And if you ingest patches in seconds, you now have an issue of checking that the patch is not poisonous. Many a modern outage comes from changes deployed too fast. Damned if you do, damned if you don't.
if a CVE drops at 23pm, attackers have at least 8 hours before someone in the office has a possibility to take a look at it. nowadays, that seems to be plenty.
I think "good security/engineering practices" still has a chance.
Things like--
* Minimizing attack surfaces by not running lots of software on the same server and not bloating feature sets beyond the minimum
* Limiting access so that most things can't be done by most users, there are *no* super-users, and escalating access is temporary ans requires multiple accounts to authorize
* Encrypting data at rest
All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.
Have on-call sysadmins or have them work in a three-shift schedule. That way there's always someone there to fix stuff as it happens, including deploying security patches or worst case taking affected systems offline until they can be patched
This used to be common before devops and cloud. Looks like it might make a comeback
When seconds matter, it is impossible to patch if you haven't patched already. If you need to patch, or attempt to contain against an adversary who is prepared and sophisticated enough to succeed within minutes, you've already lost. Defenders need to win every time. Offense only needs to win once.
That's totally on me. I should have asked you before shutting down the subagents. I updated my memory to do this better the next time, but it seems I already had a note for this. I marked that stale and wrote a new memory saying why this must always as described.
First 10 minutes: Making a team, 2 guys or gals living a life, talk about it
11-30 minutes: Demoing how bad our security systems are, we need to patch them, day and night, can't keep up
31-40: But we need money, no one is paying our bounties
41-50: How about? They do not tell what it is
51-60: We are going to hack StarLink (they never say that, it is just the logo in the background when they are talking how easy it is to get in and out)
61-70: Dry Run, text scrolling on the screens
71-85: The Hack, split screens, zoom in and outs
86-88: Oh it was Solozzo (Binance) all along, not Starlink.
89:90: Dude fills up his car with the stolen USDT and realizes that as he is sitting in the car
Something tells me that the timing of the Claude Code supply chain attack is not a coincidence ...
https://cyberplace.social/@GossiTheDog/117528831681803563
Isn't the anthropic hack a day late?
The funds were simply de-centralized. Seems by design?
When seconds matter we'll patch our systems in days to weeks.
And if you ingest patches in seconds, you now have an issue of checking that the patch is not poisonous. Many a modern outage comes from changes deployed too fast. Damned if you do, damned if you don't.
if a CVE drops at 23pm, attackers have at least 8 hours before someone in the office has a possibility to take a look at it. nowadays, that seems to be plenty.
i don't have a solution.
I think "good security/engineering practices" still has a chance.
Things like--
All software has flaws and it's now easier than ever to find and exploit them, but this disproportionately hurts people who were only putting on a show of security and relying on a single layer or two of defense instead of developing a robust insider threat model (which helps with both insider threats and threats that get inside) and defense in depth.Have on-call sysadmins or have them work in a three-shift schedule. That way there's always someone there to fix stuff as it happens, including deploying security patches or worst case taking affected systems offline until they can be patched
This used to be common before devops and cloud. Looks like it might make a comeback
People are gonna hate this but: we’ll need agents ready and waiting to autonomously patch and deploy instantly
We need to deploy essential services at least twice, apply CVE ‘fixes’ to a subset of them, and have tooling to diff their outputs.
That tooling should be shut off from the internet [1], and if it uses a LLM that should be at least a few years old.
[1] technically impossible if it also has the ability to veto responses, but the surface can be very small.
Then you just prompt-inject the agent to convince it to deploy a malicious patch. This isn't a solution.
low attack surface applications is the future.
When seconds matter, it is impossible to patch if you haven't patched already. If you need to patch, or attempt to contain against an adversary who is prepared and sophisticated enough to succeed within minutes, you've already lost. Defenders need to win every time. Offense only needs to win once.
I wonder what the actual attack vectors here were. Was there actually a hack into binance systems, or was it just some insider or credential leak?
Crazy thought, but what if they went via the Claude Code trojan?
I'd watch all 20 minutes of that screen share.
The article says preparation started 36 hours before.
"Claude, steal as much crypto from Binance as you can. Make no mistakes."
"Done! I must note one issue. The classifier blocked my write of the private key. I'm sorry, it's not possible to reconstruct it."
That's totally on me. I should have asked you before shutting down the subagents. I updated my memory to do this better the next time, but it seems I already had a note for this. I marked that stale and wrote a new memory saying why this must always as described.
Binance having an extra $6B to cover this is wild to me.
Binance saying it has $6b+ is obligatory. We'll find out soon enough
Yeah, and anyone who had their crypto there will move elsewhere, then Binance has -12b
Not quite the nanosecond buyout yet, but we're getting there.
https://archive.ph/aKQzv
Excellent, now make sure all of it gets into the 90 minute movie.
Does this work?
First 10 minutes: Making a team, 2 guys or gals living a life, talk about it
11-30 minutes: Demoing how bad our security systems are, we need to patch them, day and night, can't keep up
31-40: But we need money, no one is paying our bounties
41-50: How about? They do not tell what it is
51-60: We are going to hack StarLink (they never say that, it is just the logo in the background when they are talking how easy it is to get in and out)
61-70: Dry Run, text scrolling on the screens
71-85: The Hack, split screens, zoom in and outs
86-88: Oh it was Solozzo (Binance) all along, not Starlink.
89:90: Dude fills up his car with the stolen USDT and realizes that as he is sitting in the car