@TheHackersNews It isn’t fair to say there’s a “full ASLR bypass” when it depends on the web service (PHP app in the GIF) having a LFI vulnerability. Chaining vulnerabilities is how these things get done, sure, but intentionally making a new vulnerability in the served app seems dishonest to me.
I don’t have access to Mythos, but I tried bug-hunting with Opus. The bugs I got back were fake, the model output claimed to have confirmed them, and I found two real GHSAs/CVEs for the same fake “issue”. Was that a model issue, a harness issue, or both?
https://t.co/9KkX19nZsG
Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.
It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
https://t.co/NQ7IfEtYk7
I took some time over the holidays and ran an experiment where I "forced" an LLM to remember strings verbatim.
The perplexity of the target string had a large impact on if the model could "memorize" it, and "memorizing" a high-PPL string broke the model.
https://t.co/nlrOMknatv
I created a local-only AI assistant for the terminal. It doesn't require you to use a different terminal emulator, and it runs pretty fast (<10s to generate commands) without shipping your data to some remote API. https://t.co/2SM3xLWa2I
With millions of installations, BTPanel is a prime target for security researchers. In our new guest research article, @micrictor explains how he found an MFA bypass vulnerability in BTPanel. Read the full research by Michael Torres: https://t.co/KTEBoMQSKz
@spoofyroot Is there a plan to make Sudo compatible with Administrator Protection? Based on what’s on GitHub, Admin Protection would break Sudo since they check for a matching SID between the unpriv and priv process.
At DEF CON this year, I presented the results of some research I did into Sudo for Windows. With the recording now available on the DEF CON media server, I wrote up my research in a blog post, covering four bugs - even a memory safety bug in Rust.
https://t.co/0B0Br9hcnY
@mgubrud@ylecun How is researching/building quantum computers funded by the DoD morally different than building AI systems funded by the same? The DoDs interest in quantum computers isn’t purely for the advancement of physics.
@b_sendpacket@ForensicITGuy It does not. A regularly encrypted archive will open but error if you try to actually read a file, while a header-encrypted archive will fail outright.
🏆Love me some President’s Cup Competition! Truly unique opportunity to bring together a network of cyber warriors across the federal government for 😇friendly😈competition & a whole lotta learning! And great to see the Mighty @780thC among the winners! https://t.co/0xQ7xKQi6J
REMINDER: Join us tomorrow at 12:30 PM EDT. Don’t miss our upcoming CISA Live! CISA Competitions Section Chief Michael Harpin will discuss the President’s Cup and how cyber competitions are a training resource.
More details here: https://t.co/8LXRS7NEjO
@ImposeCost The CISA folks can confirm this, but I started off every challenge opening notepad and creating my todo list.
1. Wake up
2. Be a member of the worlds finest fighting force
3. Eat a crayon
???
5. Profit
Thanks @CISAgov for a great competition again this year, and @Google for supporting me as I balance being a member of @marforres and a Googler.
Looking forward to participating again next year!
Congratulations to U.S. Marine Corps Staff Sergeant Michael Torres for winning Track B today with a perfect score and making history as the first individual to win the #PresCup more than once. Today kicks of day 1 of the Teams round to see who will escape with the top score.