Chris Wysopal

Hacker. Co-founder/CTO Veracode. Former L0pht security researcher. GenAI Auto-repair of vulns is the future @weld.bsky.social @[email protected]

[Chris Wysopal @WeldPond]

28 years ago today, 7 members of the hacking group @L0phtHeavyInd told the U.S. Senate they could "shut down the internet in 30 minutes."

[John Stauffacher @g33kspeed]

"I mean they say you die twice. One time when you stop breathing and a second time, a bit later on, when somebody says your name for the last time." - Banksy

We've lost too many.
#NaClCon #rip

[WWAY News @WWAY]

Some of the people who helped build the modern internet and shape today’s cybersecurity industry gathered in Carolina Beach this week for the inaugural NaClCON conference. https://t.co/RcXCIShxyV

[Chris Wysopal @WeldPond]

@joshcorman See you there!

[Chris Wysopal @WeldPond]

"If LLMs can be entrusted with software development, then they ought to be writing patches that work.

They’re not.

The contrast between the breathless blog posts from commercial entities and ... 97 findings patched in the open source world is really shocking." https://t.co/wVJXikdWHV

[Chris Wysopal @WeldPond]

@caseyjohnellis It's all gray.

[Chris Wysopal @WeldPond]

@sufyanov_ @anton_chuvakin @L0phtHeavyInd It’s been open sourced. https://t.co/q3D6d4vFGH

[Chris Wysopal @WeldPond]

28 years ago today, 7 members of the hacking group @L0phtHeavyInd told the U.S. Senate they could "shut down the internet in 30 minutes."

[Chris Wysopal @WeldPond]

@extropiani @L0phtHeavyInd @grok Introduced in 1989. https://t.co/VNRb2dNvEW

[Chris Wysopal @WeldPond]

I just learned the sad news that Peter Neumann has passed away.

Peter Neumann shaped how a generation of security people learned to think about risk. As editor of RISKS Digest, he gave many of us coming up in the 1990s and early 2000s a steady education in the real-world consequences of computer failures. His work made the field more serious, more thoughtful, and more honest. He will be missed.

I first met Peter when we both testified at the 1998 Senate Governmental Affairs Committee meeting on Government Security where the L0pht testified. The combination of Peter and the L0pht made the hearing more powerful even if us hackers stole the spotlight.

Neumann and the L0pht made the same argument from two different directions. Neumann gave the institutional, systems-engineering view: the country was becoming dependent on brittle, interconnected systems that were never designed for security, reliability, or survivability. The L0pht gave the field evidence: here are the actual flaws, here is how attackers think, here is how cheaply and quickly these systems can fail in practice.

Neumann supplied the credibility of a long-time researcher warning that this was not just “hackers breaking into things,” but a structural failure of technology markets, procurement, engineering discipline, and risk management. The L0pht supplied the proof that the warnings were not theoretical. Together, we made the hearing unusually powerful: the academic risk community and the hacker community were telling the Senate the same thing, in different languages, before the rest of the world had fully caught up.

[Chris Wysopal @WeldPond]

Black Hat USA Arsenal listing is out!

19 tools use AI.

https://t.co/1eUh0SuvVP

[Katie🌻Moussouris (she/her/she-ra/she-hulk) 🪷 @k8em0]

Couldn’t agree more with @WeldPond about @window for @DarkReading being “one of the most important security leaders of the past two decades," for her ability to achieve systemic change. Great #Darkreading20 special coverage.

[The bl33p bl000p Collective @bl33pbl000p]

clanker beats is slow industrial dystopia made on an 84 hp modular
https://t.co/MEzcsEgEVk

[Chris Wysopal @WeldPond]

How to Not Get Cooked

[Dave Aitel @daveaitel]

https://t.co/vngHIPQFKk

[Security Harvester @secharvesterx]

The NaClCON (Salt Con) speaker list is out! May 31–June 2, Carolina Beach NC
https://t.co/XsgwXdJKyr

[Chris Wysopal @WeldPond]

I’ve been promoting the value of AI to fix for over 2 years to our customers. If you have a dual use technology ethics says build more fire stations before you unleash the flamethrowers. I started releasing dual use tools over 25 years ago and I adamantly believe in them. You need to promote the defense side to all who will listen as the offense side needs no promotion.

[Chris Wysopal @WeldPond]

@tqbf I never look at the clock if I get up in the middle doe of the night. Just go back to sleep with no information.

[Chris Wysopal @WeldPond]

@daveaitel @sherrod_im The willful ignorance of latent vulns. It was as if it didn’t exist until a vuln researcher discovered it.

[Matt Johansen @mattjay]

He began by replicating Mythos findings with his specialized harness.

Then went on to find more critical novel zero days in open source code that he can't share yet because they're not fixed.

TL;DR - harnesses are where the magic is. https://t.co/e8jhbktBKQ

[Chris Wysopal @WeldPond]

Should Tesla have a mode where it learns the driving habits of the driver in the region and behave accordingly? For instance, I’m in Boston so it would cut people off, merge at the last second and treat blinkers as signals you might not want to give off in all lane changes.