Michael Torres

Security @Databricks.
Security @USMC.

[Michael Torres @micrictor]

@TheHackersNews It isn’t fair to say there’s a “full ASLR bypass” when it depends on the web service (PHP app in the GIF) having a LFI vulnerability. Chaining vulnerabilities is how these things get done, sure, but intentionally making a new vulnerability in the served app seems dishonest to me.

[Michael Torres @micrictor]

Was it just as bad when CheckPoint found a DoS bug in the exact same subsystem by hand?

https://t.co/HCu2m6GB0C

[Michael Arnaldi @MichaelArnaldi]

@ptim__ @theo OpenBSD runs a lot of the networking of the world, a DoS there is a big deal

[Michael Torres @micrictor]

I don’t have access to Mythos, but I tried bug-hunting with Opus. The bugs I got back were fake, the model output claimed to have confirmed them, and I found two real GHSAs/CVEs for the same fake “issue”. Was that a model issue, a harness issue, or both?

https://t.co/9KkX19nZsG

[Anthropic @AnthropicAI]

Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.

It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
https://t.co/NQ7IfEtYk7

[Michael Torres @micrictor]

I took some time over the holidays and ran an experiment where I "forced" an LLM to remember strings verbatim.

The perplexity of the target string had a large impact on if the model could "memorize" it, and "memorizing" a high-PPL string broke the model.

https://t.co/nlrOMknatv

[Michael Torres @micrictor]

I created a local-only AI assistant for the terminal. It doesn't require you to use a different terminal emulator, and it runs pretty fast (<10s to generate commands) without shipping your data to some remote API. https://t.co/2SM3xLWa2I

[SSD Secure Disclosure @SecuriTeam_SSD]

With millions of installations, BTPanel is a prime target for security researchers. In our new guest research article, @micrictor explains how he found an MFA bypass vulnerability in BTPanel. Read the full research by Michael Torres: https://t.co/KTEBoMQSKz

[Michael Torres @micrictor]

@spoofyroot Is there a plan to make Sudo compatible with Administrator Protection? Based on what’s on GitHub, Admin Protection would break Sudo since they check for a matching SID between the unpriv and priv process.

[Michael Torres @micrictor]

At DEF CON this year, I presented the results of some research I did into Sudo for Windows. With the recording now available on the DEF CON media server, I wrote up my research in a blog post, covering four bugs - even a memory safety bug in Rust.
https://t.co/0B0Br9hcnY

[Michael Torres @micrictor]

@j2k3k

[Michael Torres @micrictor]

@mgubrud @ylecun How is researching/building quantum computers funded by the DoD morally different than building AI systems funded by the same? The DoDs interest in quantum computers isn’t purely for the advancement of physics.

[Michael Torres @micrictor]

@b_sendpacket @ForensicITGuy It does not. A regularly encrypted archive will open but error if you try to actually read a file, while a header-encrypted archive will fail outright.

[Michael Torres @micrictor]

In the last 40 days, I've taken 16 flights and visited 3 countries, as a part of @marforres. Now, back to work at @Google.

https://t.co/Cnf4at0I3N

[ARCHIVED: Jen Easterly @CISAJen]

🏆Love me some President’s Cup Competition! Truly unique opportunity to bring together a network of cyber warriors across the federal government for 😇friendly😈competition & a whole lotta learning! And great to see the Mighty @780thC among the winners! https://t.co/0xQ7xKQi6J

[Cybersecurity and Infrastructure Security Agency @CISAgov]

REMINDER: Join us tomorrow at 12:30 PM EDT. Don’t miss our upcoming CISA Live! CISA Competitions Section Chief Michael Harpin will discuss the President’s Cup and how cyber competitions are a training resource.

More details here: https://t.co/8LXRS7NEjO

[Michael Torres @micrictor]

@ImposeCost The Marine Innovation Unit can always use more Marines with years of experience innovating in the private sector…

[Michael Torres @micrictor]

@ImposeCost The CISA folks can confirm this, but I started off every challenge opening notepad and creating my todo list.

1. Wake up
2. Be a member of the worlds finest fighting force
3. Eat a crayon
???
5. Profit

[Michael Torres @micrictor]

Thanks @CISAgov for a great competition again this year, and @Google for supporting me as I balance being a member of @marforres and a Googler.

Looking forward to participating again next year!

[Cybersecurity and Infrastructure Security Agency @CISAgov]

Congratulations to U.S. Marine Corps Staff Sergeant Michael Torres for winning Track B today with a perfect score and making history as the first individual to win the #PresCup more than once. Today kicks of day 1 of the Teams round to see who will escape with the top score.

[Michael Torres @micrictor]

@j2k3k Air strike when

[Michael Torres @micrictor]

@j2k3k