Bill1d ago

For those getting questions about Glasswing from their executives, give them this article.

https://tryaether.ai/blog/anthropic-glasswing-frontier-attack

While Everyone Watches Glasswing, Attackers Are Walking Through Your Front Door. - Aether AI

Aether AI's agents pressure test your attack surface continuously, across every attack vector, internally and externally. The same agents then dynamically generate the unique defensive signals required to protect your organisation at machine speed.

Show threadcR0w   

@Sempf Yeah, that's a no for me. My risk models remain unchanged.

He is right that AI gives us the catalyst and the tools.

Apr 9 at 6:13pmWeb
Show threadBill1d ago
@cR0w When you say your risk models remain unchanged, does that mean you are not receiving pressure from management to change them due to Glass Wing, or that you already have and you're not changing them back?
Show threadScott Francis1d ago

@Sempf @cR0w "We have a different question. When did zero days become the threat you were supposed to be worried about?"

I mean, yeah, but also just because somebody is doing the basics poorly does not mean that advanced techniques are not *also* a threat. Many threats simultaneously! And some of them just became more risky and easier for attackers to leverage ...

Show threadcR0w   1d ago
@darkuncle @Sempf Easier for attackers means a potentially higher likelihood of occurrence, but it does not change the severity of impact. And while the likelihood does theoretically impact the risk score, for at least some orgs, it's minimal to no change when your adversaries are at the top of the field already. The rising tide of AI may be lifting all attackers' boats, but the high water mark remains the same, despite the industry continuously claiming a tsunami is coming. I just don't see it.
Show threadRootWyrm 🇺🇦1d ago

@cR0w @darkuncle @Sempf if the first question asked isn't "where's the proof" then people aren't doing their jobs. And Anthropic shitting their pants on command is not proof. They claimed GPT2 was 'too dangerous to release.'

So where's the proof?

An un-exploitable bogus OpenBSD bug that was only validated by themselves?
A research paper they wrote with Claude with a whole lot of fabricated crap?

Where. Is. The. Proof?

Answer: there is none and never will be.

Show threadBill1d ago
@rootwyrm @cR0w @darkuncle I believe that is exactly correct. As I mentioned somewhere, open up a developer console on any browser on any website of any size and significance, and you'll see 7,000 vulnerabilities in the JavaScript. Absolutely none of them are exploitable for anything useful at all. They don't really matter, and I would imagine that 99.997% of the things that are showing up in this magic report are going to be exactly like that.
Show threadcR0w   1d ago
@Sempf @rootwyrm @darkuncle If even that.
Show threadBill1d ago
@cR0w @rootwyrm @darkuncle But out of curiosity, are you getting questions from your management? None of my clients have said a word one, and several of them are very AI focused.
Show threadcR0w   1d ago
@Sempf @rootwyrm @darkuncle I did for a while, but then they found out I'm skeptical but back up my skepticism when asked so they stopped asking me for the most part. They ask the AI fans now.
Show threadRootWyrm 🇺🇦1d ago
@Sempf @cR0w @darkuncle I'm one of the many in the ranks of the funemployed. But I'm definitely seeing a whole lot of gnashing of teeth and sky-is-falling shit from both management and from people who have absolutely no excuse for buying into LLM generated bullshit.
Show threadBill1d ago
@cR0w @darkuncle You should start a blog. Oh, wait.
Show threadcR0w   1d ago
@Sempf @darkuncle
Show threadNosirrahSec 🏴‍☠️ guillotine enthusiast1d ago
@cR0w @Sempf @darkuncle I feel attacked.
Show threadAaron19h ago
@NosirrahSec @cR0w @Sempf @darkuncle Came here to say this.
Show threadScott Francis1d ago
@cR0w @Sempf I am in this picture and not sure how I feel about it
Show threadBill1d ago
@darkuncle @cR0w which one? I'm apparently the skeleton.
Show threadRob O 1d ago

@Sempf @darkuncle @cR0w This is pretty funny. I was literally having this conversation with a colleague (less technical, less security focus) a couple of hours ago. The gist:

Him: Anthropic's stuff is so cool! It's amazing at vulnerability discovery. It's going to revolutionize the way the attackers do their work. Just imagine, 0-days and full kill chains at the push of a button.

Me: Yeah, it does seem pretty cool, and I'm pretty happy I didn't take that job as a vulnerability researcher a while back... but how is this going to really change behavior when most of what we see exploited are unpatched N-days? Why would attackers need to waste money on this when they can just, say, ../ on a public, unpatched Ivanti box?

Show threadnixFREAK1d ago
@cR0w @Sempf @darkuncle lol yep I need to rig up a cattle prod or something else that hurts and have it on a timer to remind me.
Show threadmusing_sys🇨🇦1d ago
@cR0w @Sempf @darkuncle “wait…. Which one?”
Show threadDDR17h ago
me fr fr 😭
Show threadblami16h ago
@cR0w @Sempf @darkuncle this is so me. I bought domain in 2010, now I think blogs are already irrelevant
Show threadScott Francis16h ago
@blami @cR0w @Sempf I still write and read a lot but by the time I’d have time to do blog writing I’m too tired to computer anymore
Show threadcR0w   8h ago
@blami @Sempf @darkuncle I don't think they're irrelevant, they're just not as mainstream anymore. I actually value good blogs more now than I did a decade ago. I just keep forgetting I should take a step back and write out more long-form thoughts instead of hiding them in a series of shitposts.
Show threadvxo12h ago
@cR0w
Oh you mean that thing I put pictures of my cat on
@Sempf @darkuncle
Show threadnek03h ago
@cR0w @Sempf @darkuncle I feel called out…
Show threadScott Francis1d ago
@cR0w @Sempf that was nicely articulated, thanks
Show threadcR0w   1d ago
@Sempf Not just Glasswing but every new AI hype comes to my team like it's some major new threat, but the only thing that seems to change is the scope and scale of individual attackers, not the state of the art. I have yet to see novel vulnerabilities or new attack paths discovered with any AI system yet. If it can only find a bunch of existing vuln classes, then it should already be addressed. If not, then the model was broken and now is a great time to update it. I don't see a difference between AI finding new things and APT69420 finding new things. Because they're not really that new. They haven't been for a while.