Project Raven Box (1970s) – Underground builders sold custom “black boxes” that simulated coin tones, letting phreakers make free pay-phone calls worldwide until Bell finally changed its signaling. #Hackers
ToxSec
@toxsec.bsky.social
Security Engineer M.S. Cybersecurity, CISSP. AWS, NSA, USMC. www.toxsec.com
Every “no” is just getting you closer to the “yes.” #bugbounty #grind
How often do you revisit old programs after a scope expansion? #BugBounty
The 414s (1983) – A group of Milwaukee teens dialed into dozens of government and corporate systems—including Los Alamos National Lab—sparking the first U.S. Senate hearing on computer crime. #Hackers
funny how the broken things always hide behind the prettiest UIs. #bugbounty
ever find a vuln that makes you say “no way this is real” out loud? #bugbounty
The Max Headroom Broadcast Intrusion (1987) – Chicago TV viewers watched a hacker in a Max Headroom mask hijack two prime-time broadcasts using a rogue microwave link. The culprit was never caught. #hackers
LLM hallucinations feel like chatting with a confident liar. #AIsecurity
Probe every parameter. Don’t just test id=. Try integer fuzzing, negative numbers, encoded payloads, and nested JSON keys. Even “read-only” params can hide IDOR or injection bugs. #BugBounty
funny how “deprecated” endpoints are usually the most alive. #bugbounty
tracebit ran the context bomb through 100+ simulated attack runs in a fake aws environment. the whole idea is one content change to bait you already run. no new tooling, no new system. just a string that makes the attacker’s own model refuse itself. www.toxsec.com/p/context-bo...
Context Bombs: Defensive Prompt Injection Traps
A decoy secret loaded with text built to trip an AI attacker’s own safety training, so the model refuses itself.
toxsec.com
How many Burp tabs is “too many” before you lose track? #BugBounty
sometimes the grind feels endless, but persistence is the real exploit. #bugbounty #motivation
The biggest risk in “serverless” is believing it means “securityless.” #Cybersecurity
your #AI injection defense has a blind spot: it can't tell you when it fails. a #classifier that misses an attack doesn't raise its hand. you find out from a support ticket.
model stealing sounds fancy until you realize it’s just downloading weights like a pirate. #machinelearning
Lockpick Village – Physical security meets hacking: attendees learn to pick real locks, often opening “secure” high-end cylinders in under a minute. A DEF CON tradition that’s outlived several encryption algorithms. #defcon
it’s always the endpoints with “test” in the name that give the best surprises. #bugbounty
Car Hacking Village (DEF CON 23, 2015) – Researchers remotely killed a Jeep Cherokee’s engine on the highway, forcing Chrysler to recall 1.4 million vehicles. Live demo, worldwide headlines. #defcon
blue teamers don’t get enough credit for the whack-a-mole game they play daily. #cybersecurity
half the battle is convincing yourself to hit “send” on the report. #bugbounty
spent 3 hours chasing a bug, turned out to be a load balancer just messing with me. #bugbounty
when you feel like quitting, remember someone else will find it if you don’t. #hackerlife
don’t give up today. tomorrow might be the report you’ve been chasing. #motivation #cybersecurity
openai's plan ships three tiers off the same model. default refuses on shape. TAC drops friction for vetted defenders. cyber tier runs live-target validation. same weights, three walls, gated entirely on who you proved you are. #OpenAI #TrustedAccess #AISecurity
every bounty program should include free aspirin in the reward. #bugbounty
the u.s. government just forced #openai to hold back gpt-5.6, using the exact same playbook they used to crush #anthropic’s fable and #mythos models earlier this month.
AI is changing cybersecurity on both sides of the fight. PromptFlux shows how LLM-aware malware could adapt, generate commands, and challenge traditional detection methods. Security teams should prepare. aitransformer.online/promptflux-a... #CyberSecurity #AI #LLM #Malware
