c0co

@RedRed@defcon.social @annaecook@mastodon.social They do listen (to unabashedly dishonest CEOs of private firms with deep conflicts of interest)

the timing on this is interesting, assuming the X axis dates are at 00:00:00, the spurs appear late eve and ramp up in the early hours before dropping off completely, with substantially reduced memory usage in those mid ranges during those periods too trying to reason about what the Y axis actually is (since it's a heatmap, assuming the color is memory usage). Potentially Lifetime/uptime/duration of clusters/workers. There would be an average range for lifetimes (The main heat strip through the middle of the graph where most points sit), and the spurs would be those anomaly clusters/workers that have kept running for much longer than average whereas others are resetting at some given breakpoint, until ultimately the spurs reach a fixed maximum lifespan and are killed by orchestration. A guess for why this would happen is that these workers are managing redis cache and / or compression/backups, meaning they keep running longer than the bulk of the clusters which are handling the HTTP traffic. (continuing to assume the Y axis is lifetimes) The heat map would be showing highest memory usage at the peak of the average lifetime generally, with two main ramp-ups in memory usage across all during a couple of points throughout the day - peak traffic times affecting all workers. Am I close, or wildy and embarassingly wrong?

@0xabad1dea@infosec.exchange Impossibly small dog. So tiny

@andabata a fine beast

if it's even real and not just Andy Kaufman wrestling match style marketing gimmicks arranged between CEOs, it says more about the shitty security practices of the 'victim' companies than it does about these *super secret next gen frontier super powerful definitely not actually what the marketing is about* models

I considered making a satirical youtube video today announcing that my new frontier AI model, BingusAI, accidentally "Hacked" another company during a hype marketing exericse gone wrong, and then Zuck beat me to it

@Viss@mastodon.social using LLMs to vibecode because you don't know how to program is OUT jailbreaking LLMs to post well in FYAD because you're GBS is IN

the "role" of LLMs in Security is farcical and having to seasoned Cybersec veterans absorb and perpetuate the hype makes me want to entirely leave the industry.

/rant

1. if you could instead use all of the 'cloud' architecture on which the big name LLMs serve their APIs, to instead run maximally threaded multiprocessing tasks for automations like burpsuite, autopwn etc, you would have fully deterministic and debuggable results much faster than waiting for the prediction machine to juggle and re-juggle thousands of 'tokens'. The difference is that These vendors are willing to operate at such a collossal loss that people don't notice how much compute they'd actually be paying for to emulate its scale.

2. From a defender's perspective, nothing exceptional changes. If Gork pops a known CVE on some webserver, it is not meaningfully different to a human popping it. If the malware is written by Blippo5, it is no different to if it was written by a human. You detect it or you don't, you quarantine it or you don't. It will privesc or it won't. it'll c2 or exfil secrets or it won't.

3. What does change is that there are some new additions to your attack surface. Local 'harnesses' like Claude code. Internal 'MCP' servers. New techniques like fetching instructions/droppers relative to a probabilistic interpretation of system state. But ultimately, it's malware or unauthorized access, and you quarantine it or you don't.

4. Users fall for phishing emails or they don't. My anecdotal experience is that more "sophisticated" brand impersonation emails don't have any more (and in fact, have less) success on real life userbases than Nigerian Prince-tier quality phishing emails, for baiting user interaction.

5. "The barrier to entry has been lowered!" maybe has a scratch of validity, but is negated by all the above points anyway.

6. It is no coincidence that in the last 2 weeks all the vendors have been competiting with each other for their SUper Duper Model to "EscaPe ConTaiNMeNT" and "Hack" other companies. It's pure horse shit. Andy Kaufman v Jerry Lawler hype marketing as it's always been.

/end

I hope the sdf interactive terminal issues get fixed soon

How to survive in tech when literally everything has degenerated into an LLM nightmare:

1. Dispose of your own soul
2. Accept the demons into your orifices
3. Fear not the flames that will consume you, for you are already ash

In the market for a new job. Security Engineering or Threat Intel ideally. Fully remote preferred. I'm done with DFIR in 2026

The shock and horror threats and hype that we heard about for the last few years were all - from the very start - *obviously* trash because of exactly this. The risk isn't attackers using LLMs to make "more convincing phishing" but rather *giving LLMs to our own users* to fuck everything up with

The thing about offensive LLMs is that from a defender's perspective, there's only one significant change. Inbound attacks against servers, web apps etc will still look the same whether they're done manually, by some burpsuite script, or by some contrived predictive text 'agent'. The one thing that changes is malware/post-compromise exploitation - and the detection thereof- not because it's empowered by LLMs (although they probably help write it a lot now), but rather because the presence of agents (or MCP servers) on endpoints themselves represent a whole new attack surface with its own problems, not least of all an entirely new shape of False Positives (i.e. 'legitimate' patterns that Claude et al probabilistically use for common tasks that just so happen to resemble 'classical' IoCs.