Ryan Basden

Head of OffSec @xorasecurity

[Ryan Basden @_rybaz]

@noperator @kyleavery It’s really best to prepare for the advent of dystopian hive cities

[Ryan Basden @_rybaz]

@gymR4T @HackingLZ How very not red team of them

[ThePrimeagen @ThePrimeagen]

Monorepos were always an anti-pattern

[Ryan Basden @_rybaz]

Higher post character limits will either be one of the best things for my career or one of the worst.

[Ryan Basden @_rybaz]

@ecology_chris There's nothing you can do for the first group anyway. They'll do it with you or without you. Some clients are okay with the bottom of the barrel, and I'd rather take the chance to help them succeed in the future than turn them down completely.

[Ryan Basden @_rybaz]

@AccidentalCISO @ZackKorman I'm also not here to start shit on the internet, ya know? I did my time in the compliance and vCISO trenches. The number of people I've come across in that time who fundamentally misunderstand the basics of compliance while shitting on the whole idea is really too high to count.

[Ryan Basden @_rybaz]

Most of the compliance bashing I see comes from technical people who have taken the vendor bait and don’t realize it.

Standards organizations create frameworks for baseline assurances, middle men oversell them as effective and necessary security measure, companies believe them and base business decisions on them, someone gets hacked, then everyone criticizes the frameworks for not being what they never were.

Compliance is a huge part of diligence, it doesn’t even always have something to do with infosec, and discounting the overhyped simulacrum of the whole enterprise is naive and irresponsible.

If you’re a technical person, and you want to affect change in an organization, you have to learn to speak the language of the business which, like it or not, is a lot of compliance.

Criticizing things you clearly don’t understand and whining when people don’t take you seriously is a bad pairing.

[Accidental CISO @AccidentalCISO]

@BVeiseh @sherrod_im This is a topic that is hard to discuss in this format. I don't think I'd say it's complacency, so much as a confluence of the market not understanding what SOC 2 is and is not, and vendors using it in bad faith.

[Ryan Basden @_rybaz]

@dmcxblue All of those, plus Python dependency management makes me want to jump off a bridge

[Ryan Basden @_rybaz]

If you criticize a compliance framework for not accomplishing what it was never designed to accomplish, I have to assume you don't know what the framework says or what it's for. You actually *can* estimate what someone knows about a thing based on how misguided their criticisms of that thing are.

[Ryan Basden @_rybaz]

@Yuchenj_UW Take note, @ProtonPrivacy.

[Ryan Basden @_rybaz]

Remember everyone, working as intended. This is definitely what you're supposed to be able to do by design. Nothing to see here. Don't even ask.

Please don't ask.

[Graham Helton (too much for zblock) @GrahamHelton3]

Tomorrow I'll be walking through the Kubernetes nodes/proxy permission attack path on stage at @KubeCon_ .

Here is the tool I created during the disclosure process as my POC || GTFO.

It allows you to spread through an entire cluster using the techniques I'm discussing.

[Ryan Basden @_rybaz]

@_xpn_

[Ryan Basden @_rybaz]

That selling and marketing unfortunately is done by the companies doing the audits and readiness prep, not the standards bodies themselves (AICPA and ISO, respectively).

As soon as it became a “business enabler” to do compliance, which practically speaking just means offloading incident liability to someone else, it became fodder for sales and marketing departments.

[Ryan Basden @_rybaz]

Some friends of mine are already dealing with downstream data leaks. Plenty of software companies are using Fireworks in their stack. Those companies ALSO had ZDR in place, and now customers who have never heard of Fireworks but have used some SaaS tool for proprietary and private information that is now, presumably, not private.

Were they just passing along all the ZDR policies of their upstream vendors to their customers and assuming that because handled in the stack, they didn’t need to ensure data deletion was actually happening?

This will be interesting to watch. If you’re an AI lab or an on-demand reseller of abliterated Chinese models and you get hacked, the data impact better be super low if you have ZDR policies and agreements with customers.

Would love to know how services like @abliteration_ai and @adverserialAI are ensuring true zero retention. I would like to use these services to get around the safeguard bullshit from time to time, but there’s gotta be some more trust basis.

[Stephanie Palazzolo @steph_palazzolo]

Fireworks, the most highly-valued out of a growing group of inference providers, told customers including Harvey that it had been hit with a hack that exposed customer data. Some customers are now considering moving their business off the platform.

https://t.co/r33EeFDygx

[Ryan Basden @_rybaz]

@ZackKorman @Cl0uddStrife I’ve seen so many people talking about EDR being too risky to have on machines that I’m starting to think it’s a psyop

[Ryan Basden @_rybaz]

@hasherezade This is probably my biggest worry going with Acer or Asus to get access to a Blackwell since stock is so low everywhere.

[Ryan Basden @_rybaz]

Talked to someone a couple weeks ago in SF who wrote a Club Penguin-like frontend for a C2 where killing a beacon amounted to a penguin getting merced by a tiger seal.

OST needs more things like these.

[alexine 🏴‍☠️ @alexinexxx]

i built a kubernetes operator in Go that maps each pod in a StatefulSet to a zombie in fake Minecraft

killing a zombie deletes its pod. when k8s recreates the pod, the zombie respawns !