Clark Barron

Founder, Blackout | GTM Threat Intelligence | Your vendors are the attack surface nobody’s watching

[Clark Barron @ClarkHBarron]

Is all of @flydotio shitting the bed rn?

[Clark Barron @ClarkHBarron]

Here we gooooo.... Attacker got into Vercel internal systems via a compromised third-party AI tool's Google Workspace OAuth app.

https://t.co/zdQJSikeqL

[Clark Barron @ClarkHBarron]

Anytime somebody uses the phrase “Orchestration layer”, I immediately tune out because I can’t stop wondering if they actually know what that means.

[Clark Barron @ClarkHBarron]

@ElizabethHolmes Low key baller move.

[Clark Barron @ClarkHBarron]

Hey all you cybersecurity marketers — Turn off your RSA ads or I’m tattling.

[Clark Barron @ClarkHBarron]

@heyblake https://t.co/UVm0h5utKv

[Clark Barron @ClarkHBarron]

@robkbircher @ZackKorman I 100% hear you, but let’s be honest — at risk for *what* exactly? SOC 2 is a procurement gate, that’s it.

Let’s say SOC 2 reports are ID’s and your customer is a bouncer.

If you walk up with a fake id and they let you in… you’re not going to say a damn word

[Clark Barron @ClarkHBarron]

@I_amZackk @karunkaushik_ The entire cybersecurity community is laughing at them right now.

If you claim “cybersecurity forensic investigators”, you name them. That’s your credibility.

Mandiant. Crowdstrike, etc. Say literally anybody’s name. They won’t.

[Clark Barron @ClarkHBarron]

@karunkaushik_ All 259 Type II reports claim zero security incidents, zero personnel changes, zero customer terminations

[Clark Barron @ClarkHBarron]

A "coordinated cyber attack".... You're joking right?

[Clark Barron @ClarkHBarron]

@karunkaushik_ 99.8% identical phrasing across 494 reports

[Clark Barron @ClarkHBarron]

@karunkaushik_ This isn’t a YouTube apology video.

You raised $32 MILLION dollars.

[Clark Barron @ClarkHBarron]

@gothburz For the record, HUMAN Security is NOT a cybersecurity company.

[Clark Barron @ClarkHBarron]

@gothburz @Contentsquare @HockeyStack @LiveRamp @LinkedIn Oh — and LinkedIn's own JavaScript named the surveillance orchestrator function "AbuseFeaturesCollectionCoordinator."

They named it that. On purpose.

[Clark Barron @ClarkHBarron]

Also on humansecurity(.)com: @Contentsquare (session recording), @HockeyStack (scans the DOM to detect other vendors), @LiveRamp (identity resolution), and @LinkedIn tracking as the FIRST network request on page load.

Extension scanning confirmed on their own site. 4 chrome-extension:// probes in the network traffic.