av_eip

Cyber security

[av_eip @av_eip]

@0day_ninja One of my favorite talks from Blackhat 2017 : Breaking the x86 Instruction Set : The presenter @xoreaxeaxeax talks about "creative processor fuzzing" to exhaustively search the x86 instruction set and uncover the secret instructions https://t.co/qOX22vi0a8

[av_eip @av_eip]

Well Indians need to realize if they are not going to tell their stories well enough, someone else will ;) cc @SarvamAI

[Diva Jain @DivaJain2]

India is the largest ungated fast growing market for AI in the world. They want it to be hooked to Mythos pronto. They are not doing India a favour by inviting it to lunch - India is the lunch.

[cr3ghost @cr3ghost]

Themida turns a few lines of code into thousands of VM handler instructions. Completely unreadable.

back engineering built a static devirtualizer that lifts it all to IR, resolves the control flow, and recovers the original logic.

The before/after in the repo is genuinely shocking.

Works on pretty much any VM obfuscator, not just Themida.

Blog: https://t.co/fY4YkY2aH3
Devirt output: https://t.co/p2gkKi1vXp

Author: @BackEngineerLab

#ReverseEngineering #InfoSec #Malware

[av_eip @av_eip]

@thegrugq maybe badhat and goodhat ?

[Florian Roth ⚡️ @cyb3rops]

I spent the last weeks building LLM benchmarks for a very specific reason:

We want to use AI in RuneAI to help with THOR finding triage, and I needed a better baseline for model selection than generic LLM leaderboards.

Security-event triage is its own thing.

A model can be great at coding, reasoning or vulnerability writeups and still be a bad fit for deciding whether a messy endpoint finding should be suppressed, reviewed or escalated.

In real deployments this will likely happen inside agentic workflows with tools, memory, context handling and feedback loops. But before testing the whole system, I wanted a clean baseline:

How does the model behave when it only gets the enriched finding itself?

Blog post with the reasoning and methodology:
https://t.co/KQPOPDWP1B

Interactive benchmark results:
https://t.co/pvVhTBJsz0

Repo:
https://t.co/Fw3uW9nu2a

Maybe useful for others building SOC / security-event triage benchmarks.

[av_eip @av_eip]

@caseyjohnellis Please learn the difference between ethics and morals. It should be "mafia have a pretty strict code of morals". Not "ethics". Thank you for your attention to this matter.

[av_eip @av_eip]

😂

[Shubhangi Tiwari @ShubhangiYaps]

Hey X, I’m Shubhangi 👋
I’m a software engineer at Cisco who spends way too much time thinking about AI, tech, and random ideas at 2am.
Thought I’d finally introduce myself :)

[av_eip @av_eip]

Infosys - TCS got access to Mythos ?

[Bloomberg @business]

EXCLUSIVE: India is undertaking tests of some of its most sensitive public-facing financial and government application software to better understand their vulnerabilities to Anthropic’s next-generation Mythos AI model, sources say. https://t.co/2Qe4h2gapN

[av_eip @av_eip]

"imagine all the basic security research gets automated, you can only produce value if you are operating at top percentile."

It always was like this. Every R&D industry is. Compete or die. Don't fall for LinkedIn euphemisms and yes basic infosec is already automated by AI ;)

[s1r1us (mohan) @S1r1u5_]

i am quiet pessimistic on the view that ai will create more jobs.

if you look back at industrial revolution, and computers stuff, they sure did create more jobs, but at the same time they also increased the floor on the skill required to do those jobs.

in that sense, there are quiet a few people around me in my village who never made it into modern white-collar job. i won't say i know exact reasons, it could be lack of access to proper education, but it also could be that the skill it required to work for those jobs rose above than the capability.

if later is true, the floor for producing value creating work might increase in post ai diffused world. imagine all the basic security research gets automated, you can only produce value if you are operating at top percentile.

that means ai probably won't really create more jobs. it will create some, but maybe most people skills won't clear it?

[Malcat dev @malcat4ever]

We tested 9 LLMs on real-world #malware triage and static unpacking tasks, using only #Malcat’s MCP server.
We compared not only their results, but also their speed and cost.
Full write-up:
https://t.co/z9KN3SR4P4

[av_eip @av_eip]

Good read ! "The Corporatization of Intelligence" was bound to happen sooner than later. In fact one of the first firms I worked in used to scorn at people writing blogs and giving their threat intel for free. With the rise of AI, this sentiment is only going to get stronger 😉

[R136a1 @TheEnergyStory]

Have you noticed that those deep-dive stories about complex Windows malware have pretty much vanished, especially in recent years? It feels like the era of "blockbuster" Windows malware has just gone silent, and this blog post tries to give some answers why.

https://t.co/sFsf3uPm5o

[Georgy Kucherin @kucher1n]

Together with @bzvr_, @2igosha and Anton Kargin, we identified that the DAEMON Tools software has been compromised in a complex supply chain attack since April 8. We see thousands of infections across 100+ countries. If you use DAEMON Tools, run a malware scan immediately! [1/7]

[7h3h4ckv157 @7h3h4ckv157]

claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.mdfile that primes Claude with expert-level methodology for a specific attack surface from SQLi to shellcode, EDR evasion to exploit development.

Resource: https://t.co/0XvEqoqPfv

[Elastic Security Labs @elasticseclabs]

LLMs have gotten good enough at reverse engineering to recover source code from obfuscated binaries with real accuracy.

So we asked the obvious next question: how fast and cheap is it to use one to build obfuscation specifically designed to beat it?

We benchmarked Claude Opus 4.6 against the Tigress obfuscator across 20 targets first, to map its strengths and failure modes. 40% solve rate. Phase 3 multi-layer combos hit 0%, with cost explosions that killed the runs.

Then we ran a dev/test/refine loop to build 3 purpose-built obfuscation variants targeting the same crackme, iterating directly against the model's known weaknesses.

The finding: LLM-targeted obfuscation is fast and cheap to develop. Context windows, budget caps, and shortcut biases are all exploitable attack surfaces.

The arms race just shifted.

[av_eip @av_eip]

Infosec industry effectively created its own nemesis by putting out open source and free knowledge base articles/repositories for the AI models to train on.

[av_eip @av_eip]

@championswimmer @abhi9u 🤣

[Karsten Hahn @struppigel]

New Video: Build your own LLM dynamic analysis lab 🦔🎥

➡️ AI debugs and unpacks with x64dbg
➡️ AI can access powershell terminal

https://t.co/0qoRQmyIQi

[Nav Toor @heynavtoor]

Your smart TV is taking screenshots of your screen every 15 seconds.

Not a guess. Not a theory.

A peer-reviewed study by researchers at UC Davis, UCL, and UC3M tested it.

Samsung TVs: every minute.
LG TVs: every 15 seconds.

Even when you're just using it as a monitor.

Here's how to turn it off for every brand:

[Hamid Kashfi @hkashfi]

Finally got some breathing room, so here's a quick recap of the cyber side of IR/US ongoing war:

1. Right after the first strikes by US, within the first hours, multiple popular (pro regime) news agencies and outlets were compromised at the same time. Legitimate looking news contents were injected to the front page, aimed at degrading morale of pro-regime force by typical PSYOPS tactics. Sites were quickly taken down and restored.

2. Shortly after that, BadeSabaa (Prayer time app), a popular mobile app with 30+ Million installations (from Iranian app store) was hijacked and used to send push notifications to users. This time the target audience was mostly army members, calling them to surrender and join the people, if they want to survive. This app is an interesting pick, not just because it has a high number of downloads. Users of the app are particularly religious people and have higher chance to be also pro-regime and within body of the army. One important but seemingly ignored fact about this app is that it requests location access to operate. It's safe to assume most users allow that for more accurate prayer time results. It's also safe to assume that, if the app backend is compromised enough to allow sending push notifications, it's safe to assume that any telemetry logs and data from the app would be also compromised. Correlating telemetry with unique device ID for that large user base can be (ab)used in many different and interesting ways! Not that it has been the case.

* Rumors circulated that EITAA, an Iranian popular messaging app, was also taken down and no longer accessible. That turned out to be just a rumor as I verified.

3. Iran internet went in full blackout mode again. Not that this had anything to do with a cyber operation. Initially starting from MCI and expanding to the entire country within a day. Like in previous case, there are still a small fraction of hosts that remain accessible from outside, but if you have been logging previous round's data and compare it with current one, you might notice interesting discrepancies ;)
This is likely a multi-reason effort to contain exposure of impact of strikes, possible denial of service to smaller drones (which turned out a failed assumption and attempt during IR/IL war too) and finally to have a veil over any potential aggression towards upcoming unrests and protests by people in the streets.

4. During second day of strikes, Iranian national TV's Channel 3 satellite streams (IntelSat) were hijacked (2nd time since recent protests) and videos of Trump and Netanyahu speeches were broadcasted instead. Again, expected PSYOPS move considering the situation.

Other covert operations have been also in progress, which I guess we might be hearing about them (or not) in near future. I will be occasionally updating this as a thread, if more notable cyber attacks takes place.

[av_eip @av_eip]

@joshwoodward @securityshell Was this app vibe-coded using Gemini itself to meet the 100 day deadline ? 🙃