Or Safran

[darkzodchi @zodchiii]

https://t.co/JlZbH7mCPt

[JS0N Haddix @Jhaddix]

Fun fact in LLM hacking: because of the nature of tiered defenses (Guardrails, Classifiers, Prompt Protection, RAG Access control) a LLM jailbreak might not be enough to get the system to do certain things.

An LLM jailbreak is just getting the model to reply how you want, it doesn't control those other tiers of defenses.

Learn prompt injection primitives to understand how to bypass the additional defenses:

https://t.co/dLdEW2yFcT

[Tom Dörr @tom_doerr]

Tracks human poses through walls using WiFi signals

https://t.co/k2TqRvklOp

[Immunefi @immunefi]

Incredible.

Security researcher Liork (@LucidBitLabs) just earned $100,000 for their first ever report on Immunefi.

Oh, and this report earned Liork some pretty big Hunt Points, too.

[Lior Keshet @LiorKesh]

We broke commercial root detection in Android apps 🔓📲

We targeted sensitive apps - finance, security, government - which use commercial protections.
We got them running on rooted devices.

That gave us full control to modify app behavior however we wanted.
👇

[Denis Laskov 🇮🇱 @it4sec]

Interesting and New:
A large-scale measurement study on LiDAR spoofing attack capabilities targeting object detectors, using 9 popular #LiDAR systems, resulted in a total of 15 novel findings.

"LiDAR Spoofing Meets the New-Gen" (2024)
[PDF] https://t.co/YrjPPLv3r3

[Binni Shah @binitamshah]

MultiDump : Dumping and extracting LSASS memory discreetly without alerting Defender : https://t.co/mwrSYhHZLS

[8en N@$$! @ben_nassi]

We created a worm for GenAI-powered applications. Here is the video that explains it.

By: Stav Cohen, Ron Bitton, @ben_nassi

#infosec #genai #llm #worm #security #infosec

[Mobile Hacker @androidmalware2]

Use silent #SMS messages to track LTE users’ locations

An attacker sends silent SMS messages with a defined pattern and analyze LTE traffic to verify the victim location.
All you need is just: SDR + SIM cards + LTESniffer software
https://t.co/fFfiBmmGgs

[Kuba Gretzky @mrgretzky]

🚨 The big reveal of Evilginx Pro is finally OUT! 🚨

📔From this blog post you will learn what makes the Pro version different from the community one.

🎟️I explain how Evilpuppet secret token extraction works and showcase the core features.

Enjoy! 🪝🐟
https://t.co/kQyxOOiODI

[MDSec @MDSecLabs]

Nighthawk 0.2.6 - Three Wise Monkeys, details of our upcoming new release for Nighthawk. See no evil, hear no evil, speak no evil. https://t.co/YZCE9ouoV0

[Mobile Security @Nethanella]

New attack MO for #Android #Malware #Banker abusing #WebView to attack any #Bank with no special permission need 🤯
Amazing research by @ShaharTavor
FYI @malwrhunterteam @mobilesecurity_
@AndroidPolice
A View Into Web(View) Attacks in Android https://t.co/zXLeAMd2lE

[sagitz @sagitz_]

Hex Rays + OpenAI wen?

[Mysk 🇨🇦🇩🇪 @mysk_co]

🚨 New Findings:
🧵 1/6
Apple’s analytics data include an ID called “dsId”. We were able to verify that “dsId” is the “Directory Services Identifier”, an ID that uniquely identifies an iCloud account. Meaning, Apple’s analytics can personally identify you 👇

[hela @hela_luc]

My only cybersecurity career goal is to learn how to spell “reconnaissance”

[Ido Naor 🇮🇱 @IdoNaor1]

The guy is a genius.

[hasherezade @hasherezade]

Surprise! #PEbear is Open Source now! https://t.co/kmOynDCBFU - please check it out and let me know what do you think!

[rootsecdev @rootsecdev]

This is going to be fun for bypassing MFA

Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs https://t.co/VbB1g04kqp

[Elad Ernst @EladErnst]

חשיפה דיי מטורפת ( לדעתי) של אבא שלי.
אמ,לק - במידה ואתם מחוברים לאינטרנט בסיב אופטי, יש סיכוי דיי טוב שאתם חולקים מידע פרטי שלכם עם השכנים.

קצת רקע- כיום, בישראל, ישנן 2 טכנולגיות עיקריות בהן נעשה שימוש בשביל להביא סיבים לבתים פרטים - PTP ו-GPON.>>

[Yarden Shafir @yarden_shafir]

As promised, I wrote about my Windows 11 post exploitation technique to go from an arbitrary write/increment to a full read/write through I/O rings: https://t.co/z7ZDs9UTMC