Managing Director - Grossman Ventures. CTO of Root Evidence. Defender of others' privacy, Author of AI’s Best Friend, Advisor, often found joking.
Austin, TX
Joined July 2008
- Tweets5.1K
- Following969
- Followers34K
- Likes1.7K
Pinned Tweet
Today is the day we finally get to announce that we closed funding of our seed round for our new company Evidence. This day represents over a decade of brainstorming and years of gathering data and talking to design partners.
If your code is downloadable (as in a mobile or desktop app) it can be reverse engineered. A great use case for LLM-enabled adversaries, and makes webapps interesting again, because attacking them can scale with secrets derived from the decompiled apps.
Open question. I have my theories, but I would love to hear other people's theories on this. When we look at the amount of exploits for which there is a documented known exploited vulnerability (KEV) listed, compared to the number of exploits that have exploit code, it is clear that they are uncorrelated. So why is that? Why do hackers seem to completely ignore most vulnerabilities for which there is exploit code? The current stat for all combined public KEVs is only around 2.1% of code with exploit references is ever exploited and that number is declining as a percentage due to all of the new CVEs being produced in the last three years with the help of AI.
Robert Hansen retweeted
What AI is actually worth to an attacker?
On October 14, @jeremiahg and @RSnake sit down with Michael Aret, a CISO in the defense sector for a nation state, to discuss how nation-state actors actually use AI, where it genuinely amplifies their capabilities, and where its unpredictability is a liability for an adversary whose operations fail the moment they're noticed.
Webinar: AI and Nation States
Wednesday, October 14 at 9am PT
Register: na2.hubs.ly/H088Dwh0
We're now over 400k CVEs and counting. Update your talk tracks everyone! Onward and upward!
cvedata.com/
Rare data within LLMs don't typically surface because LLMs produce the statistical mode of their training data. That works great if everyone is right. However, if they're not right, it's terrible.
Robert Hansen retweeted
Every AI hype dealer in cybersecurity should be forced to watch this. @jeremiahg is bringing the goods and the data. @rootevidence
Robert Hansen retweeted
The Vulnpocalypse was supposed to be here by now... so where is it?
In our new research, we traced every confirmed exploitation of a published CVE since 2018.
On Wednesday, Sept. 2, @jeremiahg and @RSnake are hosting a webinar to walk through what the data actually shows.
At the end of the hour, you'll be able to answer:
→ Whether AI is really growing your backlog faster, and what that changes about what you patch
→ How to tell the 1.5% of CVEs that get exploited from the ones that never do
→ Whether you should be planning for more zero-days than you were three years ago
→ Why the median patch-to-exploit window is the wrong number to build an SLA on
→ Which of your CVEs get attacked inside 30 days, and which sit untouched for over a year
→ Which vendors and vulnerability classes are worth most of your patching hours
Attendees will get access to the full data in our upcoming Vulnpocalypse Report before it is publicly released.
🎙️ Webinar: Rumors of the Vulnpocalypse Have Been Greatly Exaggerated
📅 Wednesday, Sept. 2 at 9am PT
🔗 na2.hubs.ly/H07p4dw0
Robert Hansen retweeted
Something just came to my mind that @jeremiahg and @RSnake have done a lot of case deep-diving with css tricks back in from ha.ckers community days
Robert Hansen retweeted
Which vulnerabilities are actually going to cost us? The answer isn’t “all of them.”
That’s one of the central ideas behind “The End of Guessing,” a new book from Robert Hansen @RSnake and Jeremiah Grossman @jeremiahg .
Instead of asking security teams to chase every vulnerability, the book explores how evidence of real-world exploitation, adversary behavior, and business impact can help organizations focus on the vulnerabilities that will lead to financial loss.
If you're attending Black Hat, stop by the Nucleus Security booth (#5533) to meet the authors and get your copy signed.
📍 Aug. 5 | 2:00-3:00 PM
📍 Aug. 6 | 10:00-11:00 AM
#BlackHat #BHUSA #CyberSecurity #VulnerabilityManagement #ExposureManagement
Robert Hansen retweeted
Shoutout to @RSnake for the Vulnpocalypse site
New iPodcast is up!
📉 The incredible shrinking window between vuln disclosure and exploit
🩹 Changing patch schedule for @Cisco and who may follow suit
🪲The Vulnpocalypse!
open.spotify.com/episode/4PH…
This is a compression bomb + slowloris - basically large decompression and holding the socket open. Two unrelated DoS types chained together with Codex.
Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.
Blog post: blog.calif.io/p/codex-discov…
PoCs: github.com/califio/publicati…
Robert Hansen retweeted
For my Massachusetts homies, if you're on the south shore on Saturday, come see me at the Plymouth Public Library Local Author Fair. I'll be signing my books. If you ask nicely, I'll tell you a funny story about @ryanaraine or @RSnake. Or both.
Lib Theseus is out! It's basically a skill that removes your 3rd party code and replaces it with 3rd party code. It removes CVEs, and can actually dramatically improve security as a consequence, though it's mainly meant for compliance.
Link to the post with the code: rootevidence.com/blog-posts/…
Time to rethink defense. When patching is too slow, and assume for a moment it will be. Then what?
As I’ve been saying, the time from patch availability to exploit creation to target acquisition will reduce down to minutes -- even seconds in some cases. NO WAY patch management will be able to keep up. Defense models will be forced to change.
zdnet.com/article/cybercrimi…
Robert Hansen retweeted
Most organizations don't know which vulnerabilities will actually cost them money. They're managing thousands, patching by severity scores, and still getting breached.
At RSA, our co-founder @RSnake sat down with Yahoo Finance's Tech Edge to talk about what tech-enabled underwriting actually looks like and why clean, financial-risk-driven data changes things entirely.
If you're in security, risk, or underwriting, this one's worth 10 minutes.
🔗 tech.yahoo.com/cybersecurity…