Cybersecurity engineer specialised in detecting threats and preventing attacks. Currently working as a staff in fintech/blockchain
London, England
Joined September 2018
- Tweets397
- Following918
- Followers812
- Likes785
Pinned Tweet
Ransomware we've recently analysed uses the following command to pop your machine into Safe Mode before performing encryption
C:\Windows\System32\bcdedit.exe /set safeboot network
Why? Because your EDR/AV might not be allowed to run in Windows Safe Mode
1/2
Starting to see event more prompt injection in the wild..
To compensate for letting my agents run freely on my machine I am using docker sbx to sandbox Claude Code
Here's how I set it up 🧵
Step 3 is the network, super important
The preset allows wildcards like **.amazonaws.com and **.googleapis.com.. but rogue agents could still use those to upload your code to any public bucket.
sbx policy deny network --sandbox myproj \
"**.googleapis.com" "**.amazonaws.com"
Open hosts one at a time, only when a task needs them:
sbx policy allow network --sandbox myproj docs.example.com
treat the allowlist like a firewall
Wild this was only a year ago. Say what you want about Anthropic but he was right
businessinsider.com/anthropi…
"Luna Reserve" is a nice touch added by Codex.
If, like me, you have burned through your allowance within 2 hours on Saturday morning, you can use Luna for simple tasks until your allowance resets.
Jev appears to have a multiple cybersecurity use cases
I will be testing each of these out against frontier LLMs
Firstly - the obvious one to me - security threat alert triage...
This allows us to scale up the volume of security telemetry we feed to our agentic pipelines.
Big win.
Does anyone feel that it takes longer to read LLM-written text than human-written text?
My brain has subconsciously learned that it’s full of fluff, Claudisms and potential errors
It’s lost respect for it, so it commits less to ultrashort memory.