tuckner

Finding bad software extensions at @SocketSecurity (acquired @secureannex) #️⃣

[tuckner @tuckner]

@HackingLZ Consider the bubble popped when weather dot com bans AI

[tuckner @tuckner]

"Build in public" is having a moment for an entirely new reason 😅

[dax @thdxr]

i've spent the last week figuring out CI

on the security side, it's so easy for a single team member to get hacked and move through your system via CI

and on the volume side it's insane right now. so many commits and projects, traditional CI makes no sense anymore, too expensive and slow

[tuckner @tuckner]

@IceSolst @blackroomsec @UK_Daniel_Card @ZackKorman @shotgunner101 @LisaForteUK Can you be more specific which one it is?

[tuckner @tuckner]

@vm00z Nice one!

[tuckner @tuckner]

@HackingLZ Maybe its just short term copium for people

[tuckner @tuckner]

@TechNerdings Hard to hear Matt! Keep it going! I didn't think I hid it but people were surprised when they heard @secureannex was solo. Maybe I was naive!

[tuckner @tuckner]

@0xedgerunnr There was an AGENTS file also and it is getting standardized for harnesses

https://t.co/S8KIVLHFsd

[tuckner @tuckner]

Neat AI instructions for malware that is getting around some git repos. This is in the CLAUDE.md of the repository. If you were to use your AI agent in this folder, do you think it would ignore these instructions?

[tuckner @tuckner]

@adrianmkemp Two things:

1. When you just yolo clone repos you just get these things in a context path for agents
2. These are often compromised repositories from owner credentials so pulls or other actions will get these into your workspace

[tuckner @tuckner]

@robin_blix There are a couple execution methods added to each repo

https://t.co/2STsRjoOUV

[tuckner @tuckner]

@bcomnes Hahahaha

[tuckner @tuckner]

@maelguimet If this is what it takes, you can have my passwords

[tuckner @tuckner]

@wholisticguy Probably why there are 5x execution methods added

[tuckner @tuckner]

@277Enjoyer Smart!

[tuckner @tuckner]

@oliver_ojsec Ah nice I can't keep up!

[tuckner @tuckner]

A more basic execution in the AGENTS.md, but a unique hash

https://t.co/Yvh28pZAUh

[tuckner @tuckner]

With more code than ever, if you run a public project be on the lookout for malware in PRs! This is a blatant attempt, but it will only get harder and more obscured as time goes on.

[Dan Guido @dguido]

My Dot found malicious code in an open PR on a @trailofbits Github repo. I didn't ask it to hunt for malware! It noticed a commit, inspected what changed, and warned me about an attack all on its own.

[tuckner @tuckner]

@0x4D31 @julianor Awesome!

[tuckner @tuckner]

@ZackKorman It can look like black magic but usually it's just {open source tool} with a {remote execution framework} fronted by the hottest web design styles from 5 years ago.

[tuckner @tuckner]

@MalwareTechBlog Oh mine is just running a distillation attack on FridgeAI