@asintsov

was born in '85, still alive...

Joined February 2010
  • Tweets4.3K
  • Following532
  • Followers3K
40Media
AI pushed new CVEs to 12x last year's pace. Breaches didn't move. Why? I modeled it as a forest fire: vulns are just lightning, most fires stay small, a few giants do the damage. AI decides how often lightning strikes. The forest decides how much burns. asintsov.com/notes/2026-10-0…

The Vulnpocalypse Is a Race

AI floods the world with vulnerabilities, yet breaches have not moved. A forest-fire model explains why and shows where the damage will land next.

asintsov.com
3
615
Alyosha Sintsov retweeted
b1ack0wl@b1ack0wl14 Oct 2024
"we would look at xrefs to strcpy() and write a highly reliable exploit by the end of the day"
3
66
3
491
31,329
Hey, we are looking for an Incident Response Engineer in Mexico! #job social.icims.com/viewjob/pt1…
1
2
253
How can we measure the Return on Security Investment (RoSI) of Bug Bounty programs? @ygoltsev and I have explored various numbers to find answers, and we'd like to share our ideas with you - linkedin.com/pulse/how-measu…! #ROI #bugbounty #metrics #okr

How to measure Bug Bounty? Playing with the Bug Bounty Efficiency Index (BBEI)

For many companies, launching bug bounty programs is one of the key components of application security. But a crucial question remains: how can we effectively measure the value and efficiency of...

linkedin.com
2
367
Is Ivanti 0days based on path traversal + command injection in backup endpoint?
1
681
Yes, I was right - attackerkb.com/topics/AdUh6b…

Rapid7 Analysis: CVE-2023-46805

An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.

rapid7.com
217
Alyosha Sintsov retweeted
Cristofaro Mune@pulsoid19 Sep 2023
Let me say that again... You store pointers at the _destination_ address of a memcpy. You glitch during memcpy (). You get that pointer into PC. No, it's not sci-fi. It's the "instruction corruption" fault model. And we pioneered that. See thread below 1/N.
Raelize@raelizecom5 Sep 2023
Replying to @raelizecom
This attack showed that the data at the destination of a copy can be abused just like the data at the source. We had to improve this attack quite a bit as it simply took too long to get a successful glitch. The details for this optimization will be explained during our training.
1
14
39
10,641
Alyosha Sintsov retweeted
Alex Matrosov
@matrosov4 Aug 2023
Application Security and Vulnerability Assessment getting a significant advantage from GenAI (context-driven knowledgebase). That helps security teams understand the root cause of the problem faster and significantly reduces the latency in producing security fixes at scale.
1
10
32
6,944
Alyosha Sintsov retweeted
Alex Matrosov
@matrosov21 Jun 2023
"... detected several remotely exploitable bugs in AMI MegaRAC BMC" "... whole attack sequence: from having zero knowledge about a remote AMI BMC with enabled IPMI (yeah, right) to flashing a persistent firmware implant to the server SPI flash" Looking forward to this talk!
Alex Tereshkin@AlexTereshkin21 Jun 2023
Check out the abstract of our upcoming DC talk :) CC: @Adam_pi3 forum.defcon.org/node/245714
13
1
29
10,854
Alyosha Sintsov retweeted
joernchen@joernchen6 Jun 2023
Our lovely Red Team at @gitlab is looking for a Senior Red Teamer boards.greenhouse.io/gitlab/…

GitLab

job-boards.greenhouse.io
1
31
4
169
38,925
Also found interesting, that ChatGPT works much better if you ask to use LangSec approach: translate logic into grammar, and input as a language and try to find a Weird Machine, works more efficient at my example than just "check the pseudocode/logic for security issues"
2
304
1
247
1
246
Think lately about weird machines, and found myself that jokes and humor is an example of such for human beings.
1
356
And on other side: "fraud/propaganda" is also a language for creating "weird machines"...
228
Alyosha Sintsov retweeted
offensivecon
@offensive_con19 May 2023
A Dark Side of UEFI: Cross-Silicon Exploitation by @matrosov and @flothrone now #OffensiveCon23
1
25
63
10,914
Alyosha Sintsov retweeted
offensivecon
@offensive_con13 Apr 2023
My dear humans and non-humans, I present to you the speakers for #OffensiveCon23 offensivecon.org/speakers/
2
36
10
116
58,146
Alyosha Sintsov retweeted
PT SWARM@ptswarm8 Sep 2022
📝New research by @lmpact_l: "Fork Bomb for Flutter" There are more and more Flutter applications, and security analysis of these apps is in high demand. Our member Phil shares his knowledge and presents his reFlutter tool. Read the article: swarm.ptsecurity.com/fork-bo…
6
27
2
76
Future of hacking... ha ha, It is really fun, thx!
1
3
1
6
Load more