Cem Paya
@randomoracle
Followers
2K
Following
8K
Media
797
Statuses
10K
@[email protected] Personal opinions “Character is what you tweet when you think no one is following" ex-MSFT/GOOG/ABNB/Gemini
San Diego, CA
Joined December 2008
“The Lifetime Achievement Award isn’t about what you achieve in your lifetime. That’s part of it. It’s about how many people you influence and bring in and then take it further.” - Mudge Zatko It was our honor to present the Lifetime Achievement Award to @dakami Dan Kaminsky at
1
11
12
A deeper, more technical dive into a design flaw in the ScreenConnect executable that made it particularly appealing for malicious campaigns. https://t.co/oVl52GdmYq History Case: https://t.co/g1lz3jbm4i
0
17
44
Now that GDATA also posted about this and cat is out of the bag. Write-up on how ScreenConnect was abusing Microsoft Authenticode signatures in a way that made it ideal for malware to repurpose their installers (previously disclosed to vendor) https://t.co/PfmxXFlDKQ
blog.randomoracle.io
(Lessons from the ScreenConnect certificate-revocation episode) An earlier blog post recounted the discovery of threat actors leveraging the ScreenConnect remote assistance application in the wild,…
0
2
8
1/ 🔥 AI agents are reaching a breakthrough moment in cybersecurity. In our latest work: 🔓 CyberGym: AI agents discovered 15 zero-days in major open-source projects 💰 BountyBench: AI agents solved real-world bug bounty tasks worth tens of thousands of dollars 🤖
28
152
542
Recent work from River security team and @rmhrisk : how our discovery of bogus "River desktop app" in the wild lead to DigiCert revoking ConnectWise's code-signing certificate and invalidating all existing ScreenConnect binaries on Windows https://t.co/YWB4BVh8ie
blog.randomoracle.io
An unusual phishing site In late May, the River security team received a notification about a new fraudulent website impersonating our service. Phishing is a routine occurrence that every industry …
0
1
2
Mangled casings from 2 of those 4 thermonuclear weapons from the Palomares (Spain) broken-arrow incident is on exhibit at the Museum of Nuclear Science & History in Albuquerque. https://t.co/dmYH1VdxUn
nuclearmuseum.org
In this exhibit, visitors will learn how close we came to another war before the end of the Cold War.
Today in history. “We thought it was the end of the world': How the US dropped four nuclear bombs on Spain in 1966
0
0
1
Thoughts on ByBit First, the good stuff: impressive response to the hack. I've rarely seen that level of transparency + professionalism in a crisis. Usually you see slow, wishy-washy, lawyer-speak or quick meme-style responses that don't fit the seriousness of the situation. 1/n
2
1
4
Learned a lot about security from @randomoracle @michaelbreu back in the day. Lesson one is anything that can be penetrated will be. Software and hardware, and the practices around them, must be resilient & redundant. Every step must have integrity. No shortcuts.
Safe multisig smart contracts worked fine, and Bybit still got hacked. This is equivalent to a lending market's messing up the configs. Security is just a beast in itself and it can't be reduced to one single factor like smart contract audits. You have to do them all right.
1
1
5
Until October 30, Okta generated "the cache key" by using bcrypt to "hash a combined string of userId + username + password", which allowed full password auth bypass for usernames of 52+ bytes and apparently required only partial knowledge of the password for other long usernames
Okta allowing login bypass for any usernames with 52+ characters is insane Official Security Advisory: https://t.co/3b4v30q53z
1
6
19
1988: The Morris worm spread like wildfire and was the first worm to get wide media attention. After its author, Robert Tappan Morris, released his "experiment", it quickly spread and made many of the systems on the Internet unusable - an epoch for security...both good and bad.
2
55
141
🎉 Thrilled by the incredible enthusiasm for our LLM Agents MOOC—12K+ registered learners & 5K+ Discord members! 📣 Excited to launch today the LLM Agents MOOC Hackathon, open to all, with $200K+ in prizes & credits! 🔗 Sign up now: https://t.co/3kKLQYjAmg & join us virtually or
17
108
391
#ECJ upholds the fine of €2.4 billion imposed on @Google for abuse of its dominant position by favouring its own comparison shopping service #competition @EU_Commission 👉
30
112
145
So-called experts: "Tornado Cash is a valuable privacy service used by everyday people for legit purposes" Reality: #delusions #KYCfail
https://t.co/FYrnKix0gV
coindesk.com
The Indian crypto exchange was hacked for over $230 million in July, and a restructuring process is underway in Singapore.
1
0
0
Identity fails With Twitter verified profiles, users at least have some confidence they are following the genuine bloviator/influencer On GitHub still no way to know if that ace developer is really a North Korean stooge/APT operative 🤷🏽
1/ Recently a team reached out to me for assistance after $1.3M was stolen from the treasury after malicious code had been pushed. Unbeknownst to the team they had hired multiple DPRK IT workers as devs who were using fake identities. I then uncovered 25+ crypto projects with
0
0
0
JD Vance’s dossier would have been safe if the campaign stored it on CouchDB 🤷
thedailybeast.com
The Trump campaign announced it had been illegally hacked by “foreign sources” that leaked internal documents to news organizations. Iran is the prime suspect.
0
0
0
#Clownstrike: "Combining third-rate technology with first-rate lawyers: always ready with a DMCA takedown notice in case anyone dare criticize us" https://t.co/oyVlSe852D
arstechnica.com
Parody site ClownStrike defended the "obvious" fair use.
0
0
1
The https://t.co/QAEyz82xnv service has an open API interface for mass scanning. By today, 7550 unique FW images had been checked, and 534 (7%) contained non-production keys or were exposed to the #PKfail. The detected keys are associated with AMI (majority), Insyde and Phoenix.
1
5
13
"Creating our own bytecode VM for detection rules will be much safer than constantly writing new code for kernel mode 💡" — said someone somewhere at #Clownstrike
0
0
1
@randomoracle @rmhrisk It would be a different story if Google allowed GrapheneOS to pass the device and strong integrity levels via the hardware attestation API but added an extra field in the response saying that the OS is GrapheneOS. Apps could go out of the way to ban it if they wanted.
1
1
4
Sign of incompetent vendor: Puts more effort into cease & desist orders against obviously non-infringing parody/satire than improving their weak-sauce technology that caused a global IT outage #Clownstrike #DumpsterFire
1
1
5