15 ms·
Twitter names famed hacker 'Mudge' as head of security
- bob33212 6y agoIs this because of the breach during the summer?
- carabiner 6y agoThis is pretty leet.
- ievans 6y agoPossibly of interest to the HN crowd, just before this Mudge was (and I think still is) involved in a non-profit named CITL that focuses on performing static and dynamic analysis (eg fuzzing) to evaluate hardening measures in consumer software. For example, their work on browsers: https://cyber-itl.org/comparisons/comparison.html?comparisonType=browser&operatingSystem=Windows https://cyber-itl.org/comparisons/comparison.html?comparison... It's very interesting work but I haven't seen wide discussion on it so far.
- sp332 6y agoSarah Zatko, his wife, gets top billing at CITL https://cyber-itl.org/about/company/ https://cyber-itl.org/about/company/
- deleted 6y ago[deleted]
- geek_at 6y agoVery progressive move by Twitter. Meanwhile I tried to warn a car parts shop for 6 months of their massive problem [1] (remote js execution on their site that hadled payments) and even after it was in the media they didn't answer me or fix the issue. Wrote them on Facebook one day and they tried to sue me [1] https://blog.haschek.at/2019/threat-vector-legacy-static-websites.html https://blog.haschek.at/2019/threat-vector-legacy-static-web...
- nice__two 6y agoAs an Austrian myself, I'm not at all surprised at their reaction. To them, their website is "just IT stuff" and they simply don't have a notion that it would involve any security. To them you'll likely seem like an overzealous geek that shouldn't mess with their business website. I've experienced this before myself and it's not particularly a good position to be in. Their site has most likely been technically abandoned, i.e. no one capable is in charge anymore. It'd be best to talk to the owner, show them your "hack" (change it to cats on your phone and let them verify in their browser) and offer them to fix it for free. That's how one does these things in our small country. ;-)
- girvo 6y agoDunno if it should be fixed for free by the person who found it, but I also get your point.
- geek_at 6y agothat's actually what I tried to do. In my mind it would go like "hey your site has included a script from a domain I own" - "haha right, that's some legacy stuff thanks for noticing us" - "no worries but obviously that's not what happened 1. Telling them in person (they didn't understand) 2. Asking for the IT persons Phone number (they didn't give it to me) 3. Leaving my phone number and email (they never contacted me) 4. Notifying the austrian CERT (they never got an answer from the owner) 5. Notifying the press (standard.at posted an article about it, they didn't respond) 6. Writing them on Facebook (ob boy did they respond :D) But since my first police raid I don't publish anything before letting my lawyer read it. He said if they do press charges they haven't got a chance since I have a paper trail of everything I did and didn't harm them or their site in any way
- jmnicolas 6y agoBut why do you care that much about a security flaw in some random site? Warn them once and if they get hacked it's their problem. What's the proverb? You can lead a horse to water but you can't make it drink.
- easterncalculus 6y agoSeeing Mudge's name always reminds me of a time not that long ago: https://www.youtube.com/watch?v=VVJldn_MmMY https://www.youtube.com/watch?v=VVJldn_MmMY Good for him.
- conroydave 6y agothanks for this
- client4 6y agoIs that a young Joe Grand next to him?
- reportingsjr 6y agoThe video was posted by Joe Grand! But yes, that is Joe next to him (aka Kingpin).
- client4 6y agoDoh, I didn't even notice the uploader. Thanks for pointing that out and confirming my observation.
- blackearl 6y agoIt's hilarious to see him then compared to his current wikipedia picture
- Alex3917 6y agoMaybe they're hoping Beto gets a cabinet position?
- pc86 6y agoWhat?
- deleted 6y ago[deleted]
- WFHRenaissance 6y agoBeto and Mudge were both member of Cult of the Dead Cow https://en.wikipedia.org/wiki/Cult_of_the_Dead_Cow https://en.wikipedia.org/wiki/Cult_of_the_Dead_Cow
- tptacek 6y agoIf you're cynical about cDc --- I certainly am --- you should know that talking like this about them just amplifies them. In reality, most people in the scene would associate Mudge with L0pht much more quickly than with cDc --- whatever it is cDc means, or meant, or whatever. Really though, Peiter has just been in the bullpen for roles like this for awhile now. There's several people like him ready to be tapped for high-profile roles (Stamos is the best example, though he seems happy where he is).
- 6y ago
- kordlessagain 6y ago> Zatko answers to CEO Jack Dorsey So, the new security guy reports to the guy who handed Trump a blank check to over communicate while serving public office? > !g how many employees does twitter have? 3,920 employees ZERO sense. Twitter needs to be dismantled.
- kleer001 6y ago>Twitter needs to be dismantled. I agree with you, but on other grounds.
- notassigned 6y agoYes. Just don't use twitter. Over time their numbers will dwindle and they will become a dead social network.
- kleer001 6y agoI wish. That's not how Mass psychogenic illness works. That's not how people act. And most of all that's not how Twitter is being engineered.
- zeruch 6y agoI only met Mudge once (a few decades back in the days of VA Linux, he visited the campus....this would have been maybe right before the @Stake days). The guy was wickedly sharp.
- armadsen 6y agoI was lucky enough to work with Mudge directly a bit at my last job. Wickedly sharp, but also just a great, kind person to work with, and he truly cares about what he does.
- pwinnski 6y agoSmart move by Twitter. It's both a high-profile hire, reassuring investors, and a hire of substance, since Mudge's reputation is well-earned.
- motohagiography 6y agoAm an admirer of Mudge & co. from back in the day, though my initial reaction was doesn't he seem a bit over powered for Twitter? Their recent security issues with that hack were devops management and governance problems, no new science involved, they just dropped the ball on some solved problems. Speculating on what kind of problems Twitter would need that calibre of person for, maybe detecting inevitable AI driven botnets and deepfakes? Could also see how they need leadership with that tangible cred as a decider function, e.g. the personality cult around Jack might make delegation and scaling their management team a challenge if everyone is trying to find a way to compete for his attention, so they need someone with enough weight that he can legitimately defer to on security issues. Congrats to all involved. Interesting times.
- lostcolony 6y agoPR as much as anything. Also probably breadth of knowledge (the depth is nice, of course). And for Mudge, for why it might be worth taking on relatively 'simple' problems - money. Money is nice.
- deleted 6y ago[deleted]
- npunt 6y agoWhen it comes to security, better to err on the side of too much than too little. I'm sure there's enough work to keep him busy, question might be whether it's intellectually stimulating enough for him.
- jcims 6y agoI would imagine nobody takes Twitter security seriously (quite evidently including themselves) which probably creates recruiting impediment. If Jack feels he needs some gravitas to attract a good team, hiring Mudge isn't a bad idea. (Might also provide some legitimacy to an off-menu Twitter threat intel product as well.) There's probably a little bit of housekeeping for infrastructure and operations security. I imagine all of the fun stuff is customer-facing.
- 6y ago
- deleted 6y ago[deleted]
- shroom 6y agoDelete all profiles with five or more digits in the username. Joking aside it will be interesting to see what they can come up with for solutions to platform integrity. I find myself using Twitter more and more and the only SoMe I really "follow".
- m3kw9 6y ago“ Zatko said he appreciated Twitter’s openness to unconventional security approaches, such as his proposal for confusing bad actors by manipulating the data they receive from Twitter about how people interact with their posts.” Would this be like offensive cyber security? Or active security?
- DylanDmitri 6y agoReddit does a version of this with shadow-banning and fuzzing vote numbers.
- saagarjha 6y agoReddit vote fuzzing is generally pretty poor at combating vote manipulation, though.
- anonu 6y agoHow do you detect a bad actor to start with? If youre manipulating the engagement statistics, then you're dealing with a particular type of bad actor...
- teleforce 6y agoMudge name handle does rings a bell and the main reason is that he was featured and interviewed in the arguably the most famous 49th issue of Phrack magazine containing the popular article "Smashing The Stack For Fun and Profit"[1]. In term of popularity this article is at least as popular in computer security circle in term of its profound effect as Dijkstra's seminal paper on "Go To Statement Is Considered Harmful" in computer science community. [1]http://phrack.org/issues/49/4.html http://phrack.org/issues/49/4.html
- saagarjha 6y agoI wouldn't call that a "seminal paper". However, "Smashing The Stack For Fun and Profit" joins a couple of classic papers such as "The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on x86)" (ROP) and the Spectre/Meltdown papers as being fundamental to application security.
- anyfactor 6y agoJust checked his wiki. Even blue chip CEOs are not as well dressed as he is.
- fctorial 6y agoThe wikipedia says he is an open source contributor, but doesn't mention any project. Google doesn't bring up anything either. What projects has he worked on?
- vinhboy 6y agoCult of the Dead Cow... Back Orifice... This is taking me down memory lane. Beto O’Rourke... What???
- nefitty 6y agoWhat about Beto O’Rourke?
- nefitty 6y agoI figured it out. Beto O’Rourke was in Cult of the Dead Cow hahaha. He also used to be in a post-hardcore band with a dude from At the Drive-In. How awesome can one person get?!
- yashap 6y agoI really, really think he’d make a great president someday.
- Dirlewanger 6y agoMaybe, but he's as bland as a saltine cracker. The 2018 Senate race was his to win, but he lost because his message and overall platform was weak.
- PeterisP 6y agoIt's interesting that there are two famous Mudges - I initially thought that this is about Raphael Mudge, who works on CobaltStrike and Armitage among other things, but is not related to Pieter Zatko 'Mudge'.
- ggm 6y agoThree: Craig Mudge, of Bell, Mudge and MacNamara, a highly influential computer architect, based in South Australia. He did critical work in VLSI. And, worked at this place you may have heard of called .. Xerox Parc (he was the director..) https://www.pacific-challenge.com/biography.html https://www.pacific-challenge.com/biography.html
- tester756 6y agoMaybe it's time to ask security questions during SE interviews instead of algos? I know that security is harder and requires wide grasp of theory and solid proficiency in practice but you know: bad algo can almost always be rewritten, leak cannot be reverted. I'll use this opportunity to advertise stuff: Try against world class hackers/security engineers https://ctftime.org/ctf-wtf/ https://ctftime.org/ctf-wtf/ >Capture the Flag (CTF) is a special kind of information security competitions. There are three common types of CTFs: Jeopardy, Attack-Defence and mixed. >Jeopardy-style CTFs has a couple of questions (tasks) in range of categories. For example, Web, Forensic, Crypto, Binary or something else. Team can gain some points for every solved task. More points for more complicated tasks usually. The next task in chain can be opened only after some team solve previous task. Then the game time is over sum of points shows you a CTF winer. Famous example of such CTF is Defcon CTF quals. >Well, attack-defence is another interesting kind of competitions. Here every team has own network(or only one host) with vulnarable services. Your team has time for patching your services and developing exploits usually. So, then organizers connects participants of competition and the wargame starts! You should protect own services for defence points and hack opponents for attack points. Historically this is a first type of CTFs, everybody knows about DEF CON CTF - something like a World Cup of all other competitions. >CTF games often touch on many other aspects of information security: cryptography, stego, binary analysis, reverse engeneering, mobile security and others. Good teams generally have strong skills and experience in all these issues.
- bawolff 6y agoI disagree that its harder. Sure to be an expert security engineer is harder than being an average programmer, but so is being an expert at algorithms. I also don't think ctf's are a good model for security questions during interviews. Knowing how to do something securely is not the same as knowing how to exploit a vuln.
- jen20 6y agoOn the other hand, I'd far rather hire someone who can explain why TLS works and what the weaknesses and tradeoffs are than someone who can reverse a binary tree on a whiteboard, and I'd far rather work somewhere where that was standard of questioning.
- Stierlitz 6y ago> the biggest problem with Healthcare.gov was not timeline or budget. The biggest problem was that the site did not work .. If my memory serves me, a bunch of editable PDFs and drop-down selection boxes that gave no clue as to the correct content. Some serial number, depending on your insurance provider, AS234 BD568 and so on. A total mess. https://web.archive.org/web/20140122141413/http://www.shirky.com/weblog/2013/11/healthcare-gov-and-the-gulf-between-planning-and-reality/ https://web.archive.org/web/20140122141413/http://www.shirky...
- dmix 6y ago> A year ago, the U.S. government accused two men of spying for Saudi Arabia when they worked at Twitter years earlier, Sounds more like some solid counter-intelligence people to hire would be good here, rather than straight infosec. But still good hire obviously and I'm sure this sort of thing has been thought out already. Side note: Getting to hand out grants at DARPA sounds like a fun job.
- OpticalWindows 6y agoProbably going to cash in and out with twitter once POTUS is no longer a frequent user.
- arminiusreturns 6y agocDc be takin over
- 29athrowaway 6y agoThe golden age of buffer overflows starts with Mudge. L0pht also predicted the offensive potential of BGP black holes.
- deleted 6y ago[deleted]