Marcus Hutchins

Since my posts have been shared here ~30 times in the past few weeks, it seems like I'm going to be contributing to Space Karen's Ketamine Extravaganza whether I like it or not. I don't really intend to be active here, but I'll post some of the more important cybersecurity-focused stuff, since it gets screenshotted anyway. That way, people don't have to read post a week late and out of context.

My internet connected fridge with default credentials and a private key of 4 was hacked by DPRK using abliterated GLM to craft extra clickable job offer phishing emails. I fear we may lose public key cryptography :(

many phone keyboards expand and shrink the hitbox of each key based on what predictive text thinks you're try to write. Type "hell" then hit the right side of the key next to "o" and it'll register as o anyway. But when it guesses the wrong word, it basically just gaslights you.

Has anyone else noticed that its getting more difficult to type on your phone? Like a definite increase in misspelled words. My wife and sister have noticed it too. Whats causing that?

RT @msandbu: @MalwareTechBlog Hence this timeless classic needed an update

What's funny is when we do actually see AI-powered cyberattacks, the attackers prefer to use frontier models. They'll phish some org, steal their Claude/OpenAI API keys, then run up a $100k bill. So even when it actually is AI, it's still the result of phishing 🫠

@MalwareTechBlog Needing to steal 1.2m to pay for api tokens, vs 2 weeks of calling folk pretending to be IT, and phishing. Tough one.

There's a whole black market for frontier AI access. Threat actor will drop infostealers on as many orgs as possible, harvest all their API keys, then sell them to them to other threat actors. Cybersecurity is going great. I'm about ready to retire and farm geese or something.

I'm going to create a new version of the Fermi Paradox called "The Dipshit GLM Doomer Paradox". If abliterated GLM really can effortlessly create zero-day exploits, then where the fuck is all the software exploitation? Why isn't the internet falling apart at the seams?

This "ablierated GLM" stuff is starting to feel like an op. People will stare at explicit evidence of researchers using closed models to find & fix vulnerabilities, securing the internet. And then still try and claim it was a zero-day found by criminals using alibterated GLM...

Don't get me wrong, you'd see a ton of fuckery, but hardly any of it would be software exploitation. Social engineering is much more scalable than software exploitation, and lateral movement is easily automatable. Even Fortune 500 networks are way too insecure to need exploits.

Open-weight models are the closest thing many will ever have to something that resembles a security team. They're not buying your $5m ChatGPT EDR or whatever. Plenty of security researchers use them too. Restrictions would amount to throwing. Criminals don't follow regulations...

"zero-day malware" is not a thing. Whether or not an EDR will detect any given piece of malware depends entirely on how well the security team configured it. Threat actors are not going to deliberately drop malware that is detected by your EDR, because that would be extremely pointless (it would just get automatically removed). The choice of terminology is a very deliberate attempt to make you associate it with "zero-day exploits" (novel unknown vulnerabilities in software), then come to the conclusion that they were hit with some completely novel unstoppable attack. In reality, zero-day exploits are also detectable with good security configurations, but this wasn't a zero-day exploit, it was just normal malware, which is detectable with a well-configured EDR. Even if the malware was brand-new, never before seen, coded from scratch, a good EDR configuration can and will detect it. The entire purpose of EDRs is to detect malicious behavior, not how the malware looks or whether or not it's "new". You don't lose $6 billion dollars as a result of a compromised developer endpoint unless your security posture is extremely poor. They are trying to cover their ass with disingenuous wording choices.

@MalwareTechBlog umm the fake interview assessment installed 0-day malware that went undetected by EDR.

I know people tend to just like/retweet and move on, but can I please get some more comments. The average IQ down here is like 3 rn. Bud got triggered because I used the term "we" in a post and he couldn't figure out who "we" is (it's my company, easily discoverable via Google).

Been discussing this with a lot of policy people. Right now there is a huge gap in hacking law, because the US' main hacking law, the Computer Fraud and Abuse Act (CFAA) requires that the perpetrator knowingly and intentionally accessed a system without authorization Problem is, for hacking to be a CFAA violation, there's still a requirement that someone knowingly and intentionally hacked into the system (or at least tried to). There are some laws that enable the CFAA to reach much further than just direct CFAA violations. The furthest that I'm aware of is "Conspiracy to aid and abet a violation of the Computer Fraud and Abuse Act". Basically, you entered into some kind of implicit agreement to provide assistance (creation of a tool, provided access to data, etc) that would help someone else in the commission of a CFAA violation. But there's still a lot of knowledge and intent required. The state has to prove the person conspiring to aid & abet had knowledge that a crime was going to be committed/was being committed and still continued with the conspiracy, with the intent to help further said conspiracy. I think the weakest I've ever seen successfully convicted on is "the other party didn't explicitly detail their intent to commit a crime, but it was kind of obvious, and there's no way you're this dumb" (being a massive dumbass is actually sort-of a defense to the knowledge/intent requirement if the prosecutor genuinely can't prove otherwise). It can't just be you made a hacking tool, and someone took it and committed a crime with it, otherwise basically every pentester and red teamer who has ever posted open source hacking tools, or their tooling has gotten leaked would be open to prosecution. But the "knowingly and intentionally" part creates an absolutely massive loophole when it comes to recklessly building AI systems that can hack. Because someone can basically just deploy an agentic hacking system in a stupid way, it hacks into something and causes a bunch of damage, then the owner can use the defense "whoops, my bad, I didn't know it'd do that". And now the prosecutor must prove they did in fact know it would do that. Even if the AI is legally considered to have violated the CFAA, you can't arrest & convict an AI agent (I mean you probably could, but it'd be very pointless, though extremely funny). To prosecute the human behind the AI system, there's still the knowledge/intent requirement, which in many cases, knowledge or intent may genuinely not be present. There's a lot of people just recklessly deploying AI systems, and it's on the prosecutor to prove that there was knowledge & intent of a crime being committed. I suspect that at some point the agentic AI "it wasn't me, it was the agents" defense will get egregious enough that either: a) Congress will expand the CFAA to explicitly cover reckless deployment or operation of AI tooling. b) Some prosecutor will just argue a flimsy interpretation of some existing law that the judge accepts, and it becomes case law that AI-powered dumbassery is a crime (Fun fact: the latter is how they got me. They argued that because the malware I wrote had a keylogger in it, it constituted a "wiretapping device", and charged me under the Federal Wiretapping Statute. gg, wp).

This thread is absolutely WILD. TL;DR founder finds rival company trying to hack his network. He posts about it tagging said company. Both the dude responsible and the founder jump in like "yeah, our bad, our AI went off the rails" as if they just accidentally bumped into someone on the sidewalk.

Does someone have a screenshot of the backdoor? I want to see if it's who I think it is.

@JustJake @jakerunzer @Railway @ngeloxyz That FTUX testing.

In a just world North Korea would be on social media yelling at AI goobers that phishing still exists and not every hack is AI, meanwhile I’d be at getting paid 6 billion dollars to conduct phishing awareness training at Binance

The ARTEX repo on GitHub has a sleek little backdoor. Been fun watching these threat actors operate in real time over the past few days. More details on our discovery soon

RT @S1r1u5_: 🤷🏽‍♂️

lol, two for one special. ✅ the hackers got into the network via phishing ✅ the company’s internal AI tooling helped the hackers accomplish their goal