Stephen Sims

Perpetual Student | SANS Fellow | Musician | Braggart Hater | Gray Hat Hacking | VR | 🏂 | deadcode |

[Stephen Sims @Steph3nSims]

Looking forward to this event! If you’re going to be there come find me to say hi.

[Offensive AI Con @OffensiveAIcon]

Just two weeks until OAIC! Will Schroeder, Lee Chagolla-Christensen, Becca Lynch, Matthew Nickerson, Max Bazalii, and Aaron Grattafiori are up the first half of day 1!

See the full agenda at https://t.co/CPMwxOtaOQ

[Stephen Sims @Steph3nSims]

Join me on Friday, September 25th at 12:30PM for the next @offby1security stream with guest Tarun Koyalwar @KoyalwarTarun on "Watching Offensive AI Agents Work!"

Thanks for helping us reach 50K subscribers!

https://t.co/PA4DqChTGW

[Stephen Sims @Steph3nSims]

Breaking Windows: Exploring Security Through Kernel Drivers https://t.co/R4TRIYtRtC

[Stephen Sims @Steph3nSims]

@noperator @Umbriel_AI @mdowd @dyn___ Congratulations. Are you moving to down under?!

[Stephen Sims @Steph3nSims]

Stream Reminder: @zodiacon (Pavel Yosifovich) will be joining me on the @offby1security stream tomorrow 18-September at 11AM PT for a stream on Breaking Windows: Exploring Security Through Kernel Drivers!

https://t.co/wkYJ8AonRv

[Stephen Sims @Steph3nSims]

Join us next Friday, September 18th at 11AM PT for the next @offby1security stream with the great Pavel Yosifovich (@zodiacon) for a session on, "Breaking Windows: Exploring Security Through Kernel Drivers!"

https://t.co/wkYJ8AonRv

[Stephen Sims @Steph3nSims]

@jon__reiter

[Stephen Sims @Steph3nSims]

Lesson learned...

I forgot I switched to my "family" WiFi network when running an offensive campaign against intended test targets. The first bad indication was when my printer started printing, and then I found my Samsung Family Hub Fridge with a bricked screen and it's EoL.

[Stephen Sims @Steph3nSims]

Question: For pen testers and red teamers working internally at an organization, or working as a consultant, is your offensive AI solution:

[Stephen Sims @Steph3nSims]

Almost at 50K! I think that's great for a channel that focuses primarily on advanced content! Thanks to everyone who has subscribed and to all of the guests who have joined me for a stream!

[Stephen Sims @Steph3nSims]

@offsec225881 Coming soon

[Stephen Sims @Steph3nSims]

I’ve been doing a lot of thinking about this over the past week.

It’s getting very easy to become complacent and let AI do everything for us, especially when we’re all being pushed to 10x our output. It can be hard to justify spending hours getting into the low-level details when a model can often get you most of the way there in seconds. A lot of respected practitioners have already raised concerns about skill deterioration, and I think they’re right to worry about it.

At the same time, AI is going to make software meaningfully more secure.

As more companies integrate strong AI code scanning directly into CI/CD, a lot of low-hanging fruit is going to disappear. Even harder memory corruption bugs, unsafe API use, obvious authorization problems, and common implementation mistakes are going to get caught earlier and more consistently. That’s of course a very good thing.

But I don’t think vulnerability research or hacking suddenly ends. The offense adapts, and the bar rises. That's always been the "fun" part for those of us in the offensive space.

I’ve spent a lot of time lately benchmarking what AI code scanning and dynamic sandbox analysis are good at, and I think the harder problems increasingly move toward things like business logic flaws, strange state-machine behavior, race conditions, cross-service trust mistakes, authorization failures that only emerge across multiple components, protocol composition issues, and distributed-system behavior. I've been trying to write CTF challenges for learning that capture this.

And then we’re adding entirely new attack surfaces like agents, tool use, model orchestration, persistent memory, agent-to-agent communication, and systems where one AI is implicitly trusting the output or state of another.

AI will continue to help researchers explore these systems at a scale humans never could before. That probably means we’ll discover failure modes and bug classes that we haven’t even thought of yet. Which is why I think it’s more important now, not less, for people to keep putting in the work to understand how things actually work underneath.

I catch myself taking the easy route with AI more often than I’d like. Fortunately, I’ve spent thousands of hours coding, debugging, reversing, exploiting, and generally fighting with systems, so I can still drop back down into the weeds when I need to. Thankfully, there are a lot of us in this pool.

What worries me more is the next generation coming into the industry. How do they build that same intuition if AI removes so much of the struggle that used to force us to learn? There are fewer intern spots, fewer junior positions, etc...

Because if you don’t understand what’s happening underneath, it becomes much harder to know when the AI is wrong, when a finding is overstated, how to properly validate an issue, how to turn odd behavior into a real vulnerability, or how to recognize an entirely new bug class. Vulnerability research has never really been about instant gratification. It takes time, patience, creativity, failure, and a certain amount of stubbornness.

AI absolutely makes us faster. We should use it. We just shouldn’t let it make us stop thinking.

My current belief is that both offense and defense are going to level up dramatically. Software will get more secure, but researchers and attackers will get more capable too. The bugs that matter will simply become harder, stranger, and more interesting. As a historically offensive practitioner that's exciting to me as it's curiosity that brought many of us into this space.

I swear I reread this 10 times worried that it sounds like AI wrote it. I promise it didn't. :) My hope with this tweet is that it encourages those coming into the space, or who are new to the space, to put the work in to learn as much as you can. One thing that attracted many of us to this space is the challenges with solving complex puzzles. I encourage you to go back and read Hacking: The Art of Exploitation... .The Shellcoder's Handbook, and selfishly, the Gray Hat Hacking series!

Sorry for the looooooooooooong tweet.

[Stephen Sims @Steph3nSims]

I’ll keep digging in on it. I’ve even seen people screen record the disassembly and get it. Time limits with exploit primitive mutations is a feasible option.

The bigger question is philosophical. e.g. For how much longer does it matter whether humans have the knowledge or not. I am a believer that we will still need expert humans with the knowledge to question and validate the results, to find new bug classes and attack surfaces, and that the synergy from the joint effort is meaningful.

[Stephen Sims @Steph3nSims]

As many are seeing, AI ruins traditional CTFs. I'm seeing students solve all challenges in an hour or two. I'm working on new challenges that include logic bugs combined with 3-4 part chains to solve. Also, making it much more difficult to pull the files off the container.

[Stephen Sims @Steph3nSims]

@statictear @qwqbebe I can honestly say that I’ve been submitting a lot of disclosures and the challenging part has been triaging overstated CVSS severities, justifying the values in the scoring, chaining vulns to raise severity and impact, and writing useful reports.

[Stephen Sims @Steph3nSims]

I see it as an opportunity for those who are meant to be in the space. We need people with the low-level expertise, the curiosity and patience, the tenacity... There are those who come to cyber for the paycheck and those who are meant to be here. Vuln validation, triage and severity calculation, governance, research, creativity, etc... Talented hard-working people will have opportunities!

[Stephen Sims @Steph3nSims]

Question for music lovers… How do you feel about musicians using AI for songwriting and for music videos? I mean for writing songs, guitars, lyrics, vocals, and AI humans in videos.

This is a non-cyber tweet, but it’s the other part of my career that means the world to me.

[Kuba Gretzky @mrgretzky]

The Evilginx Chrome browser extension is now officially pending review. 🥳

Here's what's coming up in the 1.0.0 release:

- View, search, create, edit, copy, and delete cookies.
- Inspect and modify Local Storage and Session Storage.
- Import and export cookies and page-storage entries as JSON.
- Cookie Monitor that records cookies created or updated through Set-Cookie response headers.
- Kickstart Evilginx Phishlet 1.0 YAML or Phishlet 2.0 HJSON development using the cookie and hostname records gathered by the monitoring feature.
- Cookie Freeze feature allows you to test which of the captured cookies hold session authentication tokens.
- Optionally disable Device Bound Session Credentials registration by removing two specifically named DBSC response headers.

Once approved, I will release a hands-on tutorial video on YouTube. 🎬

Attaching several screenshots.

[Stephen Sims @Steph3nSims]

@jer_mchugh There are some really cool things in the works on the @CertifyGIAC side. I got to alpha test one last week and was impressed.

[Stephen Sims @Steph3nSims]

@Cyberal_chemist You'd be surprised how much winning the CTF coins means to many people. Some people are just uploading the binaries to Claude, while others have local agents running with agency. Give agents shell access and they fly through the challenges.

[Stephen Sims @Steph3nSims]

Making them harder to pull is simply to discourage going that route, or to burn time. Sadly, they can have AI write the solutions which they can verbally repeat or enter.

I'm finding that adding logic and state machine flaws, along with false positives, significantly slows AI sandbox execution.

It's near impossible to prevent students in a classroom with Internet access from using AI. Gotta work with it.

[Stephen Sims @Steph3nSims]

The goal is not to stop them, but to slow it down significantly so that students who aren't using AI with the goal of learning have an equal chance of winning.