Tim

Pentester & Security Engineer
- Opinions are my own!

[Tim @t7d_dev]

@VittoStack Also interested to join

[Tim @t7d_dev]

@kunchenguid AWS Bedrock Claude seems to be still up and fine.

[Tim @t7d_dev]

@simonw We could also note the weights down and compute them by hand if power is off. And develop a cult out of it, where all the calculations are done from generation to generation to get the next token to form the secret ancient wisdom. And the answer to the meaning of life will be...

[Tim @t7d_dev]

@_kun_19 @Hacker0x01 Now on my reading list. :)

[Tim @t7d_dev]

@dcapitella @lbeurerkellner @simonw @edoardo_debe Awesome repo nice work!

[Tim @t7d_dev]

@steipete @philippberner @mitsuhiko I will do exactly that! Thanks ❤️

[Tim @t7d_dev]

AI Testing Tip: I encountered a potential remote code execution vulnerability in an AI application that turned out to be a hallucination from the model. Although all of my exploits were tested locally and worked, the result did not.
Better use a shasum with random input to verify

[Tim @t7d_dev]

A quick personal reminder to all (AI) startups: At the very least, implement a security.txt file in your web root to enable security researchers to quickly disclose vulnerabilities to you. There are so many bugs out there!

https://t.co/YpwNwgWBcb

[Edoardo Debenedetti @edoardo_debe]

We recently updated the CaMeL paper, with results on new models (which improve utility a lot with zero changes!). Most importantly, we released code with it. Go have a look if you're curious to find out more details!

Paper: https://t.co/6muay8vPeC
Code: https://t.co/JLVeFq5oK8

[Tim @t7d_dev]

Remember this weekend (27.06.-29.06.) is Google CTF time. It is always fun to participate! It will be interesting to see how much LLM use will happen to auto solve the challenges. Anyone playing?

https://t.co/OtRlmM1Te7

#security #ctf

[Tim @t7d_dev]

@terjanq I'm interested to see how much LLM use is going to happen.

[XBOW @Xbow]

XBOW automatically runs expert-level attacks across all webapps, giving security teams unprecedented scale.

@XBOW reported 1092 vulnerabilities on HackerOne in just a few months, including RCE, XXE, SQLi, SSRF, exposed secrets, and XSS.

[Tim @t7d_dev]

@wunderwuzzi23 What was your prompt? Did you include enough context for the CVSS rating? I guess the result improves with more context and examples.

[Tim @t7d_dev]

@simonw do you know if there are terms or research for "context rot" with system prompts? It feels like to me, the longer the conversation get, the importance of the llm guardrails reduces. Maybe because they make up less and less of the text feeded into the llm.

[Simon Willison @simonw]

If you use "AI agents" (LLMs that call tools) you need to be aware of the Lethal Trifecta

Any time you combine access to private data with exposure to untrusted content and the ability to externally communicate an attacker can trick the system into stealing your data!

[Tim @t7d_dev]

@simonw I'll spread the word. Awesome blog posts by the way.

[Tim @t7d_dev]

@lks_kln Copenhagen <3

[Y-Security @YSecurity]

Check out our blog post by Thore on our Mobile Application Testing service utilizing Apple Silicon.

https://t.co/poplBBpfFL

#pentest #mobile #jailbreak #apple #ios #testing #m1 #ysecurity

[Tim @t7d_dev]

@LiveOverflow Gone Girl - If you want trust issues

[Chris @0xchrisb]

I recently looked into @hackthebox_eu 's BlackSky Cloud Hacking Labs for AWS. The presented scenario and vulnerabilities are realistic and could even exist as part of a real network.

You can read about it at: https://t.co/SfMP1fPRpJ

#Y #HackTheBox #AWS #Hailstorm #BugBounty