Kepher

Penetration Tester (Compliance enabler ☺️)
OSCP, CISSP, Python enthusiast.

[Kepher @K3pher]

Amazing feat for first time participants as a team !!

[AshF0x // Peer @0xAshFox]

Also probs to our whole Team and our captain @_superhero1. You are all amazing <3
@sipos_david
@WesVleuten (GL with your OSCP Exam today)
@szymex73
@bs1phc
@K3pher
@w3bf41con
@brahimnah1
@thats4ag2
@S1r1u5_

[Kepher @K3pher]

Do you remember when you joined X? I do! #MyXAnniversary

[Dave Kennedy @HackingDave]

Alright, I've stayed away from the Mythos stuff for a little bit. Going to comment on that, but AI as a whole.

First, this AI industry is absolutely insane. I feel like I'm back in the 90s/2000s with innovation, but it's not tempered or methodical - it's pure chaos.

Everyday there is some AI-dude-bro (or gal) clawing for followers claiming end of cybersecurity, end of software engineering, or this breakthrough changes everything. We're seeing the "streamer" effect of video games now exploding in every industry that hasn't been in whatever industry, but is now a AI-expert thus an expert in anything AI touches because they can prompt.

Largely it's not, but what it is doing is requiring us to understand what AI will do to virtually every industry in the future. I'm sitting here right now at a conference I'm presenting at, and I spoke with an individual which was like man... I'm just trying to get through this SAP implementation at my company, I don't even know where to start with AI at the moment.

We are still in the extreme early stages of what AI can do, and I think that's really the exciting part - we are at the infancy stages of this.

Most enterprise can't handle AI, as most companies couldn't handle agile workflow when it came out either, it took time, but eventually adopted.

I won't dive deep into the scalability of releasing AI to the masses based on compute, power, or subsidies because these are real hurdles we need to solve. As you can see with Claude's spike in popularity is causing them to have to dumb the model down upwards of 65% just to stay afloat (Claude is absolutely awful right now for coding - beware).

Mythos is cool, really cool - but it's not earth shattering as claimed. The potential here we are seeing a glimpse of what can actually happen though.

The ability to do extremely complex tasks, with insane context windows, and high-end reasoning. But, what we saw from other current frontier models including open LLMs, they were able to find the same issues, but had to be specifically targeted towards those code sections because of context limitations and complex task reasoning which was drastically improved in Mythos.

What does this mean? Basically. Nothing. It's a lot of marketing hype - but it does prove out that as these models become smarter, it will inevitably produce much better code, be able to work in mind blowing fashions that we haven't seen before - but it will all come down to cost. Right now Mythos is extremely expensive because of the compute needed, and we may solve that over time, but it's not there yet.

The subsidies right now means AI is not ready. Scale is our biggest bottleneck right now and until that's solved, the industry will not move as fast as it could.

What's particularly impressive is how the open models are starting to perform on par (or better) with the frontier models and become way more efficient without restrictions (turboquant) as an example.

Our ability to use near parity models on our own hardware will only continue to get better which is a huge threat for these companies. I at first looked at Cursor's implementation of Kimi as they were falling behind because it wasn't "their own model". That wasn't accurate, its that the open models are performing substantially better than from 6 months ago, and will soon be leading the charge or close to it.

What does this mean for cybersecurity? The industry is changing rapidly, and I absolutely freaking love it. We needed a swift kick in the ass in this industry that was largely stagnant for the past 10-15 years.

What used to be a handful of incredibly talented security researchers that knew systems internals, savants at reverse engineering and reading through millions of lines of ASM is now being afforded to the masses, but still has a long way to go.

The reason AI is so good at doing this stuff is because they paved the way, and will continue to do so in different ways. Not eliminated or removed, enhanced and better than ever. AI is single handedly the largest theft of plagiarism that has ever happened in human history. I just got a 10K check from Claude for ripping off my Metasploit book to train its model to be smarter actually :P

I am all for things that make the world a safer place. Our goal in cybersecurity is to fix the world, make it less harmful when using technology - we should be adopting this. Note that it's going to come with a ton of fluff, hype, doomsday predictions, people that are now AI exports or coding experts but have never written a line of code themselves. That's all to be expected if you have ever been to an RSA conference. AI will product meaningful change in an industry that needed it.

Cybersecurity is much more than bugs or defects, it's protecting against risk. AI is a new emerging risk, it's going to keep us insanely busy right now, and for the foreseeable future.

[Kepher @K3pher]

@nikhil_mitt Thank you for the giveaway.

[Michael Bargury @mbrg0]

we got a persistent 0click on ChatGPT by sharing a doc

that allowed us to exfiltrate sensitive data and creds from your connectors (google drive, sharepoint, ..) + chat history
+ future conversations

it gets worse. we deploy a memory implant

#DEFCON #BHUSA @tamirishaysh

[Anthropic @AnthropicAI]

Claude Code can now automatically review your code for security vulnerabilities.

[Kepher @K3pher]

@varseand @offsectraining Best wishes towards getting your OSCE3 then.

[Kepher @K3pher]

@Jhaddix @bsdbandit That's inspiring

[Kepher @K3pher]

@nikhil_mitt @AlteredSecurity 0x41414141 TCP one liner revshell FTW

[Kepher @K3pher]

Amazing thread

[Navin Kabra @NGKabra]

Who are Indians descended from? Aryans from Europe? Dravidians who've been "here" forever? The Indus valley civilization?

A controversial question for 150+ years, but now we have DNA evidence that answers these questions with a high degree of certainty.

🧵

[Kepher @K3pher]

@Jr0dR87 🙏🙏

[Kali Linux @kalilinux]

The xz package, starting from version 5.6.0 to 5.6.1, was found to contain a backdoor. The impact of this vulnerability affected Kali between March 26th to March 29th. If you updated your Kali installation on or after March 26th, it is crucial to apply the latest updates today.

[Kepher @K3pher]

@Andy_Thompson That seems like Westin Powai?

[Kepher @K3pher]

@philvenables Thank you for sharing

[Steve Campbell @Historian_Steve]

Your periodic reminder that less ice at the Arctic is consistent with a weaker jet stream that allows cold air to drift down into the Great Plains.

The frigid temps you're experiencing happen BECAUSE of a warming planet, not in spite of it.

[KSR @KShriniwasRao]

The more India play Test cricket in SENA countries these next two years, the more India will miss Virat Kohli the captain.

This is just the beginning.

[Kepher @K3pher]

@DanielMiessler Thanks and wish you the same.

[Kepher @K3pher]

@vikramsathaye On point on the quality of players. It appears that some teams just managed to gather members to represent them in the world cup.

[FIRST.org @FIRSTdotOrg]

The CVSS Special Interest Group is proud to announce the official release of CVSS v4.0 - https://t.co/xxaoQ2iMjF. This latest version of CVSS seeks to provide all users with the highest fidelity vulnerability assessment.

#FIRSTdotOrg #CVSS #BuildingTrust #PSIRT #CSIRT

[Kepher @K3pher]

@theliverdoc More power to you !!

[Blake @UnsaltedHash42]

Well didn't expect to get laid. I've loved my time at Truesec and I planned on finishing my career there, but was informed that all consulting services in the US are done. If anyone needs a 7 year experienced red teamer who loves what they do, please inbox me. Please retweet. ♥️