Russ McRee
@holisticinfosec
Director, GCP Cyber Defense Center, @Google, former @MSFT MSRC, PhD, GSE, dissertation chair @captechu, @SANS_ISC handler, music via @russmcree
You might like
We're sending a HUGE thank you to our incredible community of bughunters ! 🙏 Your passion for finding vulnerabilities keeps our users safe 🔒 To show our appreciation, we awarded over $380,000 in bounties this week, including the largest reward ever given in Google VRP history!
As part of our continued commitment to security & transparency on vulnerabilities found in our products & services, effective today we will be issuing CVEs for critical Google Cloud vulnerabilities, even when we do not require customer action or patching. cloud.google.com/blog/products/…
Mandatory MFA is coming to Google Cloud. We will be implementing mandatory MFA for Google Cloud in a phased approach that will roll out to all users worldwide during 2025. cloud.google.com/blog/products/…
Big Sleep LLM agent found an exploitable stack buffer underflow in SQLite, the database engine. This is believed to be the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software. googleprojectzero.blogspot.com/2024/10/from-n…
Google's approach to the 7 Secure by Design goals include focus on MFA, default passwords, reducing entire classes of vulnerability, security patches, vulnerability disclosure (VRP), CVEs & evidence of intrusions. Stayed tuned for more re Cloud VRP & CVEs! blog.google/technology/saf…
Announcing the launch of @googlecloud Vulnerability Reward Program (VRP), dedicated to products & services that are part of Google Cloud. GC VRP focuses on coordinating new vulnerabilities and compensating security researchers. Top award: $101,010. cloud.google.com/blog/products/…
While cloud providers can support customers in restoring access to their environments or activate backups, cloud providers generally lack the visibility & access to customer environments needed to perform customer incident response & remediation at scale. cloud.google.com/blog/products/…
Our CVR team performed vuln research on GCP’s AI Platform, Vertex AI & considered potential attack scenarios across Google & industry. They discovered unknown vulns that not remediated potentially could have allowed exfil of Gemini 1.0 Pro model @amlweems bughunters.google.com/blog/567986357…
While working with Project Zero, #NickGalloway found an integer overflow in the dav1d AV1 video decoder. He received questions about issue discovery as dav1d is already being fuzzed by oss-fuzz. This is a useful case study in constructing fuzzers 4 effect googleprojectzero.blogspot.com/2024/10/effect…
The bad news is there is a vulnerability in the CUPS printer system on Linux. The good news is nobody has ever gotten their printer working on Linux so they are safe.
The entire disclosure seems to have been leaked online gist.github.com/stong/c8847ef2… Here is the report and POC
At Google, we continually evolve security capabilities & practices to make our cloud the most trusted cloud. To help protect from stolen creds, cookie theft & accidental creds loss, announcing general availability of cert-based access in our IAM portfolio. cloud.google.com/blog/products/…
Google's Cloud Vulnerability Research team (CVR) presents vulnerabilities in the 3rd party image library Kakadu, outlining challenges external attackers face exploiting vulnerabilities in unknown environments. @scannell_simon @amlweems @epereiralopez bughunters.google.com/blog/622075742…
The @BlueTeamVillage at #DEFCON32 had lots of defender-focused activities, and the best pool party! 💙 🛡️ Shoutout to @RayRedacted, @NicoleBeckwith, @Ch33r10, @rj_chap, @JamieAntiSocial, @HolisticInfoSec, @BenGoerz and @rpargman. More @DEFCON villages 👇🏽 infosecmap.com/listing/def-co…
Looking forward to seeing folks tomorrow at our BTV panel in LVCC W3 10 from 3-4p. With over 80 years of SOC experience, we cut the buzzword bingo & get real. We’ll be discussing topics like how to get value with threat intel beyond IOC matching, and more! cfc.blueteamvillage.org/dc32/talk/XR7H…
I'm excited to be on a panel at the Defcon Blue Team Village on hot topics in security operations with Carson Zimmerman, Enoch Long, and Eric Lippart at 3:00pm Pacific on Saturday in room W310. See you there! #Defcon #BlueTeamVillage #SecurityOperations Hope to see you there!
I teach my teams this simple mantra: measurability == survivability. “Use specific, quantifiable metrics to showcase improvements in security posture and ops efficiency.” Reductions in vulnerability remediation time, decreases in IR costs, and latency too. helpnetsecurity.com/2024/07/24/kar…
Cirrus: a command-line tool written in Python to facilitate environment access & evidence collection across Google Cloud & is composed of two scripts: Assistant: automate Google Cloud access setup & cleanup Collector: collect log, configuration & user data github.com/SygniaLabs/Cir…
United States Trends
- 1. #LingOrm1st_ImpactFANCON 550K posts
- 2. Talus Labs 24.4K posts
- 3. #BUNCHITA 1,505 posts
- 4. Frankenstein 82.5K posts
- 5. #KirbyAirRiders 1,937 posts
- 6. Giulia 15.6K posts
- 7. taylor york 9,009 posts
- 8. #SmackDown 48.5K posts
- 9. #River 4,845 posts
- 10. Tulane 4,491 posts
- 11. Ketanji Brown Jackson 4,838 posts
- 12. Pluribus 31.3K posts
- 13. Aaron Gordon 5,254 posts
- 14. Justice Jackson 6,183 posts
- 15. Connor Bedard 3,245 posts
- 16. Russ 14.4K posts
- 17. Tatis 2,258 posts
- 18. Guillermo del Toro 26K posts
- 19. Keon 1,248 posts
- 20. Supreme Court 181K posts
You might like
-
Sean Metcalf
@PyroTek3 -
Roberto Rodriguez 🇵🇪
@Cyb3rWard0g -
volatility
@volatility -
Rob T. Lee
@robtlee -
Christopher Glyer
@cglyer -
Bart
@bartblaze -
Ryan K
@meansec -
Mark Baggett
@MarkBaggett -
Devon Kerr
@_devonkerr_ -
Andreas Sfakianakis / @[email protected]
@asfakian -
Nick Carr
@ItsReallyNick -
Willi Ballenthin
@williballenthin -
Steve YARA Synapse Miller
@stvemillertime -
John Lambert
@JohnLaTwC -
marc ochsenmeier
@ochsenmeier
Something went wrong.
Something went wrong.