Ph.D. computer security researcher @TrailOfBits. Editor of and frequent contributor to #pocorgtfo. My CV is a PDF that’s also an NES ROM https://xitter.cf/t.co/lDrC4Hz6AI
Philadelphia, PA, USA
Joined December 2008
- Tweets3K
- Following484
- Followers1.4K
- Likes3.8K
Pinned Tweet
After 6 months and over 5k new lines of 6502 assembly, the Kaizo-style platforming section of the NES game in my résumé is finally done! Yes, among other things, the PDF of my résumé is also an NES ROM. You can download it here for your emulating pleasure: sultanik.com/files/ESultanik…
Evan Sultanik retweeted
We beat Google's quantum circuit again, and we didn't have to forge a proof this time.
Today we're releasing trailmix, a toolkit for quantum "kickmix" circuits. It includes 5 new circuits we built for elliptic curve addition, the hardest part of Shor's algorithm.
Evan Sultanik retweeted
Memory Analysis for #Linux has always been a bit hit-or-miss. @trailofbits has released a tool called #mquire that doesn't require debug symbols for the originating Kernel.
#MemoryForensics #IncidentResponse #DFIR #DigitalForensics
This made me mirken until I realized the "i" and "e" were swapped.
OED #WordOfTheDay: mirken, v.
Shetland. To become dark and gloomy; to grow murky.
View the entry: oxford.ly/3Lqld6t
ALT The OED definition of 'mirken', today's word of the day.
Evan Sultanik retweeted
#BSidesBerlin Speaker Showcase
@kiki_morozova explores Weaponizing Image Scaling Against Production AI Systems.
@SecurityBSides #AI #Infosec
Evan Sultanik retweeted
Solving the Traveling Salesman Problem for NYC's 474-station subway network, obviously! @ESultanik used Christofides algorithm to find a 20h 42min route through all 474 stations, which would beat the world record by 45 minutes. blog.trailofbits.com/2025/08…
Evan Sultanik retweeted
New post and tool! Attackers can break production AI systems by using image scaling to hide multi-modal prompt injections from users.
🧵for more info on what broke, how this works, and our new tool to try this out yourself
Evan Sultanik retweeted
Our new whitepaper covers secure-by-design steps that CEXes can take to keep users' accounts (and funds) safe from account takeover (ATO) in 2025.
(Read more 👇)
Evan Sultanik retweeted
When working on Magika (Google's AI-powered content-type detection), I checked other file formats KBs and detection engines to create filesets to train the model on.
I gave a talk at HackLu to share an overview of the existing engines.
speakerdeck.com/ange/overvie…
Any idea why AA’s website is offering itineraries with legs operated by Lufthansa Group? 🤯 @thenonstopdan @AlexInAir
Evan Sultanik retweeted
It's great to see Multiplier by @trailofbits being open-sourced! github.com/trailofbits/multi… I believe it exemplifies the kind of foundational, next-generation tools we need for proper software understanding, maintenance, and sustainment.
Evan Sultanik retweeted
Any crazy libmagic (file) or yara rules out there that blew your mind?
blog.trailofbits.com/2022/07… covered quite a lot of file libmagic syntax.
cc @gynvael @hexacorn @ESultanik @decalage2
Telegram is _never_ the solution. Friends don't let friends use Telegram. This'll be a thread!
Why WhatsApp will never be secure
telegra.ph/Why-WhatsApp-Will…
Yet another way that Telegram leaks information about who talks to whom:
xitter.cf/hkashfi/status/1580625…
Adding this to the long list of reasons why I'd never trust Telegram for anything serious.
mastodon.technology/@rysiek/…
Even Telegram “secret chats” can be subverted by the server.
This is your regular reminder that “secret chats” in telegram rely on server-provided prime numbers (messages.getDhConfig).
The server could send “bad” prime numbers to clients and decrypt conversations later.
Section 1.2.1 of tel-03245433 theses.hal.science/tel-03245…
I hate to be “reviewer #2”, but I’m a bit disappointed that my prior work was not cited sultanik.com/blog/revisiting…
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
Evan Sultanik retweeted
This Wednesday, April 10th, 4:30pm ET: "In Pursuit of Silent Flaws: Dataflow Analysis for Bugfinding and Triage" Evan Sultanik @ESultanik - Trail of Bits @trailofbits ceri.as/sultanik Live on Zoom.
I had to try this myself. @trailofbits was apparently founded by @DanielMiessler and Elijah Savage, not @dguido and @alexsotirov. It is known for having created the fastest open-source password cracker in the world, @shellphish.
This Post is from an account that no longer exists. Learn more
