GrapheneOS threatening to sue Google is strange; it is Authy that decided to restrict their app to "genuine" Android devices based on remote attestation Also for perspective: Authy's days are numbered anyway, given that future is passwordless arstechnica.com/gadgets/2024/0…

Sign of incompetent vendor: Puts more effort into cease & desist orders against obviously non-infringing parody/satire than improving their weak-sauce technology that caused a global IT outage #Clownstrike #DumpsterFire

Cem Paya Ryan Hurst It would be a different story if Google allowed GrapheneOS to pass the device and strong integrity levels via the hardware attestation API but added an extra field in the response saying that the OS is GrapheneOS. Apps could go out of the way to ban it if they wanted.

"Creating our own bytecode VM for detection rules will be much safer than constantly writing new code for kernel mode 💡" — said someone somewhere at #Clownstrike

The pk.fail service has an open API interface for mass scanning. By today, 7550 unique FW images had been checked, and 534 (7%) contained non-production keys or were exposed to the #PKfail. The detected keys are associated with AMI (majority), Insyde and Phoenix.

#Clownstrike: "Combining third-rate technology with first-rate lawyers: always ready with a DMCA takedown notice in case anyone dare criticize us" arstechnica.com/tech-policy/20…

JD Vance’s dossier would have been safe if the campaign stored it on CouchDB 🤷 thedailybeast.com/trumps-270-pag…

Identity fails With Twitter verified profiles, users at least have some confidence they are following the genuine bloviator/influencer On GitHub still no way to know if that ace developer is really a North Korean stooge/APT operative 🤷🏽

So-called experts: "Tornado Cash is a valuable privacy service used by everyday people for legit purposes" Reality: #delusions #KYCfail coindesk.com/markets/2024/0…

#ECJ upholds the fine of €2.4 billion imposed on Google for abuse of its dominant position by favouring its own comparison shopping service #competition European Commission 👉 curia.europa.eu/jcms/jcms/Jo2_…

🎉 Thrilled by the incredible enthusiasm for our LLM Agents MOOC—12K+ registered learners & 5K+ Discord members! 📣 Excited to launch today the LLM Agents MOOC Hackathon, open to all, with $200K+ in prizes & credits! 🔗 Sign up now: rdi.berkeley.edu/llm-agents-hac… & join us virtually or

1988: The Morris worm spread like wildfire and was the first worm to get wide media attention. After its author, Robert Tappan Morris, released his "experiment", it quickly spread and made many of the systems on the Internet unusable - an epoch for security...both good and bad.

Until October 30, Okta generated "the cache key" by using bcrypt to "hash a combined string of userId + username + password", which allowed full password auth bypass for usernames of 52+ bytes and apparently required only partial knowledge of the password for other long usernames

Learned a lot about security from Cem Paya Michael Breu back in the day. Lesson one is anything that can be penetrated will be. Software and hardware, and the practices around them, must be resilient & redundant. Every step must have integrity. No shortcuts.

Thoughts on ByBit First, the good stuff: impressive response to the hack. I've rarely seen that level of transparency + professionalism in a crisis. Usually you see slow, wishy-washy, lawyer-speak or quick meme-style responses that don't fit the seriousness of the situation. 1/n

Mangled casings from 2 of those 4 thermonuclear weapons from the Palomares (Spain) broken-arrow incident is on exhibit at the Museum of Nuclear Science & History in Albuquerque. nuclearmuseum.org/see/exhibits/c…

Recent work from River security team and Ryan Hurst : how our discovery of bogus "River desktop app" in the wild lead to DigiCert revoking ConnectWise's code-signing certificate and invalidating all existing ScreenConnect binaries on Windows blog.randomoracle.io/2025/06/16/the…

1/ 🔥 AI agents are reaching a breakthrough moment in cybersecurity. In our latest work: 🔓 CyberGym: AI agents discovered 15 zero-days in major open-source projects 💰 BountyBench: AI agents solved real-world bug bounty tasks worth tens of thousands of dollars 🤖

Now that GDATA also posted about this and cat is out of the bag. Write-up on how ScreenConnect was abusing Microsoft Authenticode signatures in a way that made it ideal for malware to repurpose their installers (previously disclosed to vendor) blog.randomoracle.io/2025/06/26/scr…

A deeper, more technical dive into a design flaw in the ScreenConnect executable that made it particularly appealing for malicious campaigns. blog.randomoracle.io/2025/06/26/scr… History Case: blog.randomoracle.io/2025/06/16/the…