∂ετϒ

Application Security Engineer. Offensive Security Enthusiast.

[sagitz @sagitz_]

We uploaded a backdoored AI model to @HuggingFace which we could use to potentially access other customers’ data✨

Here is how we did it - and collaborated with Hugging Face to fix it 🧵⬇️

[Abhay Bhargav @abhaybhargav]

With #kubernetes network policies and CNIs like @ciliumproject, its possible to do a bunch Layer7 policies. You can use net-policies to:
- Restrict access to API endpoints on a Web Service
- Restrict certain types of queries on Cassandra
- Restrict resolution of certain DNS FQDNs

[Clint Gibler @clintgibler]

🚀 Application Security Through the Lens of Developer Experience

@chanjbs on how modern AppSec should embrace a Developer Experience (DevEx)-focused approach

#cybersecurity

https://t.co/BERPWXxqrZ

[Nagli @galnagli]

The team at @OpenAI just fixed a critical account takeover vulnerability I reported few hours ago affecting #ChatGPT.

It was possible to takeover someone's account, view their chat history, and access their billing information without them ever realizing it.

Breakdown below 👇

[Hillai Ben-Sasson @hillai]

I hacked into a @Bing CMS that allowed me to alter search results and take over millions of @Office365 accounts.
How did I do it? Well, it all started with a simple click in @Azure… 👀
This is the story of #BingBang 🧵⬇️

[∂ετϒ @Merenon]

@activeOtwo ❤️

[Barsee 🐶 @heyBarsee]

ChatGPT and Bard is phenomenal AI.

But try these 13 new AI websites to finish hours of your work in minutes:

[∂ετϒ @Merenon]

@activeOtwo Kg=h

[∂ετϒ @Merenon]

@mario_moreira @SergioRocks That's what Netflix did (based on books/stories): the management was encouraged to take as much vacation as possible and (more importantly) talk a lot about it and even show photos around.

[Rafeeq Rehman @rafeeq_rehman]

CISO MindMap 2022. What do #infosec professionals really do? Next time someone asks this question, this is your answer! #CyberSecurity #informationsecurity #riskmanagement #CISO #MindMap https://t.co/Q6TSSJ7KfF

[Jacopo Tediosi @jacopotediosi]

I just published a post on Medium about the most relevant vulnerability I have found in my life so far.

"Worldwide Server-side Cache Poisoning on All Akamai Edge Nodes ($50K+ Bounty Earned)": https://t.co/Pb85Vow3h9

[Corben Leo @hacker_]

I hacked a gaming company this year.

Here's how I did it:

[Abhay Bhargav @abhaybhargav]

Every org I talk to feels that they're messing up their Security Champions program. What you should do instead?

- Get them continuous training
- Don't blame them
- Incentivize them. Remember, they're going beyond the call of duty
- Get feedback from them. Its a two-way street

[Ishaq Mohammed @security_prince]

Found this gem today on How to start an AppSec Program with the @owasp Top 10

https://t.co/4z5b7g6Hd5

[∂ετϒ @Merenon]

@SonarSource Incredibly creative attack and excellent write-up 👌

[Sonar @SonarSource]

Our security researchers discovered a technique that allows attackers to disclose sensitive information from Python applications using the popular Django framework.

Learn more in our technical analysis:

https://t.co/GM0tI0tW83

[∂ετϒ @Merenon]

@abhaybhargav #Python for quick scripting and automation. #Go as it's the current standard for Kubernetes, HashiCorp, etc.

[Anton @ByQwert]

Open redirect vulnerability and how to use it "correctly" in bug bounty 🙃
https://t.co/O0uuj2msct