Blake Darche

Cloudforce One @Cloudflare, Advisor/Investor, Ski Patroller, Formerly Co-Founder/CSO @area1security, formerly @CrowdStrike, @NSAGov Hacker.

[Blake Darche @BlakeDarche]

https://t.co/5C5isE4hWX

[Max Musgrave @maximusgrave]

I just got a cease and desist letter from Delve's legal team about the parody video I made...

[Blake Darche @BlakeDarche]

If true, this is wild!

[Ryan @ohryansbelt]

Delve, the YC-backed compliance startup that allegedly faked hundreds of SOC 2 and ISO 27001 audits, is now accused of stealing a fellow YC company's IP. According to Part 2 of DeepDelver's Substack series, Delve took SimStudio's code, removed attribution, rebranded it "Pathways," and started closing $50k-$200k+ enterprise deals with it while telling Sim's founders the ROI wasn't there for a partnership. Here's the breakdown:

> Sim (YC X25) signed on as a Delve compliance client for $15k covering SOC 2 Type 1, Type 2, and HIPAA. CEO Karun Kaushik personally promised to handle onboarding

> During that same April 2025 sales call, Karun posted a SimStudio link internally with the note "ui inspo for pathways"

> Linear tickets referencing "sim studio" under the Pathways project started appearing that same month. An internal Notion doc titled "Sim Studio Port Plan" lists specific folders to copy, including blocks, components, the executor, tools, handlers, and database schema
Delve's production code still contains SimStudio references and docs[.]simstudio[.]ai URLs

> When Sim's CEO @Emkara tried to sell Delve a licensing deal, Karun said it didn't have "high enough ROI rn" and stopped responding

> Sim had no idea Delve was selling their product as Pathways until DeepDelver's Part 1 article. Emir confirmed over email that no white-label or attribution agreement existed

> Leaked pitch decks show Delve selling Pathways to Brex, Anthropic, Gusto, and Notion. The Notion deal was $50k+

> The Brex deck promises Pathways will make their GRC team "AI native" and includes a 50%+ partnership discount

> The Anthropic deck, dated January 9, 2025, proposes a 1-2 week PoC with named Delve staff building custom Pathways workflows

> Delve outsourced Pathways maintenance to a dev shop in Bangladesh

> Sim's open source license required attribution. Delve removed it, told clients they "built it from the ground up," and did not disclose Sim's code during Series A due diligence

[hari raghavan @haridigresses]

The Delve scandal is the perfect excuse for me to write my long-simmering rant about SOC-2 and InfoSec.

1. 90% of SOC-2 is security theater. We couldn't pass audit until we had completed an annual performance review (absurd requirement for a team of 4). It is mind-boggling to me that we collectively decided to adopt an accounting framework (and accounting firms) to validate infosec.

2. SOC-2 startups are (at least in part) culpable for this mess, thanks to Jevon's Paradox. It's now "easier" to get it, so getting the certification is table stakes for an enterprise contract.

"But Hari, startups can now sell to enterprise more easily" — nope.

3. I would argue that the approach for selling to enterprise was *better* prior to 2017:
— Enterprises were more open to doing pilots without SOC-2, because it was harder to do and not table stakes. This is, obviously, a more efficient way to transact and explore ad hoc relationships.
— You'd simply have to do actually useful things like pentesting, security questionnaires, etc. to show you were serious about security... which you have to do today anyway, because SOC-2 is a terrible proxy for real security.

And enterprises have gotten easier to sell into, because they realized they need to be more tech forward. Correlation, not causation.

SOC-2-as-table-stakes killed a more pragmatic, trust-based sales motion. All in all, the introduction of SOC-2 as an industry standard introduced *more* friction into the process, racked up *higher* costs for their customers, for ultimately the *same or worse* security outcomes. We would all be better off if we threw the standard in the trash, because then we might actually come up with something sensible.

4. Perhaps the Delve takedown was penned by a competitor, but — if the facts hold up — that doesn't make it any less valid. This is a wildly competitive space, and I've seen some truly nasty stuff happen, from an observer's seat. But people are using that to discredit the piece, even though the facts so far are pretty damning (regardless of the biases of the speaker).

5. All of the SOC-2 companies are roughly equivalent (no matter what they tell you), and you should optimize for a good service at a reasonable price and grit your teeth and get it done when you think you have enough PMF where enterprises might want it.

6. Don't even get me started on GDPR and CCPA. Cookie banners take quality-adjusted years off peoples' lives, just like cigarettes and the DMV. And just like SOC-2 is security theater, they are privacy theater.

7. Most importantly: getting dinged because you didn't pass security reviews has nothing to do with security. It means your buyer / champion didn't care enough to push it through. If you're sorely lacking, it might be an actual issue. You should (obviously) do the important stuff (vulnerability scans, pentests, 2FA, be careful with phishing), but after that...

Spend your time building something that buyers want to rip out of your hands. Your security problems will start disappearing.

[Disclose.tv @disclosetv]

JUST IN - U.S. Cybersecurity and Infrastructure Security Agency quietly purchases "https://t.co/ijZjwdSJzg" domain name.

[Matthew Prince 🌥 @eastdakota]

One advantage of @Cloudflare Workers defaulting to Region:Earth is that you’re not dependent on your availability zone not getting hit by a suicide drone.

[Blake Darche @BlakeDarche]

@0xdabbad00 @ejcx_ It turns out the AWS data center model isn’t very scalable for war. The design is inherently flawed.

[Blake Darche @BlakeDarche]

Job market for cyber security will only grow. You figure every vibe coded app by a non skilled engineer is likely vulnerable to exploitation….

[kanav @kanavtwt]

incredible things are happening on linkedin

[Who said what? @g0njxa]

These fake Fortinet websites, still present on top browser search engines results, are now delivering a fake FortiClient app, signed "Taiyuan Lihua Near Information Technology Co., Ltd. (Certum-given)"

Its a phishing app, that will send credentials to vpn-connection[.]pro

Based on other signed files with same EV cert, recently the TA were also spreading applications impersonating Sophos, WatchGuard and Ivanti.

Analysis: https://t.co/CKyprHs5US

[Blake Darche @BlakeDarche]

The future of the security practitioner profession is very bright.

[Pop Punk @PopPunkOnChain]

If you want free API keys just open the network tab on literally every vibe coded app.

In the last 24 hours i've looked at the requests of every vibe coded app I see and 9 times out of 10 they're leaking private credentials.

[Blake Darche @BlakeDarche]

It’s not typically wise to your your own protocols and this is a good example of why.

[Stanislav Kozlovski @kozlovski]

An incredibly awful security vulnerability just got revealed in MongoDB.

So much that it got named after HeartBleed.

MongoBleed is a vulnerability affecting all MongoDB versions from 2017 to... today.

The exploit is simple. It's a buffer over read bug due to compression. Here's how it works 👇

Clients can send compressed requests to MongoDB.

The client helpfully includes the uncompressed size of the message so the server knows exactly how much memory to allocate when decompressing.

The server allocates a memory buffer with the given space. Due to how memory management and garbage collection in programs work, this allocated memory may already contain sensitive information that was copied earlier and is considered garbage now (eg because it's unreferenced).

This is technically fine - every computer program works that way because it is assumed that whatever unclaimed memory exists there will be overwritten. Unfortunately that’s exactly where the bug lies. 🙃

The server stupidly trusts the client’s provided uncompressed size. When a malicious client lies about the uncompressed size - e.g the actual decompressed size is 100 bytes, but the client says its 1MB - Mongo will treat the full 1MB block as the message.

It will unload the 100 byte decompressed msg into the buffer, yet treat the full 1MB block as the msg.

This is extremely problematic if you can get the server to return back parts of the 1MB block, because it could contain data you may not have access to.

That is exactly what the exploit does - it sends a badly-formatted BSON message. The server fails to parse it, and "helpfully" returns an error message containing the invalid message. The invalid message can be that whole 1MB block of foreign data.

To understand the exploit a bit better, you need to understand the MongoDB protocol.

• Mongo also uses its own TCP wire format (i.e doesn't use HTTP, gRPC or the like).

• BSON is Mongo's message format passed within the TCP wire format. BSON is basically JSON in binary form

• Commands in Mongo don't have particular endpoints or RPC names - rather, they are simply JSON-like messages. The action is inferred from the first key of the JSON.

For example, an insert request looks like this:
`{ "insert": "users", "documents": [ { "name": "alice", "age": 30 } ] }`

Every request to the server is therefore decoded into the BSON format as it’s parsed.

Critically, BSON parsing of field names (which are strings) work by parsing the field until you hit a null terminator byte (0x00).

It works exactly like strings in C, which have their own rich history of vulnerabilities.

We can now tie things together:
1. The client lies to the the server that its request has a big uncompressed size, so the server allocates a large block of memory
2. The client sends an invalid BSON with a field which does NOT contain the null terminator (0x00)
3. The server naively tries to parse the BSON field in that allocated block until it hits the first null byte. The first null byte is encountered in some foreign data since the BSON literally doesn't have it
4. The server realizes this is a completely invalid BSON message so it responds with an error.
5. The error response contains the invalid BSON "field". Critically, the server parsed garbage data from the heap in step 3), so it returns that data in the response.

Congrats. If the garbage contains passwords or other sensitive info, you’ve hacked MongoDB!

Hackers exploit this by sending many malicious requests per second and then attempting to reconstruct the pieces of garbage they received back.

What’s critical about this vulnerability is that it works on ANY internet-accessible unpatched instance of MongoDB. 💀

You don’t need to authenticate with the server, because this whole request/response parsing cycle happens before the server can even authenticate.

Obviously you can’t authenticate a malformed request which doesn’t contain credentials - so that path of the code never gets executed.

The server simply responds with an error response. It just so happens that this error response can contain sensitive data. 🤷‍♂️

Merry Christmas

[Cloudforce One @Cloudforce_One]

UPDATE: Early activity indicates threat actors quickly integrated React2Shell into scanning routines, targeting critical infrastructure like nuclear fuel and uranium. React also disclosed two new vulnerabilities today—Cloudflare protects against all three. https://t.co/LSdi6XbuLe

[Cloudforce One @Cloudforce_One]

Update: on 10/22/2025, IP address 3[.]239[.]45[.]43 made use of an AI LLM as part of the campaign to target a SaaS vendor environment

[Cloudforce One @Cloudforce_One]

URGENT SECURITY ALERT
IP address 3[.]239[.]45[.]43, associated with the recent Gainsight security breach, has been observed across hundreds of non-Salesforce environments globally.

[Oren J. Falkowitz @orenfalkowitz]

While niche, the community of patriots seeking to farm after distinguished service is large.

[Blake Darche @BlakeDarche]

@MaziyarPanahi @AnthropicAI @Google @OVHcloud Checkout Cloudflare Access. You can prevent anyone but you from reaching your server!

[Blake Darche @BlakeDarche]

Truly concerning. It appears these actors worked at Sans! What is going on here?

[Adam Chester 🏴‍☠️ @_xpn_]

SANS scrubbing that shit from their profile page xD https://t.co/Jz59HmVoly

[Cloudforce One @Cloudforce_One]

Today, we're announcing new incident response and advisory services. Our experts provide on-demand support to help organizations prepare for and recover from security crises. https://t.co/JC8zDUGDtT

[Blake Darche @BlakeDarche]

@CBP Watching a US Agency publicly post LES and FOUO in the public domain: PRICELESS.

[Blake Darche @BlakeDarche]

@USCIS Watching a US Government agency publicly post a document labeled FOUO in the public domain: PRICELESS.

[Blake Darche @BlakeDarche]

@NickeNumbers @Cloudforce_One @cloudf It’s true. The art is so good. Thanks to @kkblinder and team.