Luke Young (@TheBoredEng) profile picture

Luke Young

@TheBoredEng

I find bugs and exploit them. Sometimes for money, mainly for free T-Shirts.

 San Francisco, CA
bored.engineer
Joined May 2010
  • Tweets335
  • Following444
  • Followers2.2K
37Media
Photo by Luke Young (@TheBoredEng)Photo by Luke Young (@TheBoredEng)Photo by Luke Young (@TheBoredEng)Photo by Luke Young (@TheBoredEng)Photo by Luke Young (@TheBoredEng)Photo by Luke Young (@TheBoredEng)Photo by Luke Young (@TheBoredEng)Photo by Luke Young (@TheBoredEng)Photo by Luke Young (@TheBoredEng)
In light of the recent supply chain attacks, I took a stab at building Canarytokens (aka Honeytokens) for GitHub.com that trigger an alert when a attacker abuses them. Follow along as it devolves into a rant about SaaS audit logs: blog.bored.engineer/github-c…
Image from Luke Young (@TheBoredEng)
1
165
@ThinkstCanary @haroonmeer github.com/thinkst/canarytok… 👀
Feature Request: Add support for GitHub Canarytokens · thinkst canarytokens · Discussion #928

Feature Request: Add support for GitHub Canarytokens · thinkst canarytokens · Discussion #928

I took at stab at implementing GitHub Canarytokens from scratch, I would love to figure out a way to integrate with canarytokens.org based on my learnings, adding support for GitHub PATs and/or Dep...

github.com
1
145
We're excited about @confluentinc Principal Security Engineer Luke Young's session at Assemble: Confluent's Journey to Distroless: Pitfalls and Lessons Learned. 📖 Happening on March 25 at Convene in San Francisco, this session will give practical on the ground advice for companies starting their own distroless migration, and how to make it a success for both security and developer teams. 🤝🙌 🎟️ See more sessions and save your spot today 🎟️ assemble.chainguard.dev/even…
Image from Chainguard ⛓️ (@chainguard_dev)
2
7
622
Looks like DEF CON talks are up on YouTube! If you want to see a fun talk on crawling online markets for the spicy silicon, check mine out here: youtu.be/QgeEHdAmJDg
12
55
8,000
New blog: We (@itscachemoney and I) abused the central function in various email security gateways: unfurl and analyze URLs to access internal SaaS services of various companies including Netflix. Check the blog to learn more. #phishing #emailsecurity ophionsecurity.com/blog/phis…
4
48
2
136
18,381
My lead investor just texted me this about SVB.
Image from Roshan Patel (@roshanpateI)
508
2,134
584
23,132
6,440,021
Luke Young retweeted
Andy (@ZephrFish) profile picture
Andy
@ZephrFish3 Sep 2020
Security is like an onion, the more layers you reveal, the more you cry
35
594
36
2,163
Luke Young retweeted
thomas🌦 (@zemnmez) profile picture
thomas🌦@zemnmez1 Dec 2022
Google published an official disclosure / writeup for the VSCode OSS RCE! github.com/google/security-r…
Visual Studio Code: Remote Code Execution

Visual Studio Code: Remote Code Execution

### Summary An attacker could, through a link or website, take over the computer of a Visual Studio Code user and any computers they were connected to via the [Visual Studio Code Remote Developmen...

github.com
3
2
1
17
Shopify disclosed a bug submitted by @TheBoredEng: hackerone.com/reports/108116… - Bounty: $1,600 #hackerone #bugbounty
Image from publiclyDisclosed (@disclosedh1)
3
1
26
I'm kicking off a series of blog posts about interesting vulnerabilities I've found and responsibly disclosed over the years, starting with a complex chain of vulnerabilities leading to XSS on accounts.leagueoflegends.com back in 2016: medium.com/@bored.engineer/x…
2
86
296
Welp, I literally re-implemented this vulnerability ~2.5 years ago when I was reversing Azure RM/IRM. Even worse, I wrote a comment about it at the time and didn't connect the dots on impact: github.com/bored-engineer/rm…
Image from Luke Young (@TheBoredEng)
This Post is from an account that no longer exists. Learn more
1
1
Tired: Responding to CPPA right to know requests Wired: Turning around and using the contact information from CPPA requests for sales leads
Image from Luke Young (@TheBoredEng)
Image from Luke Young (@TheBoredEng)
Image from Luke Young (@TheBoredEng)
1
4
Luke Young retweeted
shubs (@infosec_au) profile picture
shubs
@infosec_au8 Apr 2022
Bypassing CDN WAF’s with Alternate Domain Routing blog.ryanjarv.sh/2022/03/16/…
11
108
4
315
What an excellent little bug this is. Wow, this is a fun bug. Look at it! seclists.org/oss-sec/2022/q1…
5
21
8
89
Good news: Log4j is the only library you use that’s been trivially vulnerable for about a decade.
37
109
31
783
Replying to @_saagarjha
Before posting this publically, I privately disclosed this to the NSA by whispering it to my powered-off smartphone
6
104
13
754
I've begun a list of security mistakes made by Cloud Service Providers (AWS, GCP, Azure). Includes CVEs, SOC 2 Type 2 failures, security researchers compromising managed services, and more. github.com/SummitRoute/csp_s…
GitHub - SummitRoute/csp_security_mistakes: This repo has been replaced by https://www.cloudvulnd...

GitHub - SummitRoute/csp_security_mistakes: This repo has been replaced by https://www.cloudvulnd...

This repo has been replaced by https://www.cloudvulndb.org - SummitRoute/csp_security_mistakes

github.com
13
280
18
864
A many-splendored infrasec disaster. Count all the ways DNSSEC sabotaged this infra team.
This quoted post is unavailable.
Try viewing anyway · View on X
5
30
2
76
This is a great thread, and is why I always recommend caution when someone starts with “we will just fork [chromium|electron|..] (via @nasko)
This quoted post is unavailable.
Try viewing anyway · View on X
1
2
The biggest difference between REST and GraphQL is that when you build GraphQL API nobody tells you "well, actually this is not GraphQL".
30
234
19
2,238
Load more