In Spring of 1995, I was a Linux user. I had been since late 1993 running Slackware. This was being done on a 386SX processor with 2MB of RAM and 20MB hard disk.
There started to be some chatter on USENET about Windows 95 coming out and how it was going being amazing.
I
Kraken Security Update:
On June 9 2024, we received a Bug Bounty program alert from a security researcher. No specifics were initially disclosed, but their email claimed to find an “extremely critical” bug that allowed them to artificially inflate their balance on our platform.
Me: That’s a great painting you are working on.
10 yo: Thanks, I learned how to do this from a *YouTuber* I watch.
Me: Oh, really?
10 yo: He has this poofy hair and paints stuff like clouds, mountains and trees.
Me: Bob Ross?
10 yo: Yeah! Do you know him?
Me: 🤣
Data for 400 million Twitter users are for sale. Contains emails and phone numbers allegedly obtained via an API vulnerability.
The sample posted shows high profile accounts including
@VitalikButerin
@mcuban
and
@briankrebs
.
Stay say, friends. Watch for targeted attacks!
Instead, they demanded a call with their business development team (i.e. their sales reps) and have not agreed to return any funds until we provide a speculated $ amount that this bug could have caused if they had not disclosed it. This is not white-hat hacking, it is extortion!
Kraken Security Update:
On June 9 2024, we received a Bug Bounty program alert from a security researcher. No specifics were initially disclosed, but their email claimed to find an “extremely critical” bug that allowed them to artificially inflate their balance on our platform.
After what we learned about the lack of basic security hygiene at Twitter and the telegraphing that today was coming, I’m genuinely curious how
@elonmusk
is balancing the risk that multiple reverse shells haven’t been planted by 1 of the 1000s outgoing Engineering team members.
We’ll not disclose this research company because they don’t deserve recognition for their actions. We are treating this as a criminal case and are coordinating with law enforcement agencies accordingly. We’re thankful this issue was reported, but that’s where that thought ends.
New breach: XKCD had 562k accounts breached last month. The phpBB forum exposed email and IP addresses, usernames and passwords stored in MD5 phpBB3 format. 58% of addresses were already in
@haveibeenpwned
As a security researcher, your license to “hack” a company is enabled by following the simple rules of the bug bounty program you are participating in. Ignoring those rules and extorting the company revokes your “license to hack”. It makes you, and your company, criminals.
Instead, the ‘security researcher’ disclosed this bug to two other individuals who they work with who fraudulently generated much larger sums. They ultimately withdrew nearly $3 million from their Kraken accounts. This was from Kraken’s treasuries, not other client assets.
Our Bug Bounty program continues to be a vital shield in Kraken’s mission and a key part of our efforts to enhance the overall security of the crypto ecosystem. We look forward to working with good faith actors in the future and consider this as an isolated experience.
In the essence of transparency, we are disclosing this bug to the industry today. We are being accused of being unreasonable and unprofessional for requesting that “white-hat hackers” return what they stole from us. Unbelievable.
The
@defcon
32 badge is not only a GameBoy Color, it can also be a PalmOS device. It has a touch screen! My Graffiti skills are non-existent but character input does work.
#defcon
#defcon32
We have had a Bug Bounty program in place at Kraken for nearly ten years. This program is run internally and is fully staffed by some of the brightest minds in the community. Our program, like many others, has clear rules of the road…
1. Do not exploit more than you need to in
@George_Kurtz
My thoughts are with you and your team in this nightmare situation. If you take a few seconds to step back and look at this from outside your situation room: This is certainly both a security and cyber incident with the threat actor being
@CrowdStrike
. 10s of 1000s of companies
We triaged this vulnerability as Critical and within an hour, 47 minutes to be exact, our team of experts had mitigated the issue. Within a few hours, the issue was completely fixed and could not reoccur again.
This individual discovered the bug in our funding system, and leveraged it to credit their account with $4 in crypto. This would have been sufficient to prove the flaw, file a bug bounty report with our team, and collect a very sizable reward under the terms of our program.
To be clear, no client’s assets were ever at risk. However, a malicious attacker could effectively print assets in their Kraken account for a period of time.
Within minutes we discovered an isolated bug. This allowed a malicious attacker, under the right circumstances, to initiate a deposit onto our platform and receive funds in their account without fully completing the deposit.
After patching the risk, we thoroughly investigated the situation and quickly discovered that 3 accounts had leveraged this flaw within a few days of each other. As we dug deeper, we noticed that one account was KYC’d to an individual who claimed to be a security researcher.
In turn, we requested a full account of their activities, a proof of concept used to create the on-chain activity, and to arrange the return of the funds that they had withdrawn. This is common practice for any Bug Bounty program. These security researchers refused.
Everyday we receive fake bug bounty reports from people claiming to be “security researchers”. This is not new to anyone who runs a bug bounty program. However, we treated this seriously and quickly assembled a cross functional team to dig into this issue. Here is what we found.
Our team found a flaw deriving from a recent UX change that would promptly credit client accounts before their assets cleared - allowing clients to effectively trade crypto markets in real time. This UX change was not thoroughly tested against this specific attack vector.
The initial Bug Bounty report did not fully disclose this transaction information, so we contacted the security researchers to confirm some details to progress with rewarding them for successfully identifying a security flaw on our platform.
If you are headed to
@defcon
, it’s vital that you bring a burner phone.
Why? Because hackers.
Show me your burner (wrong answers only) - I’ll start:
#defcon32
In the last 24 hours, I’ve gained 8,000 new followers. Most of you found yourself here because of a single sentence tweet I wrote yesterday morning. You probably never knew who I was, but decided to follow to see what I’ll say next. Here’s an introduction to who I am:
Confused by the
@dotMudge
whistleblow. When you are hired to lead security at a company, you are undoubtedly going to inherit problems like described in the article. It’s your job to lead through constant improvement to a better, more secure place & reduce risk. It’s hard work.
@MarioNawfal
@buda_kyiv
Update: I’ve been told that
@FTX_Official
or
@SBF_FTX
will be making a public statement regarding the sweeping of the Tron wallet in question and them utilizing funds from their verified
@krakenfx
account to complete this transaction.
Until
@elonmusk
purchased Twitter and seemingly started to dismantle the unfairness on the platform, people who claimed they had been shadow-banned, removed from searches, or had followers removed were often told those features didn’t exist at Twitter. 🧵
#TWITTERGATE
@VP
You left out the part of your message where you write:
“I am asking that the individuals who damaged monuments and property be identified, arrested and prosecuted to the fullest extent of the law.”
Otherwise your statement means nothing and you are supporting their actions.
Working to massively scale a team at
@krakenfx
to do some amazing things in crypto for our clients.
I’m hiring *30* front end engineers with React skills. Fully remote. Global. Get paid in
#Bitcoin
Apply:
I’ve been in InfoSec for 20+ yrs professionally. Before it was 10+ yrs of BBS & IRC. Women were there the entire time. The problem has never been with the minority of women in the “community” but with the acceptance of the minority of men who act like fucking morons.
Yesterday’s Twitter takeover is one of the best examples as why world leaders should not be making official statements or announcements on social media.
Do it live, in front of cameras from multiple media agencies and allow people to confirm the legitimacy of the statements.
So a guy is banned from
@defcon
for abusing. He is friends w/ CEO of a company that’s presenting sponsor of
@BSidesCleveland
. The con puts bad guy on as a “special guest”. The CEO is a keynote & people hope he denounces the situation, but he tucks & runs from the event instead.
Kinder Surprise Eggs are banned in the America. Trying to bring one into the county can result in a $2,500 fine per egg.
This Congress passed law exists because Kinder Eggs and similar might cause children to choke.
It’s more difficult to get candy than a gun in America.
One lesson learned by the
@dotMudge
testimony:
If you are offered a cybersecurity executive leadership position at a company and you wont have actual authority over basic security policies, security hygiene, policy enforcement and access control, don’t take the fucking job.
Kraken Security Update:
On June 9 2024, we received a Bug Bounty program alert from a security researcher. No specifics were initially disclosed, but their email claimed to find an “extremely critical” bug that allowed them to artificially inflate their balance on our platform.
Headed to
#Bitcoin2024
in Nashville? Remember criminals are looking to capitalize on the concentration of Bitcoiners there. You represent something they value, and it is no secret you will be in town.
Tweeting your hotel location, bars you are at (while you are there), etc could
Today, we’ve announced a new initiative to accelerate the token listing process at
@krakenfx
- the goal here is the provide the crypto community and project teams with transparency & simplicity when navigating the process needed to become listed on our exchange.
ATTN: There is an organized crime group actively targeting members of the
#cryptocurrency
industry. You MUST remove mobile phone numbers from your personal email, work email & exchange/bank account recovery processes NOW! 1/
#crypto
#bitcoin
Over the last decade, I ran services at
@rapid7
, was the CSO at
@Uptake
and now run Security, IT & Engineering at a top 3 crypto exchange. It’s been a fun ride & the recent events have certainly been stressful and exciting. I’m optimistic about the future. Thanks for reading.
I’m attending my 25th
@defcon
this year. I’ve been a speaker 10 times and ran a contest for 6 years.
This year is my 8th year as a
@DEFCON_NOC
Goon. I can’t wait to catch up with friends from the hacker community in a few days!
@RachelTobac
@defcon
This happened to a family member’s computer back then - I think it was a eMachine as well. It wasn’t a virus. It was a feature of your BIOS. When your computer’s fans start to fail or get clogged by dust, it would play that music through your speakers.
. . : : The Hacker's Manifesto : : . .
Another one got caught today, it's all over the papers. "Teenager arrested in computer crime scandal", "Hacker arrested after bank tampering"...
Damn Kids. They're all alike.
But did you, in your three-piece psychology and 1950's
I was on
@united
flight on Sept 11th, 2001 that departed Chicago around the same time as the hijacked flights the left Boston. I was headed to Detroit for a client engagement. I still have the ticket today. (a thread)
#September11th
🚨 ALERT: High probability insiders at FTX are currently trying to run off with funds. Both FTX and FTX US wallets have now been affected and commingled. The current amount being laundered is ~$380M.
Please share information below. Let's crowdsource this.
@SwiftOnSecurity
Got this exact same text on one of my lines today. I was laughing because that’s a clever way to confuse almost everyone. I bet it has a higher success rate. This scammer is probably over 40. 😂
I love it when a small change makes a big impact. Last week, we announced new Two Factor Authentication (2FA) requirements for
@krakenfx
clients. In just 7 days, over 10,000 clients have upgraded their account security to enable 2FA for login.
#kraken
#crypto
#security
About a decade ago, a
@thotcon
attendee handed me these custom lock picks after the closing ceremony. They have the original conference logo and my handle on them.
If you made these, please reach out.
If you are tech company providing a free service to the entire planet, you need to weed out individuals in your org who think erasing a U.S. President from their platform is some moral crusade they are leading. It completely erodes trust in the platform itself and calls into
Having done consulting gigs for Las Vegas casinos, this comes as no surprise for Fremont Street. A decade ago, even the strip casinos had flat networks. Plug into the 4 port switch behind the quick service register selling pizza & and the casino network was yours to “explore”.
The computer networks at two Fremont Street casinos — Four Queens and Binion's — were hacked last night, according to multiple sources.
Slot machines, player loyalty programs, credit card processing, hotel reservations, and ATMs were all affected.
Honored to accept this
@CSOonline
#CSO50
award on behalf of the
@krakenfx
security program. It was fun and rewarding to lead such a talented and passionate team that resulted in our project entry.
The information security world went from telling people to never scan QR codes due to potential mobile exploits to making it a core part of Passkeys. That QR code threat must have disappeared or maybe it wasn’t as large as the noise everyone was making about it. 🤔
@elonmusk
When merging in traffic on an expressway, blinker detection in Autopilot would be great. Allow the driver to customize their mood on a sliding scale between “dick” and “doormat”.
@oculus
Thanks for giving me a single way to log into Oculus. I wonder how I was doing this previously. 🤔 Could it have been my fucking OCULUS account?
If you have a knack for cryptocurrency, security and working with clients a Account Security Specialist position at
@krakenfx
might be perfect for you.
We are looking to hire 10 people for this
#job
globally - ASAP.
Fully remote - get paid in
#bitcoin