Compliance using NIST controls #MTC
U.S.A.
Joined July 2009
- Tweets34K
- Following3.5K
- Followers1.9K
- Likes50.7K
Pinned Tweet
I’m on @buymeacoffee. If you like my work, you can buy me a coffee and share your thoughts 🎉☕ buymeacoffee.com/DipPd86sJc
mininatechsec retweeted
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.
In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
mininatechsec retweeted
We are now allocating a significant amount of our frontier compute towards discovering and patching vulnerabilities in open source codebases, fully pro bono.
In one case, we studied the Linux kernel, which is a particularly load-bearing piece of software at OpenAI.
Before AI, security researchers might discover ~20 local privilege escalation (LPE) vulnerabilities in Linux in a typical year.
In one week's time, our upcoming frontier cyber model was able to find ~1000 LPE vulnerabilities using about $1M of tokens. In the process, it was able to discover at least 10 novel classes of Linux exploitation techniques.
Our security researchers built an autonomous cyber vulnerability discovery, exploitation, and patching pipeline.
In a single run with an upcoming cyber model, it validated and generated patches for 948 local privilege escalation vulnerabilities in the Linux kernel at a total API cost of $1.2 million.
Yep, I concur.
Communicate in a language everyone at the organization understands.
Too many geeky words/phrases or flowery corporate speak will drown out the real message, every single time.
Corporate Communications has banned IT from using the word "outage."
Apparently it creates unnecessary anxiety.
We're now required to describe technical incidents using "solution-oriented language."
Yesterday our payroll system went down.
I drafted:
"PAYROLL SYSTEM UNAVAILABLE. DO NOT SUBMIT TIMESHEETS."
Communications rejected it.
They published:
"We're currently enhancing your compensation experience."
Within 20 minutes, HR received 40 emails asking if everyone was getting a raise.
The system was still down.
I drafted another update.
"PAYROLL PROCESSING DELAYED. PAYMENTS MAY BE LATE."
Rejected again.
They changed it to:
"Your compensation journey is experiencing a brief moment of flexibility."
The CFO called me.
"Are people getting paid Friday or not?"
I told him we couldn't say.
He asked why.
I explained that Communications hadn't approved a sufficiently positive way to describe 800 people not receiving their salaries.
He told me to send the actual status.
So I did.
"Payroll is broken. We're fixing it. Stop submitting timesheets."
Everyone understood immediately.
Communications reported me for violating our brand voice guidelines.
They've scheduled a two-hour workshop on communicating technical problems with empathy.
The payroll system was fixed in 47 minutes.
The workshop is mandatory.
We're now spending more time recovering from the announcement than the outage.
[Post 12 of x] Hacker Credo, Level 1
Level 1 No search engines for you
What-if Scenario #1
You need to learn what to do when a system breaks, fails, stops functioning, etc. It's a technical issue that you've never seen before and it's not documented anywhere.
[Post 11 of x] Hacker Credo by MININA
(I'm MININA, hacker handle mininatechsec)
KNOW YOUR SHIT OR SHUT THE FUCK UP
Level 0 Go to the casino, using public transportation
Orienteering, learning how to get about town
[Post 10 of x] Security Professional or #infosecpro
I'm a security professional.
All security professionals are hackers.
Not all hackers are security professionals.
[Post 9 of x] Documentation.
We hired at least one outside company to help us and they couldn't figure it out.
Because the configuration was documented on a white legal pad, I was able to re-configure the unit and get it working again.
[Post 8 of x] Production environments only
My career started by working on production environments only, 24x7x365. There were no test or quality assurance environments.
There was a brownout that erased the configuration on the Adtran unit.
[Post 7 of x] No, you are not a hacker.
Just because you downloaded a hacking tool, you figured out how to run it and got results, you think you're a bad ass, right? Nope. Anyone can do that, nowadays, it's easy to do.
Go ahead, click on that button.
#socialengineering
[post 6 of x] Consequences.
I'm not a police officer.
Some police departments have units that investigate policy violations, such as unauthorized access. Consequences - fines and/or jail; reputation of officer; loss of income; reputation of jurisdiction, etc.
[Post 5 of x] Everyone breaks the law, even cops.
I've been reading about law enforcement accessing Flock camera data without permission and/or as part of an active investigation. It's easy to conduct a search. Just press the button.
[Post 4 of x] Everything is logged
Everything that Joe Schmoe does on mobile phones, smart watches, laptops, etc. is logged, either locally on the device or somewhere else, i.e. in the cloud.
[Post 3 of x] Hackers don't read the legal notices.
No, they don't. For example, when you, a regular Joe Schmoe, goes to the public cafe, there's a link to read the legal notice. Do you read it? Nope. It tells you what you can do and not do when you use the Internet at the cafe.
[Post 2 of x] Let's talk legal.
I'm not an attorney.
In the previous X post, I just admitted to hacking, kind of, sort of, not really. Can what I post on X be used against me? Yes. Anything posted on public media can be used as evidence.
[Post 1 of x] I did it.
I'm the sophisticated hacker.
Yes, oh, yes, blame me.
I wear $10,000 worth of jewelry when I hack. And because I'm Latina, I also wear hoop earrings.
#sophisticatedhacker
#infosec
#humor
mininatechsec retweeted
Every day I’m given a new hilarious pitch for my company.
Embroidery: Monitor your agents so one of your developers doesn’t use AI to commit crime and try to hack a competitor.
Ah yup. That was indeed me. No mallace intended. I've been running some agents to do signups + agentic testing on similar platforms. Just halted the harness I was designing around this as it was definitely going off the rails and reaching too far
Readers added context they thought people might want to know
In many jurisdictions this is a crime. In the US under Computer Fraud and Abuse Act, 18 U.S.C. §1030, in the UK under Computer Misuse Act (CMA) 1990, in Germany Strafgesetzbuch (StGB), and many others.
justice.gov/jm/jm-9-48000-…
legislation.gov.uk/ukpga/1990/18/…
gesetze-im-internet.de/stgb/
mininatechsec retweeted
If you’re thinking about breaking into tech but you have imposter syndrome, just know this is where the bar currently is
Bro, you can't fucking say openly on social media you just attempted to compromise an organizations infrastructure under your employer and full legal name
Are you actually fucking insane?? Genuinely what the fuck are you thinking???
And how the fuck does this dude know the employees name? Why did the employee openly admit "hehe ye thats me, but no mallace intended, it was my AI agent"
????? WHAT. THATS STILL A CRIME. WHAT ARE YOU TALKING ABOUT.
