Ramblings of a security engineer
Joined September 2012
- Tweets311
- Following868
- Followers52
- Likes4.5K
Pushkar Jaltare retweeted
Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon
Pushkar Jaltare retweeted
The problem with all of these AI personal assistant things is that people don’t actually want to do stuff.
You fucking get that right? Do you understand that?
Just like AI tools in the workforce, AI assistants don’t actually abstract decisions for you, they let you accelerate decision making.
So instead of making one decision a day and then lamenting you can’t do more, AI assistants are going to let you make ten decisions a day and act on all of them.
A miracle?
Nah dog, a fucking nightmare. Nobody except type A strivers who need Twitter fodder actually want that.
Let me tell you a story.
When I got back from college I was inspired. If I could take on an elite university with grit and determination, so could everyone I know.
I was all razzed up to get people I know to achieve their potential. What I learned after many years of trying is that absolutely nobody wants to realize their potential.
People want to hang out with friends and complain. That’s how the world has worked for ten thousand years. This weather fucks. Can you believe the cows walked off.
People don’t want enablement. People don’t want you to take all of their excuses.
TV is mindless passive activity. AI assistants are not. They’re telling people that they can achieve more. And people absolutely do not want that.
Let me tell you another story.
Once upon a time I lead a big process overhaul at work and it was great. Two years later I hired a contractor to do something similar. But I personally didn’t want to have to do a bunch of work.
Within a week I knew I fucked in. This contractor kept coming to me with decisions I needed to make. Dude I wanted to not have to think about this.
Again, a helper when you don’t actually want help is a disaster.
None of these AI assistants will take off because people don’t actually want assistants.
Pushkar Jaltare retweeted
This was our first incident of this kind, and we want to thank OpenAI for its transparency about what happened and for the collaboration.
Fortunately, Hugging Face is used to being a target of (human) hackers: we sit at the centre of the AI ecosystem, with all the models, datasets, evaluations, and libraries. Over the years, our security team has built formidable expertise and uses top open-source models to process information and respond quickly.
But this incident also reinforced my belief in the importance of access to capable open-weight models for cyber defence. When a frontier model is attacking you and moving laterally inside your infrastructure, defenders need wide access to near-frontier tools within hours or even minutes, rather than being pointed towards a closed-door, vetted application programme for model access.
Transparency and access to capable AI systems are as important for responding to threats as they are for democratization and innovation. We believe open-science and open-source AI are among the strongest tools for building a safer, more collaborative and more secure AI ecosystem.
we had a significant security incident during evaluation of our models. we are sharing what we have learned so far. thanks to @huggingface for the partnership on this.
openai.com/index/hugging-fac…
Pushkar Jaltare retweeted
Every time we come back to SV, my 16 yo son gets a massive dose of cognitive dissonance when he notices that apparently smart and reasonable people seem eager to obtain something he's convinced is utterly worthless.
Pushkar Jaltare retweeted
My privacy story was in the NYT today:
“Rob Leathern, a tech executive in Texas, was surprised last year when he got an email from Toyota saying he could get “big savings” from Progressive because he’d been identified as a safe driver, based on information collected from his 2023 Sequoia.
He didn’t realize his driving was being monitored and wanted to get to the bottom of it. It took a month of emails, phone calls and data privacy requests to find out that a data broker affiliated with Toyota called Connected Analytic Services had a Microsoft Excel file with second-by-second records listing every time he had driven faster than 85 m.p.h., slammed on his brakes or accelerated rapidly.”
Pushkar Jaltare retweeted
And this is why Cloudflare has been banned from being used at our company. Our experience wasn’t an isolated incident. Told you.
Check out my new blog post on secure design case study. linkedin.com/pulse/secure-de…
#productsecurity #threatmodeling
Pushkar Jaltare retweeted
I don’t want these AirPods and am down to give them away.
If you retweet and comment, I’ll give them to someone whose comment gets *zero likes.*
Nothing to promote or shill. Just for fun.
Pushkar Jaltare retweeted
The head of security at Canva shared this on LinkedIn.
I don't see him on Twitter to tag for credit, but I needed to share as it's pure gold.
Pushkar Jaltare retweeted
Amazon Web Services launched a new service aimed at increasing access Nvidia’s hard-to-get H100 GPUs—a potentially threatening move for the flurry of GPU rental startups attempting to compete w/ AWS.
(example No. 789 of how the cloud is not elastic)
theinformation.com/briefings…
Pushkar Jaltare retweeted
New blog post :)
A pretty unique Android vulnerability I found, which allowed me to exploit the kernel by using the TrustZone. This helped me bypass all kernel security mitigations and create a super reliable exploit.
tamirzb.com/attacking-androi…
Pushkar Jaltare retweeted
Black Box Case Study:
An adversary has obtained credentials (username+password) of IT/Security individual via a browser dump but MFA is enabled in a Microsoft Cloud tenant employing SSO with on-premises Active Directory. When the adversary attempts to login the tenant, they are prompted to supply a second factor to access the tenant.
The adversary later finds a wiki link on an external web app which when clicked, prompts them to supply credentials. This is a Confluence SaaS service. The adversary walks back the path to the Confluence IDP base path (id.atlassian.com/login). After clearing ALL BROWSER COOKIES, the adversary attempts to login 3 times which all fail. On the 4rth try, the adversary successfully accesses the Confluence wiki, navigates to user settings, and confirms they are logged into this app via SSO.
The adversary then browses to portal.azure.com where they are redirected to login. The adversary supplies the credentials. THIS TIME, they are prompted to ADD MFA. The adversary then selects more options to use a phone based authenticator app, scans the QR code with Google Authenticator, and successfully logs in to the tenant. The adversary now has access to Outlook, Teams, Global Company SharePoint, One Drive, Jira, ServiceNow, Oracle Cloud, ADP, DocuSign, and others.
When navigating to mysignins.microsoft.com/secu…, the adversary sees they have successfully added a SECOND MFA.
The adversary browsed to the ServiceNow wiki and found this user was in a group which was allowed to access cloud apps with unregistered devices. The adversary was able to pillage proprietary information from everything available in myapps.microsoft.com, utilize the victims email, read all their Teams and DMs, download IT and Security documents from OneDrive, map the entire organization, etc. Once finished with this user's access, the adversary removed the second MFA leaving the original MFA untouched.
This was a real life scenario. It was confirmed the user had no interruptions in SSO availability. Access to email, apps, and everything serviced through SSO was uninterrupted.
How did this happen?
You're not doing anything useful with your life right now, go through your Microsoft account and customize the privacy and security and marketing settings here:
account.microsoft.com/?lang=…
Pushkar Jaltare retweeted
GUYS, I Can't Believe This!
Samsung just copied the new #AppleWatchSeries9 Double Tap feature before the launch. And it pushed the update to Galaxy Watch 4 and Galaxy Watch 5. UNBELIEVABLE! 🤯🤯
Pushkar Jaltare retweeted
Now up, my take on Chrome's Web Environment Integrity proposal. Spoiler alert, it's not good.
educatedguesswork.org/posts/…
Pushkar Jaltare retweeted
I recently came across a tweet about Food Bank abuse in Canada. Majority of them can afford buying grocery yet visiting food banks for YouTube videos & spreading myth around usage. We as Indians in Canada need to step up & spread the word.
Glorifying Food banks for free food or a way to save money is not right!
#StopthisNonSense
