Marcus Hutchins

Since my posts have been shared here ~30 times in the past few weeks, it seems like I'm going to be contributing to Space Karen's Ketamine Extravaganza whether I like it or not. I don't really intend to be active here, but I'll post some of the more important cybersecurity-focused stuff, since it gets screenshotted anyway. That way, people don't have to read post a week late and out of context.

I bought NVIDA puts because I thought the AI bubble was going to pop, but instead a second mistress has hit the tower

Maybe the US version is different, but in the UK, secret clearance is so useless it was less paperwork than the background check for my corporate job. Top Secret they made me list out the full legal name of every single person I've ever fucked and then went and interviewed them. Honeypotting someone and finding out they only have secret clearance gotta be embarrassing af. Just going back to their handler like "I figured out what vehicles they use, it's something called a Humvee".

Me explaining to AI dudes that cybersecurity ≠ vulnerability management and that the majority of cyberattacks involve exactly zero vulnerabilities

Ram Altman is gonna hunt me for sport when he finds out every PC I own has a minimum of 128 GB of DDR4 and several are DDR5.

Imagine if a Huangbang is what ends up popping the AI bubble

I think the invasion of Ukraine is a really solid case study on what an actual "cyber war" looks like. Russia pulled off a couple of massive cyber attacks early on in the war (and before the war), but once the shooting started, they focused almost all their efforts towards kinetic warfare. I suspect this is due to the fact that cyber warfare capacity is a subset of intelligence capacity, and Russia quickly realized that their intelligence capabilities are better put to use aiding (much more impactful) kinetic attack, or helping defend against enemy kinetic attacks, rather than annoying civilians with random outages. I'm also moderately certain this is how it'd go in any war. An initial burst of cyberattacks as powers deploy capabilities their nations had built out pre-war, but then a strong pivot to focusing on support for kinetic attacks as things run their course. Unlikely kinetic attacks, most cyber attacks aren't highly repeatable and reusable. Taking out power substations requires a couple of missiles, or years of work building, planning, and testing cyber capabilities, which have components that are often specific to individual software/hardware brands. Once the adversary figured out the what & how, it's often possible for them to mitigate the effects and/or prevent a repeat attack. Meanwhile, every nation can mass produce kinetic capabilities, and the "just send more missile" strategy tends to work much better than even the most sophisticated cyberattacks possible. Similarly, for a pure cyberwar, a cyber power would just have to, for some reason, wish to tie their own hands behind their back by taking all kinetic capabilities off the table. Given how much cyberattacks tend to impact civilians, I don't see any reason why any nation would commit to this. The idea also runs into huge issue when it comes to conflicts involving less technologically reliant nation, especially the ones that can and do turn of the entire internet. They can cause way more harm to you than you can to them. Cyber attacks are really just not that effective relative to the time and cost of producing them, and "cyberwar" being the future of warfare seems like an idea that is extremely misguided at best. (Obviously not telling this to Andrew, he knows way more about this stuff than I do, just figure the post warrants a retweet since it was what inspired these ramblings).

I own around $20,000 in NVIDIA Put options, so either I'm going to wake up tomorrow and have the best day ever, or the market is going to do something extremely irrational and I'm getting another lube-free fisting.

100%. I don't think the percentage has changed much at all, this problem has plagued cybersecurity for as long as it has existed. Just more people in total are now talking about cybersecurity, which means more people in total overly fixating on zero-day exploits.

Probably not supposed to say this but I found a worm that uses exploits to copy itself between systems, then recruits each infected system into hacking other systems. The developers messed up the code, creating a single point of failure that enabled someone to disable it. I'm a little upset, because while I shouldn't root for the bad guys, it was really cool from a technical standpoint and not particularly harmful.

Can't believe I literally wasted 2 hours of my life going back and forth with the AI psychosis fridge dude like: Him: "So you haven't used GLM 5.3" Me: "I have" Him: "Aha! Gotcha, you just admitted you haven't used GLM 5.3" Me: "I have used GLM 5.3 though" Him: "Aha! Gotcha, you just admitted you haven't used GLM 5.3 as much as I have" Me: "Here is the intricate details of the project I built with GLM 5.3 and how it performed when compared with a frontier model" Him: "Aha! Gotcha, you just admitted you haven't used GLM 5.3, and also admitted you haven't used abliterated GLM 5.3" (Abliterated GLM is just a dumber version of GLM where they've basically lobotomized it to try and get it to refuse requests as infrequently as possible. The only reason to take the performance hit is if you're running into refusals that impede your progress, which I am not. Also I have used abliteraged GLM 5.3). I think he might just be a common garden variety disingenuous debate troll posing as an academic researcher. It's like gish gallop, except he only has 2 points to gallop between, both of which where already disproven before he started the debate.

I love that people want to assume that I formed my opinions on the viability of current generation open-weight LLMs for enabling low-skilled criminals to find useful zero-day exploits, based on having just never used an LLM at all. The first thing I did when Anthropic added me to their CVP was build an autonomous zero-day exploitation pipeline. I've since backported it to use open-weight models because the token cost was insane, so I have a fairly good feel for both current frontier and open-weight model capabilities. I'm well aware of what LLMs are capable of doing, and that they can, with the right steering or harness find zero-day exploits. Where we drift off course is with the claim that low-skilled criminals can just pick up something like GLM and find viable zero-day exploits. I think that: a) More than 90% of CVEs are functionally useless for threat actors. Threat actors have a very specific operational needs and "random issue in random software" does not fall into their scope. b) Many (quite possibly even the majority of) critical rated CVEs are not exploitable under real-world conditions in a way that is useful to threat actors. There's entire teams in China dedicated to n-day exploitation and watching them will give you a good feel for what percent of critical RCEs are actually useful. c) Threat actor with no exploit development background and minimal technical skills, even with access to a completely unrestricted open-weight LLMs, would struggle or completely fail to find useful zero-day exploits. d) People with very little experience in software exploitation, Large Language Models, and CTI, are watching professional vulnerability researchers working with next-gen frontier models and ending up with a wildly unrealistic beliefs of just how "easy" what they are doing is. e) There is an extremely noticeable lack of both zero-day exploitation and use of novel (non-public) n-day exploits by all threat actors, especially unskilled ones, and proponents of the "anyone can just pick up GLM and find useful zero-day exploits" theory continually refuse to even acknowledge that fact, let alone attempt to explain it. I'm not coming at this from the position of some dude who just logs on to social media to says uninformed shit. I'm coming at this from the perspective of a researcher who has spent thousands of hours since LLMs came out researching their capabilities, and has also spent their entire career tracking threat actors and their capabilities. I have a mountain of real-world data, because the low-skilled AI-powered threat actors have a high tendency to accidentally infect themselves with their own malware. This often results in them exfiltrate their entire hard disk, along with all their AI prompt logs, to a vibe-coded C2 with client-side authentication (the admin credentials are hardcoded into the javascript or something equally stupid, so anyone can log in and download it). My entire career I've been very pro "degrees and certs don't matter, everyone is welcome, and the best way to gain experience is hands-on practical work". But when I have some dude whose only experience is essentially just "downloaded abliterated GLM and scared himself with it", I feel like it's necessary to draw a line somewhere. It's not just the bad opinions, everyone has bad opinions on something, I have plenty. It's that resources are actively being diverted away from addressing real and pressing issues in cybersecurity, as a result of FUD being spread about imaginary GLM-powered zero-day wielding scriptkiddies.

idk about this whole "AI enables attackers to write more effective phishing emails" thing. If AI slop is more effective than you at phishing, you should probably take that information to the grave. Couldn't waterboard it out of me.