Andrew

@karambit_ai
co-founder; interested in automating cybersecurity

[Andrew @zelkathak]

@evm_sec Thanks for the pins! They look great.

[The Hacker News @TheHackersNews]

Hacking incidents in #healthcare have tripled from 2018 to 2022. To defend against cyberthreats, organizations should adopt an attacker's mindset, focusing on asset inventory and monitoring.

Learn how attackers operate in the digital age: https://t.co/1MaOt6M95T

#cybersecurity

[Andrew @zelkathak]

@lcamtuf I would agree with this, but maybe not as strongly. Having an understanding of building blocks is good, you just need to add to it. A lot of what I've focused on is the behaviors of software rather than just the components of software.

[Andrew @zelkathak]

Another example of why we need a better understanding of the behaviors of the software and hardware we use. Just trusting developers doesn't seem to work out.

[HaxRob @haxrob]

This invasive Bluetooth car battery monitor was found to be sending the following location data to 🇨🇳

- GPS
- Wifi devices
- Cell phone towers

The Apple and Google app stores said no personal data was collected.

A new update has emerged. Let's see what was changed 👇(1/n)

[Andrew @zelkathak]

Excited for my @RVAsec talk next Tuesday, June 13th. I'll be talking beyond #sbom: Software Bills of Behaviors and how they get to the core of what really matters for #softwaresupplychainsecurity: what will this software actually do if I use it?
https://t.co/SGyOKys5G3

[RVAsec @RVAsec]

Speaker Feature: Andrew Hendela https://t.co/ijKvJnvOjb @zelkathak #cyber #conference #rva

[SWFLSec @SWFLSec]

Join us Tuesday, 5/16 at 6:30PM to learn about Chaos Patching from @zelkathak co-founder of @karambit_ai
RSVP here - https://t.co/wbGSclE0Nl  #infosec #appsec #cybersecurity #swfl #buildingcommunity

[Space Coast Sec @SpaceCoastSec]

Join us Tuesday, 5/16 at 6:30PM to learn about Chaos Patching from @zelkathak co-founder of @karambit_ai
RSVP here - https://t.co/iYAj3xv6Zu  #infosec #appsec #cybersecurity #spacecoast #buildingcommunity

[Andrew @zelkathak]

@CloudflareDev @erhlee_bird @karambit_ai This program was a great experience. Great thanks to the whole team involved!

[Cloudflare Developers @CloudflareDev]

Workers Launchpad Funding Program Cohort #1

Meet startup co-founders Andrew Hendela @zelkathak and Eric Lee @erhlee_bird of https://t.co/ApSNiveVHN @karambit_ai https://t.co/kQomFOCt10

[Virginia Innovation Partnership Corporation @VirginiaIPC]

VIPC Awards Commonwealth Commercialization Fund Grant to Karambit. AI Inc.

-- @karambit_ai

Continue to Full Story: https://t.co/eN1KxbOHSg

[The Hacker News @TheHackersNews]

Researchers have uncovered four new malicious packages in the #Python Package Index (PyPI) that sneak #malware onto developers' systems and manipulate their SSH authorized_keys.

Read: https://t.co/Dc6p52sBYc

#programming #coding #hacking #cybersecuritynews

[Karambit.AI @karambit_ai]

We get asked a lot of questions about how we find unauthorized software modifications without source code and without running the compiled software. The best way to answer is often just to show you the results.
https://t.co/IZd4G1FZnT
#sbob #softwaresupplychain #cybersecurity

[Karambit.AI @karambit_ai]

We're incredibly excited to be a part @Cloudflare's first Workers Launchpad cohort! https://t.co/9SafJYxh8k #WorkersLaunchpad

[Andrew @zelkathak]

@drhyrum @malwareunicorn @CamlisOrg This was an excellent talk, getting right to all of the downfalls that those doing malware analysis have run into. Putting it all so succinctly was great.

[Andrew @zelkathak]

@erhlee_bird I was thinking the same thing. I am glad it was pointed out to me earlier this year. Lots of interesting talks already.

[Karambit.AI @karambit_ai]

There was a paper written by Todd Heberlein years ago called "The Advanced Persistent Threat You Have: Google Chrome" that basically said that Chrome is an #APT. Chrome does similar things to an APT but we don't think it is #Malware because it came from Google.

[Andrew @zelkathak]

It is another good reminder that suppliers are a threat vector for important targets. Securing closed-source dependencies is as important as securing open-source ones.

[Securonix @Securonix]

@Securonix Threat Research team recently discovered a new covert attack campaign targeting multiple military/weapons contractor companies, including a strategic supplier to the F-35 Lightning II fighter aircraft. Read More! https://t.co/s2lu9RhgP0

[Karambit.AI @karambit_ai]

Know what the software you are using is doing: https://t.co/DHQQ0mosQq is opening our Software Bill of Behaviors API to the public. Sign up for an API key, generate Software Bill of Behaviors for uploaded files, and analyze diff reports to see how these behaviors change over time

[Andrew @zelkathak]

Thankfully this attack against a developer was caught, but it is a good reminder that adversaries are targeting development companies to use their software as an attack vector.

[reverseame @reverseame]

Attackers target Ukraine using GoMet backdoor https://t.co/JiE5WGatme