EdgeWalker

Security and Malware dev stuff

[IRIS C2 @C2IRIS]

Stealth browser extensions are underrated. Nobody ever finds them. Especially not EDRs.

If you hang around in the browser long enough, you collect almost everything you need 95% of the time

[EdgeWalker @BitAndro]

@Cyb3rMonk There is no mature behavioral detection system in Linux. No EDR is mature enough, yet. Please check both behaviors and exploits.

[EdgeWalker @BitAndro]

@techspence For SOC, Detection Enginering > Automation

[tweet davidson @andyreed]

my claude explore agent that hasn’t responded in 47m

[solst/ICE of Astarte @IceSolst]

It’s also not about the value of the certification itself; The problem is if you’re the type of person who RELIES on a cert for getting anywhere

“What cert should I get” if that is the first question you’re asking, you’re not even close to being on track

[Iceman @herrmann1001]

Relay attacks are underrated in red team assessments.
You don't need to clone the card.
You don't need to crack the crypto.
You just need to be close enough to the target and have a partner near the reader.

Real-time signal relay.

The door thinks the card is right there.
No cloning.
No cracking.
Just physics.

Most access control systems have zero defence against this.

#RFID #RelayAttack #RedTeam #PhysicalPentest #AccessControl

[conduct|r @conductr_]

This book is going to change how an entire generation thinks.

[Yuchen Jin @Yuchenj_UW]

Some people at frontier AI labs told me they believe startups are over.

OpenAI, Anthropic, Google, xAI will absorb every industry as AGI nears. Coding today, science, medicine, and finance next. Then everything else.

If they’re right, that’s a pretty boring end of the world.

[EdgeWalker @BitAndro]

@techspence And hard for defenders to be strict on security of developers endpoints if the company is a SaaS - Plus, EDR protection on Linux systems is much, much more immature than in Windows.

[spencer @techspence]

From an internal threat perspective, developer machines are as good as getting Domain Admin, and many times even more "lucrative" from an attack pov

They have the keys and typically much less oversight.

https://t.co/0XjCQ9I6kV

[UwU Underground @uwu_underground]

By breaking the typical chain of
Suspicious Activity -> 2nd Suspicious Activity -> Yet Another Suspicious Activity

with
Suspicious Activity -> Normal User Behavior -> Another normal behavior -> Suspicious Activity

you can reset model analysis and lower your threat profile

[BURKOV @burkov]

There's a common assumption in AI right now that if one language model can do a task reasonably well, having several of them collaborate — splitting up the work, checking each other's outputs, debating answers — should do it better.

This paper puts that assumption under a controlled experiment across 180 configurations and finds that the reality is messier and more interesting: multi-agent setups improved performance by up to 81% on some tasks and made things worse by up to 70% on others, with the difference coming down to whether the task can be broken into parallel pieces or whether each step depends on the previous one.

In a financial analysis, one agent can look at regulatory filings while another reads market news and a third examines earnings data — none of them need to wait for the others.

In a Minecraft crafting puzzle, on the other hand, each action changes the inventory that the next action depends on, so the steps have to happen in order and splitting them across agents just adds overhead without any benefit.

The paper fits an equation that predicts which architecture will work best for a new task 87% of the time.

For anyone building or thinking about building systems where multiple AI models work together, this replaces a lot of hand-waving with something concrete.

Read with an AI tutor: https://t.co/w1aX6BKPkW

Download the PDF: https://t.co/1YHNcFh7Dt

[EdgeWalker @BitAndro]

@pigeon__s Link to repo?

[Stephen Sims @Steph3nSims]

I want to share a quick thought for people in cyber security. This will be my longest tweet ever.

I’ve spoken to many lately who are having an existential crisis from the constant posts about “the end of cybersecurity jobs.”

Yes, things are changing quickly. This is a significant moment for the tech industry. Change can be uncomfortable. But we’ve seen cycles like this before.

• When GitHub and open source took off, people said software engineers would disappear because code was free.
• When AWS and cloud computing emerged, people said infrastructure jobs would vanish.
• When fuzzing and SAST tools improved, people said vulnerability research would disappear.
• Virtualization would eliminate infrastructure jobs.
• Mobile computing was going to end desktop dev.
• Exploit mitigations would end exploitability. It didn't.

Each time automation improved, the amount of software grew faster than the automation. It does feel "different" this time as it's explosive.
Some roles will shrink:
• repetitive pentesting
• basic vulnerability scanning
• tier-1 SOC monitoring

But other areas are expanding rapidly:

• AI system security
• supply chain security
• identity architecture
• autonomous agent security
• critical infrastructure protection

Historically, every time we eliminate one class of bugs, new classes emerge. Right now people are vibe-coding entire systems, giving AI access to their machines, crossing trust boundaries, and deploying autonomous agents with excessive permissions. The legal and regulatory world is nowhere close to ready.

There will absolutely be new failure modes. Humans are amazing and always adapt, finding new ways to do things.

The worst thing you can do right now is fall into a doom loop.

...and I’ll be honest, I too have felt the "psychological paralysis" a few times thinking, “Is this time different?” It's especially impactful when it comes from someone I respect in the community. There are certainly unknowns, in an industry where we've become accustomed to predictability.

But... the majority of those reactions are usually driven by social media, not reality. Platforms like X reward engagement, and sensational doom posts spread faster than measured thinking.
If you see something like:
“Holy #$%^! Opus 66.6 just found every bug in Chrome and replaced 50 startups!”

…mute it and move on.

Instead:

Stay curious.
Learn the new technology.
Adapt your skillsets.
Build things.

We’ll get through this transition the same way we always have. If I'm wrong then Sam Altman better be right about UBI! :) I'm sure that if this tweet gets any engagement that I'll get some heat for it, but a good friend of mine reminds me often to focus on what you have control over. I'll revisit this tweet at DEF CON 40!

[EdgeWalker @BitAndro]

@ThePrimeagen Incident Response

[Aurélien Chalot @Defte_]

Dumping LSASS is old school. If an admin is connected on a server you are local admin on, just create a scheduled task asking for a certificate on his behalf, get the cert, get its privs. All automatized in the schtask_as module for NetExec 🥳🥳🥳

[Sean Heelan @seanhn]

Blog post: On the Coming Industrialisation of Exploit Generation with LLMs https://t.co/aK4pysY1wD

TL;DR: I ran an experiment with GPT-5.2 and Opus 4.5 based agents to generate exploits for a zeroday QuickJS bug. They're pretty good at it.

Code: https://t.co/47xHRObhRy

[Teortaxes▶️ (DeepSeek 推特🐋铁粉 2023 – ∞) @teortaxesTex]

To restate the argument in more obvious terms.
The eventual end state of labor under automation has been understood by smart men (ie not shallow libshits) for ≈160 years since Darwin Among the Machines. The timeline to full automation was unclear. Technocrats and some Marxists expected it in the 20th century.
The last 14 years in AI (since connectionism won the hardware lottery as evidenced by AlexNet) match models that predict post-labor economy by 2035-2045. Vinge, Legg, Kurzweil, Moravec and others were unclear on details but it's obvious that if you showed them the present snapshot in say 1999, they'd have said «wow, yep, this is the endgame, almost all HARD puzzle pieces are placed».
The current technological stack is almost certainly not the final one. That doesn't matter. It will clearly suffice to build everything needed for a rapid transition to the next one – data, software, hardware, and it looks extremely dubious that the final human-made stack will be paradigmatically much more complex than what we've done in these 14 years.
Post-labor economy = post-consumer market = permanent underclass for virtually everyone and state-oligarchic power centralization by default.
As an aside: «AI takeover» as an alternative scenario is cope for nihilists and red herring for autistic quokkas. Optimizing for compliance will be easier and ultimately more incentivized than optimizing for novel cognitive work. There will be a decidedly simian ruling class, though it may choose to *become* something else. But that's not our business anon. We won't have much business at all.
The serious business will be about the technocapital deepening and gradually expanding beyond Earth.
Frantic attempts to «escape the permanent underclass» in this community are not so much about getting rich as about converting wealth into some equity, a permanent stake in the ballooning posthuman economy, large enough that you'd at least be treading water on dividends, in the best case – large enough that it can sustain a thin, disciplined bloodline in perpetuity.
Current datacenter buildup effects and PC hardware prices are suggestive of where it's going. Consumers are getting priced out of everything valuable for industrial production, starting from the top (microchips) and the bottom (raw inputs like copper and electricity). The two shockwaves will be traveling closer to the middle. This is not so much a "supercycle" as a secular trend.
American resource frenzy and disregard for diplomacy can be interpreted as a state-level reaction to this understanding.
There certainly are other factors, hedges for longer timelines, institutional inertia and disagreement between actors that prevents truly desperate focus on the new paradigm. But the smart people near the levers of power in the US do think in these terms.
Speaking purely of the political instinct, I think the quality of US elite is very high, and they're ahead of the curve, thus there are even different American cliques who have coherent positions on the issue. Other global elites, including the Chinese one, are slower on the uptake. But this state of affairs isn't as permanent as the underclass will be.

For people who are not BOTH extremely smart and agentic – myself included – I don't have a solution that doesn't sound hopelessly romantic and naive.

[Tiho Brkan @TihoBrkan]

Most of the wealthy and the super-rich did not make their money via stocks, nor do they hold a lot of stocks (even when they are rich).

The people who are obsessed with stock picking or macro investing are most likely not going to get rich from it.

You're playing the wrong game if you're after the big bucks.

So if stock picking (Buffett style), or running a macro hedge fund (Druckenmiller style), is not the way to go, what is the proven strategy?

This is not my opinion, but the data itself.

Overwhelming evidence (not only from this chart) shows that you need to solve a problem for society by starting your own business.

Most of the wealth, and I mean real wealth above — say $10 million and decently early on (not when you're 78 😂) — is made via entrepreneurship.

[Justin Elze @HackingLZ]

It’s the wildest thing these LLM pentesting frameworks blindly trust output from systems their testing sent directly back to the LLM supervisor agent.