DeadPixelSec

#DeadPixelSec | #InfoSec #Community | #CTF | Blog | Share | Educate | Evolve | Be |

[DeadPixelSec @deadpixelsec]

Want to support DeadPIxelSec and all its projects, Firstly Join Discord,

https://t.co/gg8x0lANlT
Then Support
https://t.co/5M6ijLMssc
OR if your not a discord user,
https://t.co/j7S2X6mmYT
If you don't use that here is Paypal
https://t.co/5RoNM7gjHw

[DeadPixelSec @deadpixelsec]

@TheBlindHacker

[Joe B. - BlindHacker  @TheBlindHacker]

Blind Hacker has discovered a high-severity AI supply-chain vulnerability in XXXXXXX, the primary open-source runtime powering ALL THE THINGS.

By hosting or distributing a tampered model file on public hubs (such as Hugging Face or ModelScope), an attacker can trigger arbitrary memory corruption, ASLR information disclosure, or code execution the moment an engineer or enterprise loads the model—before any AI inference or user prompt occurs.

Key Findings & Business Impact Zero-Prompt Attack Surface (Pre-Inference Execution): Unlike prompt-injection attacks which manipulate AI behavior, this is a binary exploitation defect in the host C++ inference engine. Vulnerable execution occurs immediately during model initialization (Init()) when parsing configuration metadata. Supply Chain Exploitation Model: Mirrors malicious PyTorch pickle deserialization. Any organization downloading community weights or running automated fine-tuning/conversion pipelines is exposed to host compromise.

Dual-Defect Root Cause: CWE-134 (Format String Injection): Model config path templates are passed directly as format strings to standard C library formatters, permitting arbitrary memory reads and pointer leaks. CWE-121 (Stack Buffer Overflow): Format expansion (e.g. %2000d) writes beyond a fixed 1,024-byte stack allocation, causing immediate denial-of-service or stack smashing.

Low Exploitation Complexity: Requires no authentication, no network reachability, and no specialized hardware state. A single line in a JSON configuration file triggers the defect.

Coming THOON™️

[Joe B. - BlindHacker  @TheBlindHacker]

When writing a video game, what takes up less space, Think SMALL, floppy or cartridge style games.

Playing the sound backwards via the raw file now you have the same file one forward one back, or writing code to play it backwards?

[JS0N Haddix @Jhaddix]

If you enjoyed the defcon and blackhat presentations and workshops, all that and more is in our full courses!

Hackbots - using agent frameworks

And

Attacking AI

Link and syllabuses at https://t.co/bCXGPztXAK

[Joe B. - BlindHacker  @TheBlindHacker]

Public AI endpoints are a massive telemetry leak when you are running target profile scrapes or malware analysis. Every CVE search or payload lookup you send out exposes your operation.

To fix this, we containerized SearXNG and LiteLLM inside an LXC container on Proxmox (NextGenPVE).

Our target research loop now runs completely locally:

Operator requests target profile investigation.
Custom agent queries SearXNG (privacy-respecting metasearch) to scrape search results anonymously.
Text contents are cleaned and parsed.
Local abliterated LLM extracts IoCs and maps TTPs to MITRE ATT&CK.
No queries, target domains, or malware hashes ever leave our network boundaries.

Full architecture writeup and configurations: https://t.co/PVj0aHEn5x

[DeadPixelSec @deadpixelsec]

@TheBlindHacker LFG!!

[Joe B. - BlindHacker  @TheBlindHacker]

Hello friends,

Could you drop a follow and watch my mentee Cerd/s channel. He's talking baout some cool stuff!
https://t.co/GilVRADHMp

Thank you!

[DeadPixelSec @deadpixelsec]

@TheBlindHacker @HackSpaceCon @cobalt_io Great opportunities!

[Joe B. - BlindHacker  @TheBlindHacker]

Hey, I know its been a minute,

How are you?, Me? I am doing alright! Lots of work and prepping for @HackSpaceCon.

I see the market is rough, So I wanted to let you know @cobalt_io is hiring!

https://t.co/fsj7geFuOK
Sales, Enterprise, Marketing, Solutions Architecture (Field CISO), Data Platform, Management and 1099 Pentesters. Overseas, UK, Germany, Nordics, ME, Asia!

If you can RT4<3. Share, tag a friend if you know they do any of these jobs.

Be well friends!
We should chat soon!

[DeadPixelSec @deadpixelsec]

Do you remember when you joined X? I do! #MyXAnniversary

[Joe B. - BlindHacker  @TheBlindHacker]

Well, used AI to go though my scripts folder and help be build out a single install script for my blind hacker terminals.

https://t.co/id35EDFB6p

[Joe B. - BlindHacker  @TheBlindHacker]

I just wanted to let you guys know. I am still here, but I am really glad you are still here. Drop me a note so I can say Hey!

[Joe B. - BlindHacker  @TheBlindHacker]

Its 2025, time for a new #infosec #cybersecurity #Resume Rules Update. Things are hard out there. TImes have changed, MASSIVE layoffs'. Shrinking tech budgets and more. Here is what I got.

I. Contact Information & Online Presence:

1. Location Precision: Instead of just region, consider using a general location like "Greater [City Name] Area" or "[State] - Remote Considered." This balances privacy with giving recruiters a sense of your availability. Why: More specific than just a region, but still protects your exact address.

2. Professional Email & Portfolio Link: Use a professional email ([email address removed]) and prominently include a link to your online portfolio/personal website (if you have one). Why: Your portfolio can showcase projects, write-ups, and contributions, adding depth beyond the resume.

3. LinkedIn Profile Optimization: Ensure your LinkedIn profile is up-to-date and mirrors your resume. Use keywords strategically throughout your profile. Why: Many recruiters use LinkedIn as a primary sourcing tool.

II. Experience Section – Beyond the Technical:

4. Quantify Non-Tech Achievements: If you've held non-tech jobs, quantify your achievements there, focusing on transferable skills. For example, "Increased sales by 15% through improved customer service strategies" (demonstrates communication and problem-solving). Why: Shows you can deliver results, even outside of a purely technical environment.

5. Skill-Based Grouping: Group your experience by skill area (e.g., "Incident Response," "Vulnerability Management," "Communication & Leadership") rather than just chronological order. Within each skill area, list relevant experiences (including non-tech if applicable). Why: Highlights your expertise in key areas and makes it easier for recruiters to see your qualifications.

6. Action Verbs & Impact Statements: Start each bullet point with a strong action verb and focus on the impact of your work. Use the PAR (Problem-Action-Result) format. Why: Makes your accomplishments clear and demonstrates your value.

7. Cybersecurity in Non-Cyber Roles: If you had any cybersecurity-related responsibilities in non-tech jobs (e.g., data handling procedures, access control), emphasize these. Why: Shows initiative and interest in security, even before a formal cybersecurity role.

III. Skills & Certifications:

8. Tiered Skills Section: Create a tiered skills section. "Expert" for skills you're highly proficient in, "Proficient" for skills you're comfortable with, and "Familiar" for skills you're still learning. Why: Provides a clear picture of your skill levels and avoids overselling.

9. Certifications – Strategic Selection: List only the most relevant and in-demand certifications. Focus on those aligned with the target roles. Why: Avoids clutter and showcases the most valuable credentials.

10. Software & Tools Proficiency: List specific security tools, software, and platforms you're proficient with. Group them by category (e.g., "SIEM," "Vulnerability Scanners," "Cloud Platforms"). Why: Helps recruiters quickly identify your technical skills.

IV. Education & Projects:

11. Projects – Showcase Your Skills: Include personal projects, CTF participation, bug bounty work, or open-source contributions. Why: Demonstrates practical skills and passion for cybersecurity.

12. Education – Keep it Concise: List degrees, relevant coursework (especially if you're early in your career), and any specialized training. Why: Education is important, but experience and skills are often prioritized in cybersecurity.

V. Resume Formatting & ATS Optimization:

13. ATS-Friendly Formatting: Use a clean and simple layout. Avoid tables, images, or unusual fonts that might confuse Applicant Tracking Systems (ATS). Why: Ensures your resume gets through the initial screening process.

14. Keyword Optimization: Research relevant keywords for your target roles and incorporate them naturally throughout your resume. Why: Improves your chances of being found in ATS searches.

15. File Format: Save your resume as a PDF (.pdf). Why: Preserves formatting and is widely compatible.

16. Resume Length - Be Strategic: Aim for one page if you have less than 10 years of experience. Two pages maximum for extensive experience. Why: Keep it concise and focused on the most relevant information.

VI. Networking and Continuous Learning:

17. Networking is Key: Actively network with other cybersecurity professionals. Attend industry events, join online communities, and connect on LinkedIn. Why: Networking can open doors to unadvertised opportunities.

18. Stay Current: Cybersecurity is constantly evolving. Stay up-to-date on the latest threats, vulnerabilities, and technologies. Why: Demonstrates your commitment to professional development.

19. Tailor, Tailor, Tailor: Always tailor your resume to each specific job application. Highlight the skills and experiences that are most relevant to the target role. Why: Shows employers you understand their needs and are a good fit for the position.

VII. Networking, Continuous Learning, and Community Engagement:

20. Strategic Networking: Go beyond simply connecting on LinkedIn. Engage in meaningful conversations, offer help and insights, and build genuine relationships with other cybersecurity professionals. Why: Quality over quantity in networking.

21. Hacker Cons – Strategic Attendance: Attending relevant hacker conferences (like DEF CON, Black Hat, or local events) can demonstrate your passion and provide learning opportunities. List cons attended briefly, especially if you presented or volunteered. Why: Shows active engagement in the community.

22. Open Source Contributions: If you've contributed to open-source security projects, prominently feature this. Include links to your contributions on GitHub or other platforms. Why: Demonstrates practical coding skills and community involvement.

23. Bug Bounty Participation (Ethical): If you've participated in bug bounty programs (responsibly and ethically, of course), mention this. Quantify your findings or impact if possible. Why: Shows real-world vulnerability discovery skills.

24. Cybersecurity Community Involvement: Active participation in online forums, local meetups, or cybersecurity clubs can demonstrate your passion and knowledge. Why: Highlights your commitment to the field.

25. Mentorship (Giving Back): If you've mentored aspiring cybersecurity professionals, mention this. Why: Shows leadership and commitment to the community.

26. Personal Website/Blog (Showcase Your Expertise): Maintain a personal website or blog where you share your research, insights, or project write-ups. Include a link to it on your resume and LinkedIn profile. Why: Establishes you as a thought leader and demonstrates your knowledge.

27. Publications and Presentations: If you have published security research papers, given conference talks, or presented at meetups, list these with links if available. Why: Demonstrates deep expertise and communication skills.

Final Touches:

28. Proofread Impeccably: Have multiple people proofread your resume for any errors in grammar, spelling, or punctuation. Why: A polished resume shows attention to detail.

29. Keywords – Beyond the Basics: Go beyond simply listing keywords. Understand the context in which they are used in job descriptions and incorporate them naturally into your resume. Why: Improves ATS matching and demonstrates your understanding of the role.

30. Quantify Everything Possible: Wherever you can, quantify your achievements with numbers, percentages, or specific metrics. Why: Data speaks volumes and shows your impact.

31. "Summary/Objective" – Use Wisely: A brief summary or objective statement can be useful, especially if you're transitioning careers or have specific career goals. Tailor it to each job application. Why: Provides context and highlights your key strengths.

32. References – Available Upon Request: Don't list references directly on your resume. Simply state "References available upon request." Why: Saves space and is standard practice.

Lets keep making cybersecurity accessible to everyone. RT4<3. Be Good Do Good. #Infosecjobs #cybersecurity #Resume #linkedinopportunity #infosecurity #jobsearch #hiring #opentowork #cybersecurityjobs #infosecjobs #techjobs #careers #networking #linkedin #jobhunt
#careergoals #accessiblecybersecurity
#cybersecurityforeveryone #cybersecuritysimplified #demystifyingcybersecurity #cybersecurityexplained

[Joe B. - BlindHacker  @TheBlindHacker]

I was selected to speak @HackSpaceCon in May!

[Joe B. - BlindHacker  @TheBlindHacker]

@deadpixelsec

[JS0N Haddix @Jhaddix]

[Sponsor] @TheSecOpsGroup just dropped multiple offers👇 and a chance to Win a FREE Pentesting Exam! 🎁

• Community Exams (Android/iOS – limited seats at 30£ each)

• Newly launched exam on Kiosk Breakout (CKBPro ) - 90% Discount (Code: CKBPro-90)

• Diwali Sale – 75% discount on ALL exams (Code: DIWALI-75)

Explore their offers here🔗

https://t.co/dpxjjKPjYI

Now, Here is what you have to do to qualify for the free exam draw. Every action below = 1 entry into the draw

👍 Like
💬 Comment on your exam choice
🔁 Repost / Share
👥 Tag peers who should know
🔔 Follow @TheSecOpsGroup, creators of https://t.co/gT2P3pQrgP

[TrustedSec @TrustedSec]

Service triggers can be a pentester’s secret weapon, letting low-priv users quietly fire up powerful services. In our new blog, @freefirex2 breaks down the types of service triggers that exist and how they can be activated with little to no code required. https://t.co/C2va5umFR7

[Nikhil Mittal @nikhil_mitt]

Glad to announce our Diwali deals.

20% OFF on the following (25% on more than one purchase)
- All the on-demand labs (including lab extensions),
- Bootcamps in Q1 and Q2 2026 (We have already announced dates for 5 bootcamps),

- 10% OFF (15% on more than 5 seats) for our in-person training event - AltSecCON

https://t.co/UCtbnp3jLH

#RedTeam #PenTesting #Diwali

[Programmer Humor @PR0GRAMMERHUM0R]

theGoldStandardOfDivAlignment https://t.co/irATbttP6v