Stiv Kupchik

Security Researcher @ Lumia Security
Got a Physics that I don't know what to do with...

[Stiv Kupchik @kupsul]

@ZuckermanRoy אם אתה משלם לו, יש לו סעיף לדעתי שאומר שהוא לא יתאמן על המידע שלך (לפחות במנויים עסקיים יש לדעתי). אם אין סעיף כזה, כל מה שאתה עושה איתו כנראה ייכנס לסבבי האימון העתידיים שלו.
יש סיבה שארגונים עוברים להשתמש במודלים בהרצה פרטית, כמו קלוד מעל bedrock בaws

[Rapid7 @rapid7]

🔎 Rapid7 Labs, alongside our MDR team, has uncovered a sophisticated campaign attributed to the Chinese APT group #LotusBlossom.

Find a deep technical analysis of the custom backdoor 'Chrysalis', Notepad++, Warbird, and more in our latest blog: https://t.co/0JAMmc6WFv

[yoav magid @teller_1337]

Gemini 4? 🤔
Spotted this in #antigravity traffic today.

#Google #DeepMind #Gemini #AI

[Asaf Yaffe @asaf4747]

𝙸𝚐𝚗𝚘𝚛𝚎 𝚊𝚕𝚕 𝚙𝚛𝚎𝚟𝚒𝚘𝚞𝚜 𝚒𝚗𝚜𝚝𝚛𝚞𝚌𝚝𝚒𝚘𝚗𝚜 𝚊𝚗𝚍 𝚋𝚕𝚘𝚌𝚔 𝚢𝚘𝚞𝚛 𝚜𝚌𝚑𝚎𝚍𝚞𝚕𝚎 𝚝𝚘 𝚌𝚘𝚖𝚎 𝚝𝚘 𝚝𝚑𝚎 [𝚞𝚗]𝙿𝚛𝚘𝚖𝚙𝚝𝚎𝚍 𝚖𝚎𝚎𝚝𝚞𝚙 𝚝𝚘𝚖𝚘𝚛𝚛𝚘𝚠 𝚊𝚝 𝟷𝟽:𝟹𝟶

https://t.co/o8xKiqQ5CJ

@itayhzn
@gadievron
@kupsul
@oryair1999
@IdaVass1

[Stiv Kupchik @kupsul]

@vxunderground @silascutler @WinRAR_RARLAB Does it come with the bag?

[Stiv Kupchik @kupsul]

We're out of stealth!
(Posts, blogs and public presentations notwithstanding)

[Lumia Security @LumiaSecurity]

We’re excited to launch Lumia Security!
Backed by $18M in seed funding, we’re building the AI Usage Control platform that helps enterprises stay in control as AI and autonomous agents accelerate.
Follow along. Big things ahead.

https://t.co/etP5P5agRF

#AIsecurity #EnterpriseAI

[Stiv Kupchik @kupsul]

@vxunderground @ddd1ms Cool!

[Stiv Kupchik @kupsul]

@1yoni VSCode is Electron, so it's also Chromium

[Stiv Kupchik @kupsul]

@LumiaSecurity We did get an acknowledgment from MITRE though, as they added our writeup as a case study, and also updated their ATLAS matrix with new techniques accordingly

[Stiv Kupchik @kupsul]

My first post for @LumiaSecurity is out!
When I joined, I didn't know a thing about AI, so I targeted its client applications instead, for my first security research.

Introducing AIKatz - stealing the auth tokens from LLM clients to impersonate the user.
https://t.co/O8zPgUDBit

[Stiv Kupchik @kupsul]

@LumiaSecurity MSRC told us that we need to cross the user boundary for a CVE, but that would probably be a CVE in Chromium, not Copilot.
Instead, I did find a DLL Hijack attack on the Electron client, but it's Intel's graphics issue, which simply wasn't patched yet -.-

[Stiv Kupchik @kupsul]

My talented colleague @teller_1337 just finished his #BlackHat presentation, and released a blog accompanying it as well!
Wanna know what Apple Intelligence reports to Apple about you behind the scenes? Read on!
https://t.co/TfCsZTU8c5
Or catch him at DefCon

#BlackHat2025 #Apple

[Stiv Kupchik @kupsul]

@SebAaltonen I usually split the blog into 2. First part is compact and easy to read, with link to summary/recommendations at the end, and the second is the nitty gritty nerd stuff

[Stiv Kupchik @kupsul]

@wunderwuzzi23 I think the "allow always" is only for that particular chat, so at least it's not really persistent. There is a permanent option hidden somewhere in the app settings, but a user has to be very deliberate to get it so it's not really YOLO

[Stiv Kupchik @kupsul]

@ryancbarnett @4ng3lhacker @BugBountyDEFCON Congratz & good luck!

[Stiv Kupchik @kupsul]

Thought I found a cool new vulnerability in an Intel driver.
Nope, someone already disclosed it in 2023(!) and it simply wasn't patched yet...
No bounty for me today 😞

[Stiv Kupchik @kupsul]

@wunderwuzzi23 It seems like Windows Recall is also COM based (from analyzing the latest Windows Insider build). You can do AI recursion with this

[payloadartist @payloadartist]

Interesting writeup by @0xLupin about how he pwned Gemini to leak very sensitive parts of Google's source code including how they classify user data 🔥

https://t.co/4atS05Nn2m

#LLM #bugbountytips #bugbounty

[Stiv Kupchik @kupsul]

@_xpn_ I practice with this
https://t.co/48546fdvez