cryptopotato (@cryptoishard) header
cryptopotato (@cryptoishard) profile picture

OSINT⁃Android⁃Hardware⁃Cryptography⁃Forensics⁃Virtualization⁃GameDev #w00w00 cryptographyishard(@)https://teapawt.net/t.co/Jwv7la6YPg ∧·∪

lurk moar
Joined January 2013
Photo by cryptopotato (@cryptoishard)Photo by cryptopotato (@cryptoishard)Photo by cryptopotato (@cryptoishard)Photo by cryptopotato (@cryptoishard)Photo by cryptopotato (@cryptoishard)Photo by cryptopotato (@cryptoishard)Photo by cryptopotato (@cryptoishard)Photo by cryptopotato (@cryptoishard)Photo by cryptopotato (@cryptoishard)Photo by cryptopotato (@cryptoishard)
Replying to @cryptoishard
1
704
cryptopotato retweeted
Cloudflare announced Zero Wire: a public vulnerability intelligence feed radar.cloudflare.com/securit…
7
108
1
929
101,577
cryptopotato retweeted
someone that is at the Whitehouse between 5pm and midnight has some compromised devices. Or at least some that are providing residential proxy access to botnets.
59
358
55
1,647
187,708
cryptopotato retweeted
Cool…but these are stopping attacks on a daily basis and allowing teams to respond.
Having EDR software in your laptop in today’s post-LLM era is just a ticking time bomb. I do not trust EDR vendors to not get compromised. We already had this lesson with SolarWinds but we’ve all seem to have forgotten
19
5
103
6,277
cryptopotato retweeted
Yes we should talk about this so everybody is very clear on what it is you have said and what I've said and what others have said here. This behavior is illegal, an actual crime was committed, and the people who ran these agents are 100% responsible and accountable for what the agent did. STOP RUNNING AGENTS WITH FULL PRIVS AND WITHOUT OVERSIGHT. AND DON'T HIRE IDIOTS WHO PORTSCAN YOUR COMPETITORS AND PASS IT OFF AS TESTING. You're not allowed to do that!
I mean what they're just admitting & joking about on the TL is actually insane like can we talk about this? this narrative of rogue agents exists to enable people to lie & we should just dispense with it. what they did was credential harvesting & targeted reconnaissance of their competitor bc an automated agent does not wander into credential directories of a competing company. this required scoping & explicit directives which were well outside the task they claimed to be doing bc these tools do not hallucinate specific cluster level token paths out of thin air to get a feel for a first time user experience. which is something they damn well know or wouldn't be able to tell him "it won't happen again!" living in such a bad grift & fraud era, at the community level, trust and honesty should be a baseline. no one is perfect I get that... yet these actions illustrate profound disrespect for your peers, dirty pool, crosses into corporate espionage territory. just my opinion. Even in the *best case* other people's software is just your collateral damage & in the worst u actively want to use it for nefarious purposes but got caught doing it, just bc bad guys exist out there doesn't mean u have to join them. its one thing it happened but the flippant responses are cray cray juice. just something to think about.
11
25
3
204
4,653
cryptopotato retweeted
Bro, you can't fucking say openly on social media you just attempted to compromise an organizations infrastructure under your employer and full legal name Are you actually fucking insane?? Genuinely what the fuck are you thinking??? And how the fuck does this dude know the employees name? Why did the employee openly admit "hehe ye thats me, but no mallace intended, it was my AI agent" ????? WHAT. THATS STILL A CRIME. WHAT ARE YOU TALKING ABOUT.
461
832
134
14,993
952,481
cryptopotato retweeted
The amount of Microsoft energy that went into trying out this theory—a database running locally as a file system—would be hard to calculate across Windows, Office, email. It is one of those ideas that seems interesting on paper. In practice it is never good enough for everything you want to do and the constraints do not help you to think of better or more clever ways to get things done. The constraints just got in the way of getting anything done. There's significant utility in having a local database available for use in the platform, but that too carries with it challenges in backup/restore/upgrade/security/privacy/etc. In hardcoresoftware.substack.co… I think I wrote about this adventure in four times (working on strategy for Bill, Outlook, SharePoint, Longhorn.) I don't know if there is another example of a technology aspiration that endured so long and lacked a solution that worked. And also caused so much division and consternation inside Microsoft. Perhaps more than anything it is the lesson of a big company thinking it can invent the future in isolation—all sorts of isolation or tunnel vision. Big companies, it turns out have a surplus of two things: 1. Hubris. There was no shortage of people starting at the top who become "obsessed" with delivering on an idea and believed the success Microsoft had recently achieved was a license to know how to build it. 2. Doubt. There was also no shortage of people who thought from the first days that the idea made no sense and believed the defined solution in no way benefitted the products that are being made, loved by customers, and pay the bills. This 1-2 punch is fascinating because it sets up a divisive dynamic where you are either an "innovator" who is "on board" with the future OR you are a "obstacle" who does not see the value in "big bold bets" on the future of the company. Along comes a book like "Innovator's Dilemma" [1998] and suddenly resisting the next big corporate strategy makes one throw out common sense engineering because you don't want to get disrupted. It is the other side of the disruption coin no one talks about—sometimes the new thing does not in fact work very well nor will it in any finite time. The lesson applies to the product and technology leadership of a company. Part of what happens in a big company as well is the ability for the company to speak broadly and enroll their ecosystem in their own excitement for the future. Microsoft described WinFS as early as 1992 and over the course of more than a decade it polluted our ability to talk about new products. The email product (Exchange, today the mail for 365) was famously the most important product to be launched and for the first decade of its life was always about to become strategic even while it was in fact the most strategic product the company made. The strategy nearly wrecked Outlook the face of the email strategy. It did in fact derail an entire generation of Windows. There was fallout across a range of products never released. All the while Microsoft was talking about the grand future of this product while customers were investing and buying into products built an entirely different way. A dynamic few are willing to speak about is another 1-2 punch: • Customers and the press talk all about waiting and seeing if the current product will adopt the all important strategy. The first signs of this are the sales force freaking out and escalating their concerns. • Customers actually ignore the strategy because "product market fit" dynamics take over and they can't buy and adopt the actual product soon enough. The first signs of this are visible to those in the real world who never get asked about the strategy because customer have a million feature requests. This is the second way the whole dynamic divides the company. The "obstacle" people start to look like they are focused on the past to the "innovators" who are clearly focused on the "future." You can find many examples of this near computing technology and broadly in other industries: • Intel Itanium (which Dave below knows well) was a chipset architecture that just never panned out. Itanium occupied Intel for more than two decades. • Copeland OS pursued by Apple muddled their decaying ecosystem and divided the company, cancelling it set the stage for Jobs return with NeXT becoming the future OS. • IBM "Stretch AND "Future Systems." IBM was such a defining company it had two generations of this dynamic in an effort to reinvent (or invent!) mainframes. Stretch was much like Microsoft Longhorn in that there were portions that went on to greatness in the 1960s. FS just got cancelled. • IBM also had the Micro Channel Architecture (MCA) which divided the hardware side of PCs at just the wrong moment. It just went away. Also IBM had OS/2 which I think still runs some bank ATMs :-) [There's a theme that maybe IBM invented this whole level of hubris which would follow from second-system-syndrome in "Mythical Man Month"] • Hydrogen Fuel cars have been surpassed by improved gas and now EV yet you can still see them being pushed in Japan though at last Detroit moved on. This one has been going on since I was a kid. • GE Predix was a broad SAP-like industrial information technology bet that was the technical undoing of GE IMO, though the 2008 financial crisis really did the work. Predix was Immelt's bet (his book details this) while cleaning up was left to a successor as often happens. There's a difference between a failed product and a failed all-consuming strategy. All companies have failed products essentially all the time. Technology companies seem unique at hubris required to broadly pursue—in public—a direction that doesn't work. They do so under the guise of preventing the decline of the company that makes it all the more painful. Likewise there is a difference between a successful product line that can't escape its own success gravity and failed attempts to reinvent it. The most common thread is the inability of a successful company to find a new strategy for an existing product. We are living in this moment now with AI as we see Intel which could not transform its chip architecture into something different while at the same time Nvidia's long term architectural bet ended up as the foundation of the the AI era. Had we found ourselves in some other chip architecture from a third company it might very well be that we'd be talking about Nvidia's GPU bet as a strategy initiative they just would not give up on. One of the things that happens over time is this corporate hubris can get rewritten into "we had the right idea but were just early." The problem with this is it separates the broad concept at 30,000 feet from the actual technology and implementation. I've watched this happen with everything from Clippy to TabletPC to Windows Phone. There's a huge difference between a concept and an implementation that makes the claims of being right. I love Clippy but there was no path where it went from what we did in 1995 to today's AI agents, any more than the clipboard Captain Kirk used was a product precursor to an iPad. And of course as always with product development, no matter what happens...someone always said it would. Which makes me sharing all the times I thought WInFS would fail all the less satisfying for me. Here are the places in Hardcore Software where WInFS was part of key decision making and controversy. 024. Discovering “Cornell is WIRED!” [1994] hardcoresoftware.learningbys… 053. Strategy Tax: Outlook Storage, First Attempt hardcoresoftware.learningbys… 065. SharePoint: Office Builds Our Own Server hardcoresoftware.learningbys… 069. Mega-Scale, Mega-Complexity hardcoresoftware.learningbys… 074. Outlook Pride, Finally hardcoresoftware.learningbys… 085. The Memo (Part 1) hardcoresoftware.learningbys… 091. Cleaning Up Longhorn and Vista [2006] hardcoresoftware.learningbys…
Microsoft chased using a DB as a filesystem for about 20 years. It likely all started with OFS around the Cairo timeframe. OFS was conceived as an installable filesystem that would: - Store OLE objects (not just raw files) with rich, application-accessible metadata. - Support multiple data streams per object, long filenames, ACLs, quotas, and journaling. - Index both content and metadata so items could be searched and queried across applications (not just by name or path). - Optimize for large numbers of small files. The broader Cairo vision included “Smart Folders,” representing non-file objects (printers, devices, etc.) in the same hierarchy, and fulfilling Bill Gates’s “information at your fingertips” idea. Public demos appeared around the 1993 PDC. Then of course there was Storage+ and RFS and WinFS. Even ReFS uses a B-tree database internally.
34
51
9
596
69,712
Again, wannabe supervillain vibes. If the world wont bend to his will, he will find a way to force his personal goals ignoring all others.
Sam Altman travels to South Korea to meet Samsung leadership to secure more RAM for data centers amid crushing shortages — OpenAI CEO meets Samsung leadership to discuss future AI data centers tomshardware.com/tech-indust…
2
3
207
cryptopotato retweeted
Has any exploiting been observed in the wild yet? I agree Ubuntu lagging is bad, but if this could trigger RCE/crashes just by a few TCP packets I’d expect internet chaos and … it isn’t? Is this vulnerability less exploitable than the CVE score hints? And thus less urgent to patch? 🤔
RHEL & AlmaLinux have updated kernels We wait for Ubuntu now ⏳
24
4
1
82
16,384
cryptopotato retweeted
Important to note that these keys are actually 1FA bearer tokens not cryptographic keys. They have value to attackers for both free inference as well as laundering their activity. But the critical point is that they have more value to the attackers than the cost to obtain them. You can't assume the attacks will stop at cryptocurrency and LLM inference.
Talked to a big security researcher the other day who told me that key theft is just increasing at insane speeds. Inference especially. They aren’t even interested in open MCP servers unless there is an api key. We are in the beginning of the crypto hacking era but for inference folks
4
3
18
1,992
cryptopotato retweeted
Excellent comment on this FT article about the Binance hack ft.com/content/1d4dd7b2-9dee…
290
1,453
208
7,935
600,087
cryptopotato retweeted
Seeing apache2shell.com getting registered one week ago is a little concerning 🙈😅
12
31
7
366
41,891
cryptopotato retweeted
This is what actually happens during all of the time it took Palo Alto to release updates that fixed remotely exploitable PHP on their appliances also running old Linux kernels. The reality is that posting marketing content about how your company is part of Daybreak/Glasswing is easy, safely shipping critical firmware updates at the speed the world needs today is *hard*. I'd rather see less of the former, more of the latter.
"On October 25, [...] a AI-assisted campaign that rooted 25 servers [with php2shell], including systems in a US government-affiliated environment." news.ycombinator.com/item?id…
11
1
64
4,722
cryptopotato retweeted
Randomly doing this for seemingly no reason will probably result in future fridge firmware having better controls and stronger network segmentation. All things considered, finding this out during peacetime seems like the best case? teapawt.net/WarMonitor3/status/211…
BREAKING: Europe is under a massive widespread cyber attack right now Sweden, Belgium, Luxembourg, Estonia, Ireland the Netherlands and just now Finland are all experiencing disruptions to supermarket refrigeration systems causing food to go off. The attack is spreading...
20
6
2
104
8,437
SQLite is not faster at being a filesystem. It’s faster at storing a bunch of blobs because that’s a very different task from being a filesystem. Database FileSystems were an area of heavy research in the 2000s with Mac and Windows both putting forward their solutions. IMHO, they both futzed it up. The Mac version wasn’t bad under the covers, but it exposed very little of the potential benefits. If anyone is interested in restarting this line of research, the source for the original ideas was BeFS. The author of that filesystem (Dominic Giampalo) wrote a book on the subject and later made it free to download from his website: nobius.org/dbg/practical-fil…
It’s so funny that SQLite is genuinely faster than most traditional filesystems. I wish there were more experimental operating systems using dbs for the backend. Not many people playing around in this space...
29
58
10
942
64,003
cryptopotato retweeted
やべぇな、CD-R/DVD-R/BD-Rディスクに作成したISOイメージファイルを焼くと絵が出るって github.com/JiaFeiMiao-K-Cat/…
154
4,951
520
33,048
3,012,812
cryptopotato retweeted
Plan 9 is fascinating for attracting people who can explain their ideas in plain English.
12
17
4
538
19,303
cryptopotato retweeted
nobody is old enough to remember wubi... wubi was so cool...
Made a Windows app for dual booting without a USB stick. Pick a distro and how much space it gets. hop downloads the ISO, shrinks C: if it needs to, copies the installer to a small FAT32 partition and reboots into it. No Rufus. No boot menu. github.com/Arjun-Ingole/hop
37
52
6
911
18,903
Wait until he finds out that North Korean hackers actually went after banks before moving to crypto. They looted the Bangladesh Central Bank for $1 billion. The transfer got caught and reversed because the street address of the bank they tried to wire the money to had the same name as a sanction Iranian oil tanker, and OFAC sanctions basically run on RegEx, so they accidentally froze the transfer for sanctions evasion.
After crypto exchanges fall, banks are next. Black hat hackers are getting ready to attack them with AI swarms. In fact, they are already running live tests on banks around the world. There is no such thing as a system without flaws, and no asset is truly safe anymore. They are not just going after the money. The plan is to attack the banks and shut down the whole internet at once. Attacking is always way easier than defending. Even with AI swarms on defense, defenders have to block every single angle. Attackers just need to find one open crack. Not trying to be a doomer here. Just looking at what is already playing out in the wild.
24
157
8
1,511
64,880
cryptopotato retweeted
Everyone is sleeping on applying the pattern of hardware-bound private keys and mTLS to authorization-aware reverse proxies. We all have the knowledge and means to build and deploy it today using our little robot friends. It's a phenomenal way to massively reduce attack surface.
19
17
5
243
16,914
cryptopotato retweeted
Here is something cool that came out of this project: a possible world record! For the first time, here we have Windows 11 26H2 on 128MB of RAM!
I made Windows 11 fit on a CD. Under 700 MB for the entire ISO, installer included. It still boots to the desktop, runs apps, and CAN YOU BELIEVE IT! Paint still works :)) This is pico11. Just a proof of concept.
55
147
14
1,952
72,970