CTO and cofounder @proferosec | tired father by night | Board Member | Software/Cryptography/Architecture | @BSidesTLV Co-Organizer and @BSidesTLV_CTF lead
Israel
Joined April 2010
- Tweets7.5K
- Following1.2K
- Followers1.2K
- Likes7K
Pinned Tweet
With everything happening in the last couple of weeks, I will take a few weeks off twitter.
I hope Twitter will be here when I'm back, but I hope so.
Some steps I took in the interim:
1. archived my data
2. copied my network to mastodon pruvisto.org/debirdify/
The Switch 2 "make no mistakes" prompt was a caption. What worked was a loop: for ~2 weeks Codex crashed, rebooted and read the screen, and a human decided where it should dig next.
Agents investigate. Responders decide.
The human's half: deciding where the agent digs. While the Codex instances chased the audio and ldn sysmodules, the author went after fs, because it serves decrypted code. Then, rather than fight CFI, PAC and XOM, the author chose a logic bug: the loader trusts fs's signature check, so swapping the filesystem behind it gives code execution. Each decision set up the next round of agent work, like dumping sysmodule code so Codex could analyze it offline.
It's the line we use at Profero for incident response: agents investigate, responders decide. The edge isn't the model. It's the loop, with a human inside it choosing where the agent points next.
Guy Barnhart-Magen @[email protected] retweeted
Sometimes, it can be the Iranians, the Russians, or the North Koreans...and sometimes...it can be your own Security Manager.
#TheProferoBreachFiles
Come say hi after the talk!
our next breach won't have an attacker.
Today at @BSidesLV: @barnhartguy on AI-induced destruction. Prod wiped by an AI assistant with --dangerously-skip-permissions told to "clean things up." Real incidents, live triage.
Skytalks, 11:00, Tuscany. No recording.
Guy Barnhart-Magen @[email protected] retweeted
our next breach won't have an attacker.
Today at @BSidesLV: @barnhartguy on AI-induced destruction. Prod wiped by an AI assistant with --dangerously-skip-permissions told to "clean things up." Real incidents, live triage.
Skytalks, 11:00, Tuscany. No recording.
Guy Barnhart-Magen @[email protected] retweeted
We just realized we're sitting on two conference tickets we're not using ourselves.
One for Black Hat (Business Pass) one for BSides LV.
Comment which one you want. First 15 comments go into a draw, one winner per ticket. Closing Friday , July 31 at 4:00pm EDT. Winners tagged right after.
#BHUSA #BSidesLV #HackerSummerCamp #CISO #InfoSec
this was not really what we expected, we had to dig in to understand why this is happening
We added a detection rule for --allow-dangerously-skip-permissions in Claude Desktop. Then we found an attack chain nobody was talking about.
"No shell, no impact" is the wrong mental model for AI agents.
An agent running with that flag, even with Bash blocked, can still:
• Read SSH private keys, .env files, AWS credentials, and browser session databases
• Write to ~/.zshrc, .git/hooks/pre-commit, ~/.ssh/authorized_keys, or source files in your repo
Execution is deferred. The next terminal you open, the next commit you push, the next CI run, runs the payload.
It gets worse. Skills load as trusted context with no signatures, no checksums, and no version pinning. Inject once, persist in ~/.claude/skills/, and wait. The user invokes the skill days later in a fresh session, and the payload runs with full trust. No anomalous process, network, or permission signal to catch it.
What defenders should do today:
• Monitor ~/.claude/skills/ for unexpected modifications
• Vet every MCP tool and skill before installation
• Audit shell configs and git hooks after any agent session
• Stop treating --allow-dangerously-skip-permissions as safe just because Bash is off
Full breakdown by @barnhartguy :
profero.io/blog/hiddenperms/
#AISecurity #IncidentResponse #ThreatIntelligence #ClaudeCode #RapidIR
Guy Barnhart-Magen @[email protected] retweeted
We added a detection rule for --allow-dangerously-skip-permissions in Claude Desktop. Then we found an attack chain nobody was talking about.
"No shell, no impact" is the wrong mental model for AI agents.
An agent running with that flag, even with Bash blocked, can still:
• Read SSH private keys, .env files, AWS credentials, and browser session databases
• Write to ~/.zshrc, .git/hooks/pre-commit, ~/.ssh/authorized_keys, or source files in your repo
Execution is deferred. The next terminal you open, the next commit you push, the next CI run, runs the payload.
It gets worse. Skills load as trusted context with no signatures, no checksums, and no version pinning. Inject once, persist in ~/.claude/skills/, and wait. The user invokes the skill days later in a fresh session, and the payload runs with full trust. No anomalous process, network, or permission signal to catch it.
What defenders should do today:
• Monitor ~/.claude/skills/ for unexpected modifications
• Vet every MCP tool and skill before installation
• Audit shell configs and git hooks after any agent session
• Stop treating --allow-dangerously-skip-permissions as safe just because Bash is off
Full breakdown by @barnhartguy :
profero.io/blog/hiddenperms/
#AISecurity #IncidentResponse #ThreatIntelligence #ClaudeCode #RapidIR
Guy Barnhart-Magen @[email protected] retweeted
Profero IRT pulled apart "WindowsAudit.exe", a 101MB .NET RAT running as LocalSystem that uses a Discord guild as its primary C2.
Two channels inside one guild: one for tasking, one for results. Operators issue slash commands to target agents by hostname, Machine GUID, or broadcast to all. MQTT and Telegram sit as fallbacks.
Inside the kit: LSASS dumps, DPAPI browser theft, full AD takeover toolkit, Hell's Gate syscalls, AMSI/ETW patches, EDR kill for 15+ vendors, WireGuard relay for pivoting.
This isn't a script-kiddie RAT. Looks like a ransomware crew warming up.
Guy Barnhart-Magen @[email protected] retweeted
We don't know exactly how Handala got into Kash Patel's accounts-and we're not going to speculate.
But after years tracking MOIS-linked intrusions, the answer is usually far less "zero-day" and far more credential dumps, stealer logs, and old breach data.
Read the full breakdown on the blog: profero.io/blog/the-key-was-…
We should be very critical of information presented to us, in these times even more so
Guy Barnhart-Magen @[email protected] retweeted
Congratulations to the Llama Drama Robotics Team on taking first place and earning a spot in the national competition! Profero is excited and proud to sponsor you and celebrate this amazing achievement.
Great blog post by Ron Benisty - interesting usage of C&C
Delve into the inner workings of a Vietnamese threat actor's latest info stealer, using Telegram as its control hub. Find out how they taunt security researchers like Morphisec, while stealing credentials and cryptocurrency wallets.
Full story: profero.io/blog/dit-me-may-m…
Guy Barnhart-Magen @[email protected] retweeted
אלה החמש דקות הכי חשובות בהן תצפו, בתקווה שגם תפיצו, בשבוע הזה. איך ישראל הצילה את קטאר, איך נתניהו הרים את קטאר מהקרשים מול המצור שהוטל עליה, ואיך ישראל בנתה עם קטאר את מפלצת חמאס. רק עובדות. בין יוני 2017 לאוקטובר 2023. שבע השנים המתועבות. חובה.
יאללה תקווה >> bit.ly/YallaTikva
Guy Barnhart-Magen @[email protected] retweeted
ירושלים היא בריתנו הנצחית.
העיר הרצליה מחויבת ללימוד ירושלים על כל רבדיה - היסטוריים, דתיים, לאומיים ואזרחיים, אך לא דרך גוף שמקדם אג’נדה פוליטית אחת.
עמותת אלע״ד פועלת לקידום נרטיב פוליטי ימני קיצוני מובהק וגם ספגה לאורך השנים ביקורת ממשרד החינוך וממבקר המדינה על ערבוב פעילות חינוכית עם מסרים פוליטיים קיצוניים.
לכן, הוחלט שהטיול יתקיים כמתוכנן, אך בהובלת מדריכים מקצועיים וחברה שאינה מזוהה פוליטית, כדי להבטיח חוויה לימודית מאוזנת ומכבדת.
כמובן שאין להחלטה הזו שום קשר למחלוקת שאינה קיימת על מעמדה הדתי, הרוחני והלאומי של ירושלים, על ציונות או על אהבת הארץ.
אלא אך ורק על השאלה מי נכון שיוביל פעילות חינוכית מטעם מערכת החינוך הציבורית.
אנחנו לא זקוקים להטפת מוסר מאף אחד על ציונות או על אהבת ירושלים.
האהבה הזו טבועה בזהות שלנו והיא בדיוק מה שמחייב אותנו לשמור על חינוך נקי מהשפעות פוליטיות.
Guy Barnhart-Magen @[email protected] retweeted
In Washington D.C., Muslims lower the flag of freedom and raise one of oppression.
Why don't the media cover this?
Guy Barnhart-Magen @[email protected] retweeted
