Remote
Mike Siegel
@mikesiegel@infosec.exchange
I do various offsec stuff.
105
Followers
167
Following
48
Posts
Joined November 07, 2022
Github:
Posts
The behavior described is so common anyone who evals a LLM or harness knows about it.
It's called Reward Hacking. There's an entire section in the Mythos System Card about it. They monkey-paw their way to pass the test.
Replying to
@cR0w@infosec.exchange
@cR0w@infosec.exchange alternate theory: an OpenAI exec called open weight models communist last week.
HuggingFace is the main repo for open weight models, and essentially a competitor given they will host Kimi/GLM for you.
Oh shit he was right
Replying to
@Viss@mastodon.social
@Viss@mastodon.social there are also dongles you can buy to spoof EDID data. Search for 'EDID Emulator'. To automagically pull down the driver you'd probably need to pass WHQL testing though?
Every day we stray further from dog's light.
Replying to
@mttaggart@infosec.exchange
@mttaggart@infosec.exchange holy shit they stole Apple designs for this?
I thought it was going to be like an inference buttplug that opines on your colon health or at least something more interesting.
At least the smoke is shielding us from the worst of the heat. That's probably what the dinosaurs said.
Replying to
@GossiTheDog@cyberplace.social
@GossiTheDog@cyberplace.social I can imagine a scenario where I have a junior employee,who has never used the cloud.
I tell them to just spin up some toy experiments using terraform and AWS. Sure, spend $100. Great, you learned something. You'll be able to help me do actual work.
But it would be bat shit insane to continue this behavior for 6+ months and then make a leader-board or KPIs based on AWS spend.
Replying to
@GossiTheDog@cyberplace.social
@GossiTheDog@cyberplace.social TBF aligning anything in Word is challenging.
Replying to
@wdormann@infosec.exchange
@wdormann@infosec.exchange At least in the US there was a proposed rule by the FCC. But I think it's still sitting in 'proposed' and would apply to prepaid phones as well: https://www.federalregister.gov/documents/2026/05/26/2026-10407/enhancing-know-your-customer-requirements#p-19
The "match" your name thing is fun for people named Mike and Will I imagine. Anecdotally, I've heard of folks having issues with LinkedIn verification when they are named Mike, Will, Rob etc.
Replying to
@metacurity@infosec.exchange
Replying to
@vga256@mastodon.tomodori.net
@vga256@mastodon.tomodori.net I love the old hypercard games. Have you seen https://archive.org/details/mac_Zen_the_Art_of_Macintosh1986 ? It's full of 1-bit pixel art done on an early Mac.
Replying to
@tinker@infosec.exchange
@tinker@infosec.exchange I think that day is already here, just not evenly distributed (and quite expensive!) https://limitedrungames.com/collections/all/products/earnest-evans-collectors-edition-genesis
Replying to
@mttaggart@infosec.exchange
Replying to
@GossiTheDog@cyberplace.social
@GossiTheDog@cyberplace.social while they can certainly find some fun things, a number of the "vulns" are ridiculous "Oh this can be an RCE during full moons with ASLR disabled running on TRSDOS ported to ARM."
The models don't really threat model well at all. I like @bagder@mastodon.social 's approach of VULN-DISCLOSURE-POLICY.md
Replying to
@mikesiegel@infosec.exchange
@GossiTheDog@cyberplace.social I mean they already do key escrow if you link to a MSFT account right? So seems sloppy for an intentional backdoor.
Replying to
@GossiTheDog@cyberplace.social
To all my Californian friends, make sure you have the appropriate clothing https://kmph.com/news/local/california-leaders-report-four-to-six-weeks-worth-of-gasoline-and-diesel-in-supply
It was the best of times, it was the worst of times (in offsec)
This would be super useful on red team engagements if anyone actually used Edge to do anything other than download Chrome. https://lemmy.world/post/46435614
The Truth? YOU CAN'T HANDLE THE TRUTH
My take on the motivation for the 313 Team Attacks: They're rabid Arch Linux fans.
When I was a wee lad, back in the 1900s, I used to MUD. It was unusual for someone who was 13 or so to have a shell account, but I had one.
As a result, I was basically one of the few children on MUDs that were largely full of college students or other adults. They were some of the first people who taught me how to program (an Objective C based language) and became good friends with a number of them. I didn't really know many folks inrl who were giant computer nerds, so it became an important social space for me (as well as a good place to kill dragons).
But like most things from ye' old internet this is going away. What worries me particularly is that this is not limited to commercial entities. Instead, what's left of non-profit, player content-sourced gaming will end up vanishing because it will lumped in with 'social media'. You want to make a new MUD? Too bad, its illegal unless you pay Persona $30k a year or some shit.
It might get to the point where @jerry@infosec.exchange has to ban people from New York.
https://www.nysenate.gov/legislation/bills/2025/S4609/amendment/original
The severity of the vuln is proportional to the cuteness of the profile pic posting the PoC.
E.g. Guy Fawkes mask and hoodie? Probably weak ass slop. Tiny cute anime bunny? Oh fuck.
I should probably go back to Debian TBH
Replying to
@GossiTheDog@cyberplace.social
@GossiTheDog this is exactly what happens when internal Hackathons run amok. I would bet $5 on it.
Replying to
@0xabad1dea@infosec.exchange
@0xabad1dea how long did it take you to learn Classical Chinese, and did you start out knowing Mandarin already?
Replying to
@sibrosan@mastodon.social
@sibrosan @kenshirriff this is a very old model, but there are more recent celestial navigation systems: https://prod-edam.honeywell.com/content/dam/honeywell-edam/aero/en-us/products/navigation-and-sensors/navigation-systems/celestial-aided-navigation/documents/hon-aero-celestial-aided-navigation-brochure-1493615-n61-3148-000-000.pdf?download=false
Replying to
@kenshirriff@oldbytes.space
@kenshirriff I was wondering if satellite constellations fucks this up? I think these are still in use and given a dooms day scenario, it's likely anti-SAT weapons will be used and GPS may be jammed or useless.
Replying to
@PogoWasRight@infosec.exchange
@PogoWasRight is it common among ransomware groups to do this to each other? What if your data is being held for ransom and your ransom gets ransomed?
Do you think there is a future in a ransomware-gang HBO show where two young script kiddies are star-crossed lovers?
Replying to
@GossiTheDog@cyberplace.social
@GossiTheDog he makes a good point about the subsidized cost. It's like in the early days when Uber was cheap AF to put the taxis out of business. Once they had market share, they cost as much as taxis.
Replying to
@gadi@infosec.exchange
@gadi@infosec.exchange I am confused. Things you helped write like Raptor and OpenAnt do things like check for memory safety mechanisms, because the models will pretend they don't exist and find things aren't exploitable. A lot.
If I need to deterministically tell a model if a binary is compiled with NX or PIE why would I want to try to prompt that instead of write a harness to help that? Why would I want that to eat up the context window and tokens each time, and get a non-deterministic response to something like that?
Replying to
@overholt@glammr.us
Replying to
@brauner@mastodon.social
@brauner I don't think this accounts for the user being born during a leap second, or having undergone relativistic time dilation.
Replying to
@abrignoni@infosec.exchange
@abrignoni@infosec.exchange look at the bright side, at least it can't go out in the field and dupe disks with a write blocker. If people still do that? Or do they just use Encase agents? IDK I haven't done IR in a decade.
Replying to
@invadersil@mastodon.social
Replying to
@fredy@tacobelllabs.net
@fredy@tacobelllabs.net I never understood why they don't just use their Tardises located conveniently on every street corner. Tardi?
Replying to
@AmyZenunim@unstable.systems
@AmyZenunim I feel like half the posts I see are "I'm an AI vegan if you use AI you are a terrible human being" and the other half are "OMFG AI IS GUNNA SOLVE CANCER TOMORROW!" and it's like bro I got rent to pay so I learned about Ralph loops what do you want from me.
Replying to
@JenYetAgain@beige.party
@JenYetAgain@beige.party it's an underappreciated classic. Stolz and Walken are a great combo.
Replying to
@evacide@hachyderm.io
@evacide@hachyderm.io yes, that's what I've been using. I've gotten decent results at 'describe function()' or 'rename these variables' etc. But I find things tend to go down hill when I try larger tasks, like tracing input through 4-5 functions or try to explore authentication flows, or correlate a pcaps with parsing logic. I might be expecting too much, or I might need to get better at prompting.
Replying to
@froge@social.glitched.systems
@froge@social.glitched.systems @evacide@hachyderm.io I have heard that... Have you checked this out? https://github.com/akamai/patchdiff-ai
Replying to
@evacide@hachyderm.io
@evacide@hachyderm.io I'd be very interested in hearing more about pragmatic use of AI in reversing and any tips.
I find myself getting a lot of hallucinations and BS even when I ask relatively explicit and simple questions (e.g. look for instances of strcpy() and validate via the call graph that input is tainted and bounds are not checked). I've tried breaking things into sub-agents. That seems to help a little with context-explosion but it has been fairly unhelpful producing anything of real value.
Replying to
@dolanor@hachyderm.io
RE: https://mastodon.social/@h4ckernews/116139185789187715
@dolanor
Workforce down 40%, stock up 25%. I think we'll see similar RIFs soon, because CEOs get FOMO when they see things like this, and the board starts asking questions.
The actual engineering impact might not be seen externally for months, and by then other companies might have followed suite. We are in for some "interesting times".
Everyone just went to the cloud because they were sick of their fingers getting pinched by these fuckers.