Radek (@radekk) header
Radek (@radekk) profile picture

Product Security, occasional CTF player, web security training instructor in the past. Contact: radekk/@/vulnsec.com, https://teapawt.org/t.co/T8KgKL5NfS

Joined January 2008
Photo by Radek (@radekk)Photo by Radek (@radekk)Photo by Radek (@radekk)Photo by Radek (@radekk)Photo by Radek (@radekk)Photo by Radek (@radekk)Photo by Radek (@radekk)
Just released a new version of the repo supervisor tool with AWS Lambda support. Scan your pull requests for passwords and secrets - github.com/auth0/repo-superv…
Radek retweeted
they didn’t hack ledger. they didn’t exploit the code. they BOUGHT the company selling you the device. $86 million gone a company called CryptoBilis was an authorized ledger reseller in southeast asia. trusted. legit. sold ledgers for years a random chinese company quietly bought CryptoBilis from its malaysian owner made the original owner sign a confidentiality agreement. he couldn’t tell anyone the company was sold same brand name. same website. same “authorized reseller” badge. but different people behind it now the new owners started opening every ledger device before shipping soldered a tiny spy chip onto the board inside. repackaged it. sealed the box. shipped it the device looked normal. felt normal. worked normal but the spy chip was silently capturing your private keys the moment you set it up your seed phrase was sent to the attacker before you even finished writing it down hundreds of wallets across ethereum tron and bitcoin. all drained the guy who lost $5.3 million said “i did everything right. no leverage. no memecoins. i stored my funds on a hardware wallet like we’re all told to” he was right. he did everything right except his device had a parasite inside it that he couldn’t see ledger has now told CryptoBilis to stop all sales. told recent buyers NOT to set up their devices mark karpelès posted photos of the implant. normal board on top. spy chip below the most dangerous attack in crypto this year wasn’t a line of code it was a business acquisition
428
976
173
5,996
550,005
Radek retweeted
Credential leaks are the number one source of data breaches. To help keep your data secure, today we’re launching fine-grained personal access tokens. Minimum permissions equals minimum risk. github.blog/2022-10-18-intro…
2
74
23
209
S3 is designed to lose only 1 object per year for every 100B objects (which is really good!), but it means it now loses 2000 objects per year.
7
43
3
252
Our paper and code covering physical attacks on the Texas Instruments CC13xx and CC26xx SimpleLink microcontrollers is available! Paper: eprint.iacr.org/2022/328.pdf Repository: github.com/KULeuven-COSIC/Si… Security advisory: ti.com/lit/an/swra739/swra73… Some details in this🧵
11
150
6
496
The one-time pad is an encryption algorithm that is information-theoretically secure - it's secure even against adversaries with infinite computational power Invented in the 19th century, the OTP can be used with just pen & paper Learn more here: fermatslibrary.com/s/frank-m…
13
154
10
783
I've released NAT Slipstreaming, a spooky new technique that allows an attacker to remotely access any TCP/UDP service bound to a victim machine, bypassing the victim’s NAT/firewall, just by the victim visiting a website. samy.pl/slipstream/ Happy Halloween!
142
1,831
434
4,998
📢 My first @pluralsight course has been published! "JavaScript Security: Best Practices" will teach you how to find, fix, and prevent common #javascript #security issues. 📽️ buff.ly/2QkWh0u
5
45
4
96
One of the improvements for CVSS v3.1 by @FIRSTdotOrg was to introduce the extension framework: „The list of validated extensions will be listed on the first.org web site”. But there are no extensions nor any mentions of that so far. Is this already obsolete?
2
University of Cincinnati made their malware reverse engineering classes public: class.malware.re/ Includes lecture notes, videos and all the good stuff!
10
833
34
1,836
Hack The Real: An exploitation chain to break Safari browser #MacOSsecurity by @hanqing gts3.org/2019/Real-World-CTF…
74
155
Going live in 1h with more picoCTF 2019 solutions: youtube.com/watch?v=gEPd1ref… 🖥️⌨️🖱️→🚩🚩🚩
3
1
29
Verifying myself: I am radekk on Keybase.io. 3-p3aTVFNFTneTRDG80JhiuaumvPdj1NVjmf / keybase.io/radekk/sigs/3-p3a…
I’m really happy I could contribute to that. There is lot of great articles!
2
Radek retweeted
Find a security problem, issue a CVE, and fix the issue without ever leaving GitHub. All while making open source more secure.
3
75
15
261
Burp Suite Pro 2.1.05 released, with experimental support for using Burp's embedded Chromium browser to perform all navigation while scanning. This new approach will provide a robust basis for future capabilities. Feedback welcome if you want to play now. releases.portswigger.net/201…
13
133
5
431
I’ve got a message that my article was accepted to the Paged Out! #2 zine 🥳 I can’t wait to see it published! @pagedout_zine
2
Have you ever imagine that @facebook is crawling links in your pdf files when you are sending them via messenger?
41
879
160
1,724