Michael Coates

CyberSecurity & Innovation - Former: CISO @Twitter, @Mozilla, @Coinlist, Chairman @OWASP, Startup Founder (Acquired) | Seven Hill Ventures

[Michael Coates @_mwc]

Honored to testify to Homeland Security and joint session on AI, Quantum and Cybersecurity. Full info below

[Michael Coates @_mwc]

@solana 🚀

[Solana @solana]

BREAKING: Mastercard is introducing always-on stablecoin settlement on Solana.

3.7 billion cards. 210+ countries. One of the largest payment networks on earth, now settling onchain.

[Michael Coates @_mwc]

@patelmtl Yea I see the race for human liveness during KYC to be a solution that is needed in enterprise account recovery processes.

World ID is definitely one approach that could work. Just needs enterprise buy in first.

[Michael Coates @_mwc]

If your account recovery process is automated end to end with proof of human checks, your AI detection better be good.

For instagram it wasn't good enough....

Many high profile attacks stolen via account recovery flow.

[André @oracles]

Today Instagram had this massive exploit where hackers were just stealing rare handles left and right. Hundreds of accounts gone.

People losing handles they’ve owned since 2010, some worth hundreds of thousands.

I own a few rare ones so I was actually stressed watching this happen in real time, which I haven’t been in years.

Obama White House account got hit.

These aren’t some random new accounts, these are verified, locked down accounts and they still got compromised.

The thing is the exploit is so simple it’s almost funny. Attacker goes to Forgot Password, says their account is hacked, turns on a VPN to match the target’s location (which now you can find on the about section of the page).

Instagram’s AI support flow asks them to verify with a selfie.

They grab a photo from the target’s profile, run it through an AI video generator to make an animation of the person’s face moving around, upload that to Meta’s AI as proof.

And Meta’s AI just accepts it because it can’t tell the difference between a real selfie and an AI-generated video of someone’s face
.
Once verified they change the email to theirs. Password reset link goes to their email. They own it now. 2FA gets bypassed somehow in the process but honestly I don’t know exactly how, just that it did.

Point is even locked down accounts went down.

Then you try to recover your account and you’re talking to a chatbot that has zero ability to help.

You can’t escalate to a human. You’re just stuck. Your asset is gone and there’s no one to call.

The whole thing just highlighted how stupid it is to automate account security without any human in the loop.

One AI fooling another AI while there’s literally no person anywhere to catch it.

Meta took hours to even acknowledge it while accounts were getting stolen every minute.

Now thankfully it’s patched but I don’t think it will be the last one. Stay safe!

[Xavier Rivera @XavierRiveraX]

Google Chrome is rolling out device-bound session credentials to all users. Session cookies get cryptographically tied to your device, so stolen cookies can't be replayed from a different machine. Attackers who exfiltrate your cookie database get nothing usable.

[Solana @solana]

BREAKING: @SoFi launches SoFiUSD (SoFiD) on Solana.

The first stablecoin issued by a U.S. nationally chartered bank.

[Michael Coates @_mwc]

Love the tracking and transparency

[Alex Matrosov @matrosov]

Follow every Mythos discovery through our coordinated vulnerability disclosure dashboard.

https://t.co/xri3fTpf77

[Perplexity @perplexity_ai]

Today we're open-sourcing Bumblebee, a read-only scanner for macOS and Linux.

It checks developer machines for risky packages, extensions, and AI tool configs.

Connected to Computer, it can trigger deeper scans whenever a new supply-chain risk emerges.

https://t.co/FOaWnF1yQy

[Dino A. Dai Zovi @dinodaizovi]

There are a lot of interesting things for defenders to study and learn from in this full end-to-end attack path.

My guess: compromised developer poisons NPM module, which gets used by a VS Code extension, poisoning it. GitHub developer installs VS Code extension, runs infostealer. Stolen tokens used off-target by attacker.

[Michael Coates @_mwc]

Looking at individual vulnerabilities and CVE/KEV is rudimentary and antiquated.

The future is attack chains mapped to threat exposure and root business impact.

That “informational” risk may be harmless on its own but actually a key piece of a critical attack chain.

[The Kobeissi Letter @KobeissiLetter]

BREAKING: The SEC is set to release its so-called "innovation exemption" for tokenized stocks which will pave the path for trading digital versions of securities, per Bloomberg.

Details include:

1. In a "surprise move," the SEC is leaning toward allowing the trading of tokenized assets

2. These tokenized assets would be tradeable on decentralized crypto platforms

3. The move could "reshape the landscape of the American stock market"

4. This would also be one of the US' biggest shifts into crypto infrastructure yet

Tokenized assets are rapidly expanding.

[Grafana @grafana]

🚨 We recently discovered that an unauthorized party obtained a token with access to the Grafana Labs GitHub environment, enabling the threat actor to download our codebase. (1/6)

[Michael Coates @_mwc]

@PalantirTech Looking forward to digesting this.

[CoinList @CoinList]

CoinList was founded on the belief: the next generation of financial opportunities should be open to all.

After launching protocols from @Solana to @Ondo, we’ve built Passage by CoinList: the access layer for onchain capital markets.

[Michael Coates @_mwc]

Thinking about “harvest now, decrypt later” way back in 2009. Certainly others were too. But a far greater point of discussion these days.

[Michael Coates @_mwc]

What do we do when today's crypto is cracked in 20 years? Are we comfortable with the data being exposed? Blog http://tinyurl.com/c5qtvb

[Dino A. Dai Zovi @dinodaizovi]

Defenders need to read and then re-read this first sentence and then think about what it means when a "market" is flooded with exploits...

[Michael Coates @_mwc]

@dinodaizovi @edskoudis Definitely agree. The likely point of exploitation is public facing. Cut that down as much as possible.

Similarly for critical internal systems, does it really need to be accessible to a wide audience even if gates with login?

Defense in depth strikes again!

[Huntress @HuntressLabs]

ShinyHunters targeted Instructure with an extortion attack, disrupting access across more than 8,800 schools and other orgs that rely on the Canvas learning management system.

[Michael Coates @_mwc]

How I stay current https://t.co/50i4B8JOpl

Daily podcast covering top news in CyberSecurity and AI