Chrome Security gnome. I work on the sandbox and local data protection on Windows. @parityzero.99 on signal. Opinions here are my own!
Joined June 2011
- Tweets2.5K
- Following802
- Followers3.9K
- Likes2.7K
Will Harris retweeted
@googlechrome is officially moving to a two-week release cycle starting today with Chrome 153, letting us deliver features and performance improvements faster than ever.
Cutting our release window in half also shrinks the "N-day" patch gap to an absolute minimum. This helps keep everyone protected against evolving threats as automated AI discovery tools generate higher patch volume. More on that here: goo.gle/4r2mmSK
Will Harris retweeted
Our Black Hat talk on the OpenAI-Hugging Face incident is now live on youtube.
This is a watershed moment for the industry. I encourage all defenders to watch, consider how attack dynamics will imminently change, and plan for accelerating defense.
youtube.com/watch?v=87DyyMV0…
Will Harris retweeted
pwn2own has always been a great datapoint for how hard it is to find vulns, what exploit mitigations are working, new exploitation techniques, and now how AI works on offensive security.
this year's pwn2own isn't just interesting because there will be lots of entries with AI+human.
it is also interesting because
a) anthropic burned a ton of tokens on firefox, basically running claude in a loop until it found something for a month, probably exhausting whatever claude can one shot.
b) if someone submits full chain without much use of ai, it tells you one shotting plateaus and these models are bit like fuzzers than seasoned security reseachers.
c) even if they used an llm to find the bug, this tells us scaffolding/harnesss design, prompting, and the operator matters a lot.
Will Harris retweeted
This young man Manchester Madgwick seems to know everything. What a mind. Bravo 👏🏻
#UniversityChallenge
Will Harris retweeted
Great advice from @AnthropicAI on prep for accelerated AI vulnerability discovery, including what to do if you don’t have a dedicated security team, if you’re reporting bugs you found, or are an open source maintainer.
/ht @_decius_ for sending the link
claude.com/blog/preparing-yo…
Will Harris retweeted
The window between vulnerability disclosure and real-world exploitation keeps shrinking.
The Zero Day Clock visualizes how fast attackers are operationalizing new CVEs. What used to take months now often happens in days, or hours.
The future needs to be Secure by Design.
zerodayclock.com
#AppSec #CyberSecurity
Will Harris retweeted
Someone finally made a proper video on the xz backdoor. It’s missing a lot of the story, that I hope gets told someday, but still worth a watch.
Will Harris retweeted
We launched a redesigned Project Zero website today at projectzero.google !
To mark the occasion, we released some older posts that never quite made it out of drafts.
Enjoy!
Will Harris retweeted
🔺iPhone models announced today include Memory Integrity Enforcement, the culmination of an unprecedented design and engineering effort that we believe represents the most significant upgrade to memory safety in the history of consumer operating systems. security.apple.com/blog/memo…
Will Harris retweeted
Hey @espn can you please get a sound engineer on the case in Minnesota? The choppy audio is making the #VegasBorn vs. #mnwild game incredibly brutal to watch. #StanleyCupPlayoffs @NHL
Will Harris retweeted
Chrome 136 now has enhanced cookie security 🍪 → goo.gle/3DMf5SS
Changes to remote debugging switches protect your data. Find out how the --remote-debugging-port and --remote-debugging-pipe switches are now being handled.
ALT Changes to remote debugging switches to improve security
Will Harris retweeted
Two stories published Friday reporting that Trump admin had ordered US Cyber Command and CISA to "stand down" on their work to detect/counter Russian cyber threats. But new info has come out to contradict them. I dug into what we know and don't know. zetter-zeroday.com/did-trump…
Will Harris retweeted
Microsoft's Threat-Intelligence ETW provider now supports events to identify token impersonation attacks. I wrote a blog on these events and how Microsoft is surfacing them:
jsecurity101.medium.com/behi…
Will Harris retweeted
Celebrating 15 years of password hacking 💻 🔑, Swiss Army knives (and sometimes even chainsaws or swords) included! 😲
Discover how Google's security teams turn employee farewells into security tests.
bughunters.google.com/blog/6…
Will Harris retweeted
📣SPEAKER ANNOUNCEMENT📣
We’re excited to announce James Forshaw (@tiraniddo), Security Researcher, Google Project Zero, will be presenting a talk titled “DCOM Research for Everyone!”
James has been involved with computer hardware and software security for over 10 years looking at a range of different platforms and applications. With a great interest in logical vulnerabilities he’s been listed as the #1 researcher for MSRC, as well as being a Pwn2Own and Microsoft Mitigation Bypass bounty winner. He has spoken at a number of security conferences including Black Hat USA, CanSecWest, Bluehat, HITB, and Infiltrate. James is also the author of two security books “Windows Security Internals” and “Attacking Network Protocols”, both available from NoStarch Press.
