ex-twitterSRE "I have approximate knowledge of many things"
Joined July 2009
- Tweets6K
- Following4.7K
- Followers2.1K
- Likes217K
Billy Becker retweeted
People are going to lose their mind when they realize its actually easier to hack things using FEATURES not CVEs.
Billy Becker retweeted
Imagine me telling you last year that GoAhead and eMudhra were using the same private key, with no further information. All sorts of scenarios might spin in your head, but never in a million years would you guess the real one.
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Billy Becker retweeted
+ "you know what i'd really like?"
- "tell me"
+ "a website"
- "...we can do a website"
+ "a real website, not some claude generated neon slop, a real website"
- "i'll make you a very good traditional handmade website, one that is built with dozens of snippets from stackoverflow"
Billy Becker retweeted
We are launching a PHP Capture the Flag challenge integrated with our Bug Bounty program to test our WAF protections. Security researchers are invited to bypass our defenses and capture the flag to help make the Internet safer. cfl.re/4iqHaQ1
Billy Becker retweeted
No fucking way
ITS 4 AGAIN
DIFFERENT BUG
Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing...
The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer.
- TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely.
- LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap.
- OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for.
These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure.
foxio.io/blog/choose-your-ba…
Billy Becker retweeted
I found a new RCE bug in PHP, missed by previous auditing teams. It’s unpatched in PHP v8.5.12
Billy Becker retweeted
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
Billy Becker retweeted
The general public should be made to play XCOM until they understand.
This is like the "if you hadn't had breakfast this morning" test.
Remember when Nate Silver predicted Hillary Clinton beating Trump in the 2016 election at 71% confidence--then everyone rubbished him, because Trump won?
Then, of course, someone looked at all his ~70% predictions and found that they were right about 70% of the time, i.e. 70% the predictions were rather well calibrated.
Billy Becker retweeted
A very clear eyed picture of what’s coming. You will need a software factory for defense, not just internal productivity.
Just spent the last 7 days on the front lines of the vulnpocalypse fending off an active cyber attack on one of our products.
Some thoughts:
- Software factories are going to be required equipment for everyone. There’s just no way to keep up with the pace of highly automated adversaries without one.
- We were lucky because we had spent the last few months getting our software factory running well. It is nice to have for product development but proved to be absolutely essential this week.
- At the minimum you need to have a coding server in the cloud pre-provisioned with read only access to all your logs and all the services you depend on for observability. With that in place you are a prompt away from reasonably good situational awareness, ongoing monitoring with loops, and ability for coding agents to validate fixes against your actual, observed attack patterns.
- Shared coding server also unlocks multiplayer incident response where everyone can see every session and jump in as needed. Sharing session links that can be forked is much higher bandwidth than re-explaining things.
- You don’t need to be Ramp/Stripe/Uber scale to have a working software factory in the cloud. We are a team of 3. Ours is built with an @opencode server (thanks @thdxr!), a forked version of compound engineering optimized for automated workflows (thanks @kieranklaassen!) and a multiplayer agent in slack that handles crons (we have our own harness but pick your favorite here).
- To get our software factory up and running well, we had to stop all new product development for ~6 weeks and just focus on getting the validation systems working that enabled us to reliably shipping PR without human code review. This felt very painful in the moment but was totally worth the eventual speedup in velocity.
- KYC for @AnthropicAI & @OpenAI cyber programs is now easy and quick (at least for defensive access), but a day felt like a lifetime this week. Submit your app now before you really need it.
- Getting Mythos access unlocked a deeper level of analysis that helped us shift from reactive mitigation to proactive patching. Wish we had done this a few weeks earlier. Get started now!
Billy Becker retweeted
It is never okay to circumvent proper established coordination efforts for security disclosures.
It causes harm for others, and while it does give the person some short term gratification, it burns more bridges than it will ever open.
Billy Becker retweeted
For those wondering: it's a classic "proof of discovery". You hash the write-up of an undisclosed bug, post the hash and reveal the text after the fix. Anyone can then verify you had it first.
After the past week… k8s admins, get some rest and hydrate while can 👀
Good morning
045fa83b7c7a42dba1acb2c19794c1bf1091c448eb9c483503e8f8e110fcec42
github.com/kubernetes/kubern…
Billy Becker retweeted
Star Wars Mandalorian, Luke Skywalkers entrance but with the Force Theme 🔥🔥🔥🔥🔥
Billy Becker retweeted
No one in the history of media knew the interior workings of a young boy’s brain better than Bill Watterson
