Ian Carroll (@iangcarroll) header
Ian Carroll (@iangcarroll) profile picture

Ian Carroll

@iangcarroll

Founder at @SeatsAero. Travel/points, application security, security research, etc.

 Las Vegas, NV
ian.sh
Joined July 2014
  • Tweets2K
  • Following1.2K
  • Followers25K
272Media
Photo by Ian Carroll (@iangcarroll)Photo by Ian Carroll (@iangcarroll)Photo by Ian Carroll (@iangcarroll)Photo by Ian Carroll (@iangcarroll)Photo by Ian Carroll (@iangcarroll)Photo by Ian Carroll (@iangcarroll)Photo by Ian Carroll (@iangcarroll)Photo by Ian Carroll (@iangcarroll)Photo by Ian Carroll (@iangcarroll)Photo by Ian Carroll (@iangcarroll)
First DEF CON talk with @LennertWo was a success!
Image from Ian Carroll (@iangcarroll)
Image from Ian Carroll (@iangcarroll)
Image from Ian Carroll (@iangcarroll)
7
3
169
120,847
Ian Carroll retweeted
SinSinology (@SinSinology) profile picture
SinSinology
@SinSinology7h
Respectfully, get fucked.
Image from SinSinology (@SinSinology)
41
29
18
662
27,697
Our DiDi crashed in Shenzhen, RIP
Image from Ian Carroll (@iangcarroll)
2
31
4,871
For the next few days or weeks, anyone now has a root CA thanks to eMudhra. Time to have some fun with MiTMing unwilling devices!
Image from Ian Carroll (@iangcarroll)
49
232
82
2,823
483,000
It appears these intermediary certificates were issued with single-byte P-384 private keys. This means anyone can exploit this issue locally and issue valid certificates under them with no effort. This is very, very bad! Seems undetected since issuance in 2025?
AJ Stuyvenberg (@astuyve) profile pictureAJ Stuyvenberg
@astuyveOct 20
private keys from 8 intermediate CA certs have been compromised (eMudhra) Happy "Update everything" day to all my pager-carrying friends emudhra.we-have-a-problem.co…
Image from AJ Stuyvenberg (@astuyve)
9
57
11
669
63,123
Ian Carroll retweeted
AJ Stuyvenberg (@astuyve) profile picture
AJ Stuyvenberg
@astuyveOct 20
private keys from 8 intermediate CA certs have been compromised (eMudhra) Happy "Update everything" day to all my pager-carrying friends emudhra.we-have-a-problem.co…
Image from AJ Stuyvenberg (@astuyve)
93
998
346
5,165
4,713,665
how am I getting duped on an RCE from june (production host btw)
Image from Ian Carroll (@iangcarroll)
7
3
152
13,488
3D printing an enclosure for my DIY security key. * Within China: 20 RMB ($3 USD) * Within the USA: $46.18 USD
Image from Ian Carroll (@iangcarroll)
Image from Ian Carroll (@iangcarroll)
5
1
41
11,496
If Discord is only paying $5k for an RCE in their desktop client, it's probably time to uninstall it
karim (@kymu___) profile picturekarim
@kymu___Oct 16
RCE in Discord 👀 bugcrowd.com/disclosures/638…
16
98
3
2,347
107,194
Replying to @SAlsaif7 @bmmashat
"The weakest link in the security chain is the human element" 🙂
34
51
85
282
Ian Carroll retweeted
INIYSA (@lafaiel) profile picture
INIYSA
@lafaielOct 14
iPhone 18 Pro series logic board is comically small, even with WMCM. Making a board this dense takes pretty much every cutting edge tech in the industry.
Image from INIYSA (@lafaiel)
Image from INIYSA (@lafaiel)
Image from INIYSA (@lafaiel)
52
142
48
3,175
254,012
Ian Carroll retweeted
Nagli (@galnagli) profile picture
Nagli
@galnagliOct 13
Gemini 4 Argon has arrived! The era of super intelligence in cyber security has begun, excited to share more on how we use it to secure the world - and we are just getting started 🌎 youtu.be/ftkic7Tdpcg?si=3QxA… deepmind.google/blog/introdu…
Using Gemini 4 Argon to protect against Cyber attackers

Using Gemini 4 Argon to protect against Cyber attackers

In shadow A/B testing on real-world systems, Wiz security researche...

youtube.com
17
19
1
215
67,681
So far, I have survived this Hacker News bet.
Image from Ian Carroll (@iangcarroll)
3
1
100
7,224
My OpenAI dot produced this PCB and then hit its usage limit and gave up. AGI is here
Image from Ian Carroll (@iangcarroll)
183
85
46
2,602
253,775
Should be prohibited to try and get users to turn off lockdown mode in apps.. Probably a lazy anti-fraud system from @XMoney relies on WebGL or something
Image from Ian Carroll (@iangcarroll)
5
11
404
22,726
One of the most interesting learnings from doing AI security audits is how prevalent SQL injection still remains in numerous organizations. I had largely stopped looking for it manually, which appears to be a huge mistake - it is everywhere and the AIs are great at finding it.
11
6
2
103
7,083
Starting to think the Gemini review summaries might be a bit biased...
Image from Ian Carroll (@iangcarroll)
Image from Ian Carroll (@iangcarroll)
1
26
5,912
Ian Carroll retweeted
Brian Pempus (@brianjpempus) profile picture
Brian Pempus
@brianjpempusSep 24
This Kalshi ad is among the most dystopian ones I’ve seen from any betting app
222
287
322
5,020
1,738,045
Waymo in Vegas is amazing.
Image from Ian Carroll (@iangcarroll)
Image from Ian Carroll (@iangcarroll)
2
24
2,801
JPMorgan/Chase has to be the only VDP that demands screenshot proof they fixed their own bug lol. Rubs me the wrong way
Image from Ian Carroll (@iangcarroll)
6
227
27,908
Ian Carroll retweeted
pirate.moo (@apiratemoo) profile picture
pirate.moo
@apiratemooSep 19
I've been seeing this shift for a while now and it feels like a revert in attitude pre-bounty. Those of us old enough may recall this was not uncommon back in the day.
solst/ICE of Astarte (@IceSolst) profile picturesolst/ICE of Astarte
@IceSolstSep 19
OpenAI: “how should we engage more with the security community?” CISO at OpenAI (ex-palantir): “let’s threaten to sue the researchers” What a clown
6
5
43
4,277
Load more