Security engineer @ Tolmo

Bulgaria
Joined August 2021
cryptonite retweeted
What a night 🔥🔥🔥 Last week we hosted "Tolmo Day: Autonomous Security in Action." Security leaders, founders, and friends joined to see AI agents take on offensive security, from spotting a weakness to shipping the patch. The best part wasn't the demos (though our founders @pbetouin , @arnaud_breton , @JbAviat, and @poledesfetes made sure those were fun). It was the conversations that kept going around the fire pits long after the sun went down, with Rhonda Sauce and her incredible band bringing the rooftop to life. 🎶 Shout out to everyone who came out and brought so much energy to the evening! And a special thank you to @Accel for hosting us. If you were there, we'd love to hear from you. What landed, what didn't, what you want to see next time. Feedback is a gift, and we read every bit of it. See you at the next one! #TolmoDay
1
5
1
7
1,222
cryptonite retweeted
After months of reviews our humble contribution just landed in the Bitcoin Core main branch: github.com/bitcoin/bitcoin/c… Thanks a lot @macrohead7 for the commitment to get it merged 🙏
2
13
1,405
🚀🚀🚀
Let's go! We're out of stealth with @TolmoHQ! AI is completely redefining how software gets built. And how it's being attacked. Helping define what security means for this new world was impossible to resist. We had to go back! We’re building the AI agent fleet to secure production environments. Our security agents continuously work on a live production knowledge graph that connects data from code, cloud services, containers, databases, and third-party providers. Imagine high fidelity pictures of what you’re building, with a tracked history of changes at scale! Our team spent years on the offensive side, breaking into cloud services, kernels, or cryptographic implementations, as well as building observability and security solutions for thousands of customers in production at Datadog. Over the last few months, we’ve raised $22M, led by Accel and Y Combinator, assembled a stellar team in San Francisco and have been iterating with our first 45 design partners. It’s go time! Joining me today to announce Tolmo: my cofounders @JbAviat, @poledesfetes, and @arnaud_breton, alongside @msuiche and our early team @wbeuil, @jimmycaputo, @cryptonitemmk, @theraniarnia, and @TylerHaydenSF. We're psyched to embark on this new journey together! We're building Tolmo in the open, and we're looking for feedback. Would love to hear your thoughts about what we're building! tolmo.com/blog/introducing-t…
1
51
A summary of our security assessment of Bitcoin core 😎
Miss our last OSTIF meetup? You can catch the recording here of Robin David, Software Security Researcher and Research Lead at Quarkslab, presenting "Bitcoin Core Audit: From Static Review to Fuzzing — Inside Bitcoin’s Testing Infrastructure". #OSTIF #OpenSource #bitcoin
2
80
cryptonite retweeted
Quarkslab engineers @RobinDavid1, @MihailKirov1 and Kaname just completed the first public security audit of Bitcoin Core, led by @OSTIFofficial and funded by @bitcoinbrink. Details on the blog post: blog.quarkslab.com/bitcoin-c… Congrats to developers for such software masterpiece !
1
10
2
48
6,432
cryptonite retweeted
Proton VPN, Proton Mail, Proton Drive, Proton Pass, and Proton Unlimited will accept Monero as payment method soon!
... okay I can confirm it :-) Proton VPN, Proton Mail, Proton Drive, Proton Pass and Proton Unlimited.
34
118
25
1,214
80,279
cryptonite retweeted
🚨Our governments are about to decide whether 450M Europeans deserve privacy - or not. Help ensure your country says NO to Chat Control: Call you local representatives! Privacy is not negotiable. Speak up now. ✊ #privacy 👉 More on how to stop Chat Control: tuta.com/blog/chat-control-c…
36
507
50
1,291
70,806
Six months ago, three colleagues and I at Quarkslab audited parts of the PHP source code. We uncovered 17 security vulnerabilities, including three high-severity issues, leading to four new CVEs.
Quarkslab audited PHP-SRC, the open source interpreter of PHP. The security audit, sponsored by @OSTIFofficial with funding from @sovtechagency, aimed at strengthening the project's security ahead of the upcoming PHP 8.4 release. Here is what we found: blog.quarkslab.com/security-…
1
39
cryptonite retweeted
こんにちは Tokyo! "Of all things, I liked bugs best." ― Nikola Tesla Quarkslab is happy to participate in Pwn2Own Automotive and tomorrow we will try to demonstrate a RCE on an Electric Vehicle Charger on stage. Nikola enlight us, Murphy stay home! zerodayinitiative.com/blog/2…
7
34
2,516
Служебният министър на електронното управление в интервю по БНТ обяснил за някои казуси с машините, в което чувствително ухо може да чуе, че всичко е възможно с машините и тъй като частна фирма инсталира софтуера в последния момент, може да сложи всякакъв софтуер, различен от официално удостоверения. Нека обясня защо на практика не може да се сложи всякакъв софтуер и това да доведе до изкривяване на вота. Да, контролът от държавните органи (ЦИК и МЕУ) е важен, както казва министърът - именно затова по закон тези институции участват в процеса и носят отговорност за него. Този процес може и трябва да се подобрява постоянно - по това с него сме на едно мнение. Но ето детайлите: машините стоят в частен склад, но са заключени на ниво firmware (системен софтуер) чрез т.нар. UEFI secure boot. Никой не може да инсталира нищо, което не е електронно подписано с ключ на ЦИК, който стои в касата на ЦИК. Преди всеки избор, ЦИК създава нов ключ, прави нов официален, удостоверен образ и заедно с него създава една флашка, която може да отключи машините за следващите избори (UEFI unlocker), която също се съхранява в касата на ЦИК. За да се инсталира софтуера за следващи избори, фирмата получава от ЦИК UEFI unlocker от предните избори, с което отключва машините, и инсталационна флашка за новите избори. По време на инсталацията ЦИК изпраща свои представители в склада. Но най-важното: след инсталацията се прави извадкова проверка на машините (този път на 1/3), при която с външен инструмент (hash extractor) се проверява по сигурен начин дали софтуерът на машините е правилният, пак от ЦИК. Това беше и моя констатация и препоръка още през 2021 г. След това никой не може да слага никакъв софтуер, който не е подписан от ЦИК. Това е проверявано няколко пъти по време на удостоверяването - ако МЕУ направи нов образ, без ключа на ЦИК, машината просто не тръгва. Още повече, че след като СИК преброи разписките (преди) / бюлетините (сега), ако имаше разминавания в нечия полза, това шеше да се установи. До момента се е установявало само едно - грешки при броенето на комисията. Дали ако никой орган по веригата не си върши работата, някой може да опита да злоупотреби - може. Дали това е практически изпълнимо и то без да бъде хванато - не. Вкл. защото никой не би рискувал, когато вероятността да бъде хванат клони към 100%. Доверието в машините беше атакувано и подкопано с всякакви измислици и откровени тъпотии за кодове, флашки, снимане. На тези избори се видя, че премахването на машинния протокол води до много проблеми и манипулации в отчитането. Сега е моментът за адекватен, спокоен и отговорен дебат по темата, който не е зареден с конспиративни теории.
30
49
3
335
10,262
* Unauthenticated RCE vs all GNU/Linux systems (plus others) disclosed 3 weeks ago. * Full disclosure happening in less than 2 weeks (as agreed with devs). * Still no CVE assigned (there should be at least 3, possibly 4, ideally 6). * Still no working fix. * Canonical, RedHat and others have confirmed the severity, a 9.9, check screenshot. * Devs are still arguing about whether or not some of the issues have a security impact. I've spent the last 3 weeks of my sabbatical working full time on this research, reporting, coordination and so on with the sole purpose of helping and pretty much only got patronized because the devs just can't accept that their code is crap - responsible disclosure: no more.
78
476
124
2,733
365,303
cryptonite retweeted
Creating an OCI image from source code that can run on any cloud could be very challenging. Quarkslab assessed the security of Cloud Native Builpacks, a tool for creating ready-to-use OCI images directly from source code. The report is available here: blog.quarkslab.com/audit-of-…
7
13
1,800
cryptonite retweeted
Ready for part 3 of our travel into the dynamic instrumentation of #Golang during runtime? In this article, @cryptonitemmk and Damien Aumaitre will leverage CGO, Go's Foreign Function Interface (FFI), to improve the hooking scheme they defined in part 1 blog.quarkslab.com/lets-go-i…
17
33
4,489
cryptonite retweeted
Last year @cryptonitemmk and Damien Aumaitre embarked on a journey to the depths of #Golang. Their mission? To boldly instrument Golang programs during runtime. In the 2nd entry in their travel diary they explore CGO, Go's Foreign Function Interface (FFI) blog.quarkslab.com/lets-go-i…
1
18
28
4,126
cryptonite retweeted
🪓Yes we hacked! Last week QSEC, our CTF team, participated in the European Cyber Cup at the InCyber Forum. Our team finished 4th among 20 participants but we could not engage in the hardware CTF...because we organized it! 👏Kudos to QSEC, the CTF organizers and all other teams!
1
8
2
22
3,346
cryptonite retweeted
🚨 Alerte CERT-FR 🚨 Une porte dérobée (backdoor) a été découverte dans la bibliothèque Linux xz dans les versions 5.6.0 et 5.6.1. Son utilisation semble permettre de contourner l'authentification ssh. Veuillez consulter les avis de sécurité des éditeurs.
22
478
55
984
211,018
🎉Voici le classement complet de cette édition #EC2 2024 ! Bravo à toutes les équipes !
2
18
5
62
6,513
We (@SaltSecurity ) could access *private* GitHub repos of *other* users, using....... ChatGPT! Open the comments below to understand exactly how👇
13
119
10
682
116,954
cryptonite retweeted
Interested in navigation of source code, binaries and other artifacts? Let a marsupial and goddess help you. Here @_cryptocorn_ and Fenrisfulsur introduce Numbat, a new Python API for Sourcetrail, and Pyrrha, a mapper collection for firmware cartography. blog.quarkslab.com/leveragin…
1
34
1
75
10,151
cryptonite retweeted
Interested in dynamically hooking Golang programs ? TL;DR: it's complicated, but fear not because today @cryptonitemmk started a series of blog posts explaining why and how to do it. Here is the first: blog.quarkslab.com/lets-go-i… #golang #hooking #ReverseEngineering #debugging
1
26
2
78
9,158