Tal Be'ery

Security Research Manager. 10 times @BlackHatEvents speaker.
Co-Founder @ZenGo acq by @etoro
Advisor @ZeroNetworks.
x-VP Research Aorato, acq by @Microsoft.

[Tal Be'ery @TalBeerySec]

OMG! i'm in RFC! https://t.co/GkNQElULJY

[Tal Be'ery @TalBeerySec]

Even OpenSSH, the poster child of security-oriented architecture, benefited from this attack-surface hardening

[chrisrohlf @chrisrohlf]

Reducing the attack surface of deployed services and apps is a fundamental component of software that is secure by design. Earlier this year we tasked Claude with autonomously mapping and reducing the attack surface of 25 large and widely used OSS codebases. This blog post covers some of our methodology and a preview of the data we collected.

This research resulted in a significant reduction in OpenSSH pre-authentication attack surface (now fixed in 10.6). And over 500 findings where reachability could be reduced and configurations hardened to ensure security controls weren’t silently disabled.

https://t.co/8Iun038PNY

[Tal Be'ery @TalBeerySec]

@arekfurt @thegrugq Great discussion. I think we can only make sense of it if we break the attacker monolith into segments: financially motivated attackers, A-League nation states, B-League nation states, etc.

[Tal Be'ery @TalBeerySec]

Small D Energy

[HD Moore @hdmoore]

https://t.co/fgE40dHDiy

The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).

[Jeremiah Grossman @jeremiahg]

Yes. What he said. And, if you look close, all very knowable in advance when you're able to distinguish between what's possible vs what's probable.

[Tal Be'ery @TalBeerySec]

@arekfurt In other words: the NSA (and the rest of the A league) always had weaponized Chrome, Windows, etc. 0days, well before AI. Probably a few at a time. A few more doesn't help them.
The B league used alternatives: phishing, stolen creds and 1days were already enough.
@thegrugq

[Tal Be'ery @TalBeerySec]

@arekfurt I don't think that vulns or exploits are the limiting factor.
They are (mostly) not the bottleneck.
Therefore adding more of them does not have an (major) impact on the final breach scores.

[Tal Be'ery @TalBeerySec]

@OphirHarpaz לחוקר אסור להבין ב גיט, שנאמר "אל יתהלל חוקר כמפתח"

[Tal Be'ery @TalBeerySec]

@jonasl @GelosSnake @ProferoSec @Mandiant @Volexity @attrc @uuallan @TalosSecurity @RGB_Lights I think defense needs new dimensions. Playing the same game, just with AI on both sides, won't yield great results. We need new cars, not faster horses.
https://t.co/pZNNbUxu8R

[Tal Be'ery @TalBeerySec]

Patching faster won't win the Vulnpocalypse.

Ships don't stay afloat because their hulls are never breached or instantly patched. They stay afloat because their compartments are watertight.

Assume breach. Build compartments: sandboxing, micro-segmentation, isolation.

[Tal Be'ery @TalBeerySec]

IR folks (@GelosSnake @ProferoSec @Mandiant @Volexity @attrc @uuallan @TalosSecurity others, please tag): trying to put numbers on breaches.
Vs. a year ago (or whatever makes sense), how many more cases are you seeing?
Are you really "turning away work" as @RGB_Lights says?

[Rob Joyce @RGB_Lights]

Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. https://t.co/30wJxs7iIY

[Tal Be'ery @TalBeerySec]

@JDeLuccia Not sure what that means

[Tal Be'ery @TalBeerySec]

1/ My new blopost on "Why the AI Vulnpocalypse Isn’t the Breachpocalypse (Yet)?"

TL;DR: The vuln surge (‘The Vulnpocalypse’) is real. The breach surge isn’t. YET. Vulns were never the bottleneck; the economics are.

https://t.co/8cfOctGmiu

[Tal Be'ery @TalBeerySec]

@shmumick @naftalibennett תודה רבה, אבל שבט בארי מאופיין באנשים של מאחורי הקלעים ברובם 😉

[Tal Be'ery @TalBeerySec]

גם אני מתכוון להצביע בנט @naftalibennett

[Tal Morgenstern @TalMorgenstern]

מסתבר שהודעת התמיכה שלי במר בנט התחילה איזה גל קטן.. ככה אמרו האנשים המעולים מהמטה שלו שהתקשרו והציעו שניפגש.
התלבטתי והסכמתי, כדי להגיע לעוד אנשים.
זה אולי אחד השבועות החשובים בהסטוריה של מדינת ישראל - רדו מהגדר!
לכו להצביע ושכנעו את כל מי שסביבכם.

[Tal Be'ery @TalBeerySec]

@Hectaman Thanks.
Can you please elaborate on "threat actors have their own #Accesspocalypse"?

[Tal Be'ery @TalBeerySec]

@Rob_Gurz Good points.
8-K only covers US public companies, but that's a feature: big, heavily targeted orgs, mandatory disclosure, consistent sample. If a breachpocalypse were underway, it'd show up there first.
On model access, see below:

[Tal Be'ery @TalBeerySec]

@GelosSnake @UK_Daniel_Card @ProferoSec @Mandiant @Volexity @attrc @uuallan @TalosSecurity @RGB_Lights What about AI for IR? Doesn't it help in handling cases more efficiently?

[Tal Be'ery @TalBeerySec]

״הבן שלי סיים תואר בהפרדה מגדרית, ועכשיו אנחנו מחפשים מציאות בהפרדה מגדרית שיוכל להשתלב בתוכה״

[♥️𝕋𝕠𝕠𝕝𝕪 @Tal202020]

״הבן שלי סיים מערכת חינוך אנתרופוסופית,
ועכשיו אנחנו מחפשים מציאות אנתרופוסופית שיוכל להשתלב בתוכה״

זה זהב טהור 😂

[Omri Segev Moyal @GelosSnake]

We were turning away work before AI. What changed is the mix, not the exploit curve.

We’re not seeing more 0-days or 1-days in our cases. That CVE spike barely shows up in our IR queue.

What’s driving volume is AI inside the house:

AI-written code shipping more vulns and logic flaws
AI-generated configs leaving things exposed
Agents misbehaving and breaking things on their own. We call it AI-induced destruction.

So yes, AI is the root cause, just not the way people think. Breaches aren’t rising because attacks got better. They’re rising because what we ship got worse.

[Tal Be'ery @TalBeerySec]

@PnL63962200 יש לי תחושה שלא @doritsos בחר את הכותר��

[Tal Be'ery @TalBeerySec]

The @elder_plinius mystery continues..
Will present @BlackHatEvents Europe event, but remotely
https://t.co/6RHsVaNzCb
#BHEU #BHEU26