202k Tech / Cybersecurity YouTuber. PHD in vibe coding Security Researcher, Reverse Engineer
Chiang Mai, Thailand
Joined February 2017
- Tweets5.9K
- Following2.7K
- Followers11K
- Likes35.6K
Pinned Tweet
Victory Royale
A day after a false rumor of an AWS bucket leak of a single shard of an anthropic model, there is a new rumor that a full sized model has been leaked. The codename "numbat" was actually leaked, but that does not prove this is relevant to anything.
I did look at the custom inference code and it does not appear to contain anything malicious. Would require at least 8TB vram to run.
It’s literally posted on HF bro huggingface.co/burner22/numb…
I’d assume like most content this is set up but what a weird thing to show as an example. Hacking family is both illegal and creepy
Eric Parker retweeted
more context from an actual worker at proton
imo that writer at 404media is biased against proton and has been for a while, you shouldn’t take one for-profit media outlet as source of truth
Hey everyone, we have heard your concerns about Proton’s AI strategy and culture and after internal discussions, we want to share a few things with you.
First, Proton does not install tracking software on employees' laptops to measure how much AI-generated code they produce. This rumor stemmed from a misunderstanding about how MDM software works, and it's not true.
Second, our use of AI will never be at the expense of security. In the past year, contrary to what has been alleged, additional layers of security review have been added to meet the threat posed by hostile AIs scanning Proton's open-source code for vulnerabilities. Our code is open source, and its security remains open for all to verify.
We want to prove this to you, so in the interest of transparency, we will lift the hood on how we use AI internally at Proton. This includes publicly releasing and open sourcing several of the internal tools that we use, including more advanced versions of Lumo with greater capabilities, which have never been made available outside of the company.
We will also publish how code reviews and security reviews at Proton are done, and detail our AI policies, including where AI is permitted, and where it is not, and our rationale. Instead of just being able to see the final open-source code that we produce to verify security, you will also be able to assess how that code was produced.
Lastly, we are not re-interviewing our staff about AI usage, and there are no job losses due to AI re-interviews.
You can hold us to these commitments. We're aware that we haven't lived up to the high standard you ought to hold us to, and for that we can only apologize, we are sorry.
Eric Parker retweeted
Life is a lot easier once you stop seeing threat actors as hackers who want to break into systems by any means possible, and start seeing them as businesses with well defined business processes.
A bakery isn't going to start making dog food because there's a dog food shortage. ClickFix and Phishing actors aren't going to drop everything to vibecode exploits just because a critical CVE came out.
The fact that the only actors exploiting this are the actors whose MO is exploiting things... isn't a coincidence. It's entirely predictable if you understand threat actor behavior.
Very interesting new malware that was shipped as a fake FACEIT updater. It ships salatstealer and some other run of the mill malware, but then it also has a payload which installs a trusted certificate and modifies your hosts so that steam traffic goes to an MITM server.
ANY RUN analysis: app.any.run/tasks/85875490-9…
Eric Parker retweeted
OpenAI reversed the plan to force training AI models based on usage without "off" option". Always amazing to see technology companies rediscovering what other technology companies discovered the hard way in previous 20 years ;) Speaking from PR/communication experience here.
This quoted post is unavailable.
The wordchoice here feels quite weasely, "including to help strengthen safeguards" also means not limited to.
Given they also prohibit any modern models (6.1 anything, 6 astra) from being used in daybreak the program seems essentially pointless at this point.
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
Eric Parker retweeted
For over a decade, Reddit never missed an opportunity to preen about so-called “net neutrality.” It virtue-signaled that the company was “built on the premise of letting individuals decide what content they find interesting. We believe the same basic principle should apply to the internet as a whole.” It launched multiple “Days of Action,” trying to scaremonger people into believing that the internet as we knew it was about to end—obviously wrong then and now. Without utility-style internet regulation, Reddit warned that corporations would take actions solely “for their own profit.”
How times have changed. Reddit is now making its own “open” platform a walled garden. Specifically, it’s unilaterally decided to block consumers from accessing Reddit content unless they log in—what it calls a “logged-in-only experience.” (So much for letting “individuals decide what content they find interesting.”) That’s because corporate-controlled access yields more consumer-specific information that benefits Reddit’s own advertising and data businesses. All this despite the company being enormously profitable already—it’s made over $740 million this year, a record by far.
Far be it from me to suggest that Reddit must be regulated or prohibited from doing what they think is a key driver of “monetization on Reddit.” Assuming no violations of law or regulation, my views here are clear—and they don’t change, even when corporate leadership previously accused me of corruption and called repealing FCC regulations “un-American.” But when a company that has constantly and vitriolically demanded regulation of its perceived rivals—to prevent alleged harms to consumer from conduct that was purely hypothetical—now explicitly boasts about giving consumers a less-open Internet to benefit its bottom line, it should get the public scrutiny and mockery it richly deserves.
Eric Parker retweeted
People are misunderstanding
The FIRST thing that happened was a devops laptop was compromised
Then A LOT of other shit happened
Then the hack happened
These are really skilled hackers. They navigate complex systems and get the access they need from a tiny toehold.
One of the largest True Crime channels on @youtube has been demonetized. Apparently without any contact despite having over 7 million subscribers.
Eric Parker retweeted
It turns out Youtube's AI moderation is demonetizing true crime content creators across the board. Explore With Us has been around for over a decade and gets tens of millions of views per month.
EWU was demonetized yesterday as well, the same as me ("generic content").
Is this AI moderation gone haywire?
"All Watched Over By Machines Of Loving Grace"? Perhaps not.
Eric Parker retweeted
The same guys who claimed a few days ago that Qwen open-weight models plant backdoors just took Canadian taxpayer money at a CAD $35.7B valuation.
Their Artificial Analysis score? 9.
Meanwhile, you have probably never heard of Motif Technologies, a Korean sovereign AI startup. They scored 47 on Artificial Analysis with Motif 3, and their valuation is CAD $136M.
Even MiniMax sits at CAD $10B.
AI is clearly an important technology, but way too much money is being burned on absolute garbage right now.
This thing sounds more and more like a straight scam. Where the price adjusted to what they could afford.
Eric Parker retweeted
I don't think people can understand the scale of how big this hack was.
The prior biggest hack ever was Bybit @ ~$1.5 billion.
In the hours following this hack, 2x that amount was *frozen.*
And theres still more than that that wasn't frozen.
It's completely insane. 😭
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
So if I'm not mistaken it seems both iOS (via telegram) and Android both had 0 days that were wontfixed and then subsequently fixed without the researchers knowledge that were revealed today. Crazy.
‼️ Google won't fix an Android bug that lets one invisible text crash a phone's calling service, researcher Mark Blaszczyk says.
So he just released the Proof-of-Concept!
The malformed message never reaches the inbox and needs no user interaction. It drops active calls, emergency calls included.
He says about 30 sent in a row corrupt the phone's SMS database, so a Pixel 9 or Samsung Galaxy crashes on every boot. A factory reset only helps until the carrier delivers the texts again.
He reported it to Google on 5 May. Google closed it as "Won't Fix" and a "Non-Security Issue".
Readers added context they thought people might want to know
Google will fix it as part of the November security update. A fix has already been pushed to AOSP in October, with the first commit in June.
x.com/GrapheneOS/sta…
Eric Parker retweeted
cc @EricParker
someone can hack your phone by sending you a telegram sticker and you don’t even have to open it
a security researcher just showed that telegram’s animated stickers have a zero-click vulnerability rated 9.8 out of 10, that’s almost as critical as it gets
you receive the sticker, telegram automatically processes it to show you a preview, and that’s it.
code runs on your phone, no tap needed, no link clicked, nothing
the worst part? telegram is saying the bug doesn’t exist. they claim their servers validate every sticker so this is “technically impossible.”
meanwhile the researcher presented proof at a security conference in tokyo and the flawed code is still live in the app
there’s no patch. the vulnerability was reported months ago and telegram hasn’t fixed it
go to Settings → Privacy and Security → Messages and restrict who can message you. right now that’s the only thing between you and a sticker that owns your phone
the app 300 million crypto users trust with their group chats doesn’t even acknowledge the door is open