Anthony Weems

Cloud Vulnerability Research • The opinions stated here are my own, not those of my company.

[Anthony Weems @amlweems]

Learn how Google CVR could have potentially exfiltrated Gemini 1.0 Pro before launch last year. We describe the vulnz, the fix, and tips for bughunters. Also, shout-out to @epereiralopez for teaming up to adapt this work to another cloud provider.

https://t.co/65PY5o3mtV

[Google Cloud Security @GoogleCloudSec]

Today our Cloud Vulnerability Research (CVR) team shared this research into LLM security, which is broadly applicable to AI domain security practitioners working in this rapidly evolving space.

Learn more: https://t.co/QtcOoDKgez

[Wiz @wiz_io]

Introducing https://t.co/iULfuMrtEd🕵️‍♀️
Be the first to participate in the first-of-its-kind cloud hacking competition. 🤝

WIN PRIZES from our 4.5M$ prize pool. 💰

Register your exploit > https://t.co/pr7GC5uRqu

@msftsecresponse @awscloud @googlecloud

[Anthony Weems @amlweems]

🕺"Leaving tradition" is one of the best parts of Google's security culture and has led to some of the most interesting attack chains I've gotten to work on. There's nothing quite like starting with a blank slate and ending with a root shell.💃

[Google VRP (Google Bug Hunters) @GoogleVRP]

Celebrating 15 years of password hacking 💻 🔑, Swiss Army knives (and sometimes even chainsaws or swords) included! 😲

Discover how Google's security teams turn employee farewells into security tests.

https://t.co/Mapn7Nrs78

[Anthony Weems @amlweems]

@rez0__ Transparency. Microsoft announced a similar change after the CSRB report on Storm-0558.

https://t.co/RUly8lDOeb

[Anthony Weems @amlweems]

Effective today, Google will issue CVEs for critical vulnerabilities in Google Cloud that are fixed internally and do not require customer action or patching.

https://t.co/obc0Tz9Nv5

[Natalie Silvanovich @natashenka]

Exciting update on Project Zero’s LLM research: https://t.co/TRmtdU9B9g

[Anthony Weems @amlweems]

Before joining Google, I submitted some Cloud bugs to the Google Vulnerability Rewards Program (VRP). Today, we announced a dedicated Cloud VRP and I'm so excited to be a part of the program that got me into Google in the first place.

Send us vulnz 🙂

https://t.co/9cddeUoYcL

[Phil Venables @philvenables]

Cloud CISO Perspectives Blog for mid-October ‘24 is up covering:

- Sharing AI vulnerability research
- Virtual red teams
- Advances in DDoS mitigation
- Securing inherited cloud deployments
- Can AI keep a secret?
- and more…..

https://t.co/y9CtqKKAIj

[Anthony Weems @amlweems]

Excited to share this blog post about server-side memory corruption that my team exploited in production.

Shout-out to @scannell_simon, @epereiralopez, and @thatjiaozi - this was a very fun project. :-)

https://t.co/63Ho3HvF4w

[offensivecon @offensive_con]

The Mines of Kakadûm: Blindly Exploiting Load-Balanced Services by @scannell_simon and @amlweems is now live!

[Simon Scannell @scannell_simon]

Very excited to present this with @amlweems! See you in Berlin!

(@epereiralopez and @thatjiaozi) were also working on that project and will also be there :)

[Anthony Weems @amlweems]

@bl4sty @julianor Yeah, I noticed this and was wondering if it was a bug. It seems strange to allow setting the request type but not the body.

[Anthony Weems @amlweems]

@bl4sty @julianor Yes, but I don't yet understand their purpose. My hunch is that command 1 might be for identifying a vulnerable server w/o calling system(). Command 3 looks interesting.

[Anthony Weems @amlweems]

@therealshodan fyi: if you search for keys, the magic command byte can be obfuscated, I've updated the code with an example.

[Anthony Weems @amlweems]

@solardiz This is an excellent point, I had only been considering the simple case where the values were e.g. 2*1+0, but it makes more sense that they'd be large ints to look less suspicious. I'll update the .patch later today.

[Anthony Weems @amlweems]

I've been reverse engineering the xz backdoor this weekend and have documented the payload format and written a proof-of-concept exploit for the RCE. The payloads are signed with an ED448 key, so I patched my own key into the backdoor for testing. :-)

https://t.co/CvKo3xPRkP

[Anthony Weems @amlweems]

@julianor @vx__notduck1e @CodeAsm_ I've tested and signature replay works as expected, allowing modification of the command (except the first 5 chars). But I agree it is unrealistic until we actually capture a real signature (which may never happen).

[Anthony Weems @amlweems]

@therealshodan Did you capture SSH certificates as well? The payload is embedded in the CA signing key in the cert and will always start with 16 bytes that match a specific pattern.

(see https://t.co/CvKo3xPRkP for the payload format)

[那个火饺🦆(JJ) @thatjiaozi]

https://t.co/5MSMjKzqhK

Our research on the deep mines of the JPX standard is now public. I had the pleasure and the privilege to work with @scannell_simon , @amlweems and @epereiralopez on this one.

Pretty interesting client side info leak vector :)