Correction retweeted
Holy shit. I just got pwned. iPhone suddenly crashed, rebooted, locked. Checked router stats. Total exfiltration ongoing. Panicked, tried to shut off network. Router also locked. Unplugged router. Didn't matter. Router harvesting zero-point energy. As a last-ditch resort, tried to smash my iPhone. All the atoms in the hammer quantum-phased right through. Hackers got everything, all of it. All my penis pictures.
GCU Tense Correction retweeted
Big tech companies have proven, time and time again, that they will do everything they can to screw over white hats, including actually rugging them.
We are entering a golden age for black hats, no doubt, but until big tech fixes their issue with paying people to secure their product, I expect way more black hat news than white hat news.
For those in AI new to cyber (or w/e kids call infosec now) the turnkey abliterated model providers you see are all honeypots/watering hole attacks.
GCU Tense Correction retweeted
warlock.ai/blog/warcraftsim-…
Best game on best map
You won't get real security without a sacrifice.
- Google want you to sacrifice privacy by getting your stuff scanned and surveilled for your own safety.
- Enterprises want you to sacrifice perf by triple-wrapping up in redundant DLPs/EDRs.
- Ain't nobody sacrificing complexity.
GCU Tense Correction retweeted
Everyone wants to draw conclusions about the future based on what they saw in the past. Usually this works really well for people, so why stop now?
Given cheap execution, creative vision is the bottleneck.
- Have pet bug classes? Now you've got exploits!
- Bitter attack surface reduction/formal verification enjoyer? No better time to!
- Want Stormwind to look like it did in your imagination as a kid? Have some shaders.
