Yiannis (John) Kozyrakis | @[email protected]

security engineer |

[Yiannis (John) Kozyrakis | @[email protected] @ikoz]

Let's try this: @[email protected]

[HD Moore @hdmoore]

Tom Ptacek posted a great writeup titled "Vulnerability Research Is Cooked", covering the state of vulndev and its rapidly accelerating future:
https://t.co/OL2k2eV9v2

[Jeff Vander Stoep @jeffvanderstoep]

I’m super excited about this blogpost. The approach is so counterintuitive, and yet the results are so much better than anything else that we’ve tried for memory safety. We finally understand why.
https://t.co/cBc3gMLzO6

[Brendan Dolan-Gavitt @moyix]

I gave Claude 3 the entire source of a small C GIF decoding library I found on GitHub, and asked it to write me a Python function to generate random GIFs that exercised the parser. Its GIF generator got 92% line coverage in the decoder and found 4 memory safety bugs and one hang.

[The Linux Foundation @linuxfoundation]

We are excited to announce that Google, Microsoft, and Meta are formally partnering as the founding steering committee to improve app security through a newly restructured App Defense Alliance, under the Joint Development Foundation.

Learn more: https://t.co/JkT5j7XCtL

[Yiannis (John) Kozyrakis | @[email protected] @ikoz]

Some more info on this, positions open onsite in Meta engineering offices in the US and London.

Remote also possible depending on seniority within US, UK, France, Germany, Spain, Italy, Ireland, Netherlands, Poland.

[Yiannis (John) Kozyrakis | @[email protected] @ikoz]

Security Engineering roles in mobile security also open, do reach out!

[LLM Security @llm_sec]

* People ask LLMs to write code
* LLMs recommend imports that don't actually exist
* Attackers work out what these imports' names are, and create & upload them with malicious payloads
* People using LLM-written code then auto-add malware themselves

https://t.co/Va9w18RpWu

[David Kleidermacher @DaveKSecure]

not every day 4 world-class security teams (all from Google, though that's not all of them...TAG, Mandiant, CrOS Security, and more) co-author a doc... #powerofopen
https://t.co/ws1gZHqzGY

[Ahn Ki Chan @Externalist]

Here are the slides for my keynote, 'Mobile Exploitation, the past, present, and the future' at #Zer0Con2023. Zer0con was a blast as always, thank you @POC_Crew!! 🚀💫

https://t.co/cqEftba9Cy

[Jeff Vander Stoep @jeffvanderstoep]

The Android team has open sourced our internal Rust Training! It's a four day course covering the full spectrum of Rust, from basic syntax to advanced topics like generics and error handling. It also includes Android-specific content on the last day.

https://t.co/5U3kmRruKG

[Yiannis (John) Kozyrakis | @[email protected] @ikoz]

@maldr0id Scary stuff.

[Yiannis (John) Kozyrakis | @[email protected] @ikoz]

@GerryMcBride Siemens SX1, good luck typing on this

[Casey Newton @CaseyNewton]

According to messages shared in Twitter Slack, Twitter’s CISO, chief privacy office, and chief compliance officer all resigned last night.

An employee says it will be up to engineers to “self-certify compliance with FTC requirements and other laws.”

[Nasko Oskov @nasko]

The folks in Chrome who work on securing the web platform API have compiled a great guidelines doc based on their experience. https://t.co/2GlkbjmEa6
Thanks @mikewest et al!

[Kees Cook @kees_cook]

If you can't switch your C to Rust immediately, consider at least enabling all the sanity checking the compiler can already do for free:

-Wall
-D_FORTIFY_SOURCE=2
-fsanitize=bounds fsanitize-undefined-trap-on-error
-fstrict-flex-arrays (GCC 13+, Clang 16+)

[Benjamin Lewis @tc1415]

I believe HMG are trying to legislatively prohibit SQL injection attacks on the register of companies!

[Yiannis (John) Kozyrakis | @[email protected] @ikoz]

@Hexploitable @dcuthbert My 7: Olive oil, onions, garlic, peppers, tomatoes, carrots, more olive oil

[Tim Strazzere @timstrazz]

Breaking Secure Boot on Google Nest Hub (2nd Gen) to run Ubuntu https://t.co/BM24A9LxU6 < what an awesome write up

[Philippe Oechslin @tradeoph]

We have finally published Tproxy (https://t.co/ECXoklDR0B) our generic TCP interception proxy (think Burp for TCP): TLS handling, wireshark dissection, intercept and modify by hand or with scripts in GUI or CLI.
There is a complete doc with demos (https://t.co/wJ7lrHC8L4)