Profile for joern
- Display name
- joernchen
- Username
- @joern@threatactor.club
- Role
- admin
About joern
Fields
- Website
- https://0day.click
- Threema
- https://threema.id/K8J68WTX
Bio
Your mom's favorite hacker!
My other account is @joernchen
- Joined
- Posts
- 686
- Followed by
- 1129
- Following
- 261
Stats
Recent public posts
exclude boosts
You use Claude Code to find vulnerabilities, I find vulnerabilities in Claude Code.
https://greptalks.ai/ is fun, also https://greptalks.ai/rate-my-talk/ for letting it rate your own presentations.
Infosec community right now…
Find a vuln? Your disclosure options:
1. Exploit it! Plant ransomware, steal cryptocurrency
2. Sell it to a broker. Add "journalist hacked" to the muted words list. Ignorance is bliss
3. Sell to your country's military. Patriotic.
4. Tell people who are affected by disclosing it
Maybe AI is what was needed to make Linus‘s Law ("Given enough eyeballs, all bugs are shallow") become effective since now there are enough(?) AI assisted eyeballs.
@joern CVSS? Not even once.
Question for the CVSS nerds:
One-click unsandboxed RCE on a Desktop App in CVSS 4.0 --> Subsequent System Impact Metrics are what exactly?
Anyone in Berlin from whom I can borrow an RTL-SDR (USB, ideally with antenna)? Ideally in West Berlin, near U7 or near Schlesi :)
When you instruct your LLM, why is it:
“make no mistakes!”
and not:
“good vibes only!”
Thanks so much to everyone who showed up on the weekend in Berlin to say goodbye to FX.
“Burning bridges where we can” - this is the original Phenoelit slogan. Yet, while FX for sure burned some network bridges, he did quite the opposite for the hacking community. FX built bridges between people wherever he could. He created something way bigger than himself which we all are part of.
Each one who joined us in Berlin carries a piece of his legacy. You were there because he left something with you. We know there are many who couldn't make it in person, and they too carry his spirit with them.
FX is gone.
But the spirit lives on.
I finally managed to write something about my recently deceased dear friend Felix 'Fx' Lindner.
i look forward to AI finding an 0day and providing a patch that contains a backdoor for a supply chain attack.
LLMs now do the busywork of finding amazing vulnerabilities for everyone willing to spend the tokens.
But hacking still isn't dead:
We haven't at all solved the underlying problems which come with writing and shipping code.
You still need to understand what you're looking at and what you are operating.
The LLM platforms themselves are a exquisite target for hacking^Wcreative use of the technology.
Now when everyone can pull a CVE or two out of thin silicon and a few kWh of electricity the art of hacking might need adopt and maybe reshape a little but at its core the mind- and skillset will stay as relevant as it always was.
In that sense: keep hacking, keep exploring, break some stuff.
If your Open Source project sees a steep increase in number of high quality security reports (mostly done with AI) right now (#curl, Linux kernel, glibc confirmed) please tell me the name of this project.
(I'd like to make a little list for my coming talk on this.)
Letting Gemini proof read my Claude Code vulnerability write ups. 🤡
RIP FX
We collected some texts from the community in memory of FX. You can find them here https://phenoelit.de/fx.html
@joern RIP FX. Lets remember him in the good old days https://media.ccc.de/search?p=FX
RIP FX - You are a legend.
Here Dino is delivering his Pwnie Award, as well as the last public post FX made last year.
