Alex Stamos

CISO at SentinelOne
https://www.sentinelone.com

Teaching at Stanford
https://io.stanford.edu

Public Key

npub1e50y3s2953kyxa3h5xg5jpycy7nh9p4wam6ks4nw7quesu9auegquhl5x6

NIP-05 Address

alex_at_cybervillains.com@mostr.pub

Profile Code

nprofile1qqsv68jgc9z6gmzrwcm6ry2fqjvz0fmjs6hwaatg2eh0qwvcwz77v5qpzemhxue69uhhyetvv9ujumn0wd68ytnzv9hxgqgkwaehxw309aex2mrp0yh8qunfd4skctnwv46q477f4m

Publishing to

relay.nostr.band

relay.primal.net

Author Public Key

npub1e50y3s2953kyxa3h5xg5jpycy7nh9p4wam6ks4nw7quesu9auegquhl5x6

Show more details

Last Notes

2025-04-16 21:11:22

Working with Chris Krebs and getting to know his wife Emily and their family has been one of the great honors of my life. The extralegal attack against their family should be condemned by all.
I have written a post about what is happening to them here: https://www.linkedin.com/posts/alexstamos_exclusive-former-trump-official-targeted-activity-7318372702438707201-SLo2

2025-04-07 16:30:50

- reply

@nprofile…v6nv @nprofile…0ajr I don't work at Facebook anymore. There are a couple of books to that effect.

2024-12-13 17:32:31

- reply

@nprofile…ljz9 @nprofile…5lc3 The challenges with the Paranoids are all downstream of the constant company shape and business model changes at the top. Is Yahoo a tech company? A platform? A holding company with many various services? A media company? Every CEO (there were four of them in 2012, three from 2017-2018) has a different answer to that.
@nprofile…jv4z built up a great team and is doing his best to protect his people but it is hard to do that on shifting sands.

2024-09-17 13:34:55

I think this would have put a smile on Dan’s face.
https://assets.cybervillains.com/media_attachments/files/113/153/152/861/769/326/original/91b2f575e33d0195.jpeg

2024-08-24 02:24:30

- reply

@npub1aml…eu4e Docker made things really complicated, now source on Proxmox VMs.

2024-08-14 17:58:12

- reply

@npub1l20…0c0w Tricksy Caltrain network engineers!

2024-08-14 15:37:36

- reply

@npub1l20…0c0w That’s not a real MAC!
? (10.3.0.1) at 0:21:21:21:3:30 on en0 ifscope [ethernet]

2024-08-14 15:32:53

https://assets.cybervillains.com/media_attachments/files/112/961/098/147/772/691/original/1d93094ca2532578.png

2024-08-05 17:20:46

This button is getting some work this week.
https://assets.cybervillains.com/media_attachments/files/112/910/561/512/351/273/original/a6529dde12b55315.png

2024-08-05 17:20:46

This button is getting some work this week.
https://assets.cybervillains.com/media_attachments/files/112/910/561/512/351/273/original/a6529dde12b55315.png

2024-07-21 13:26:04

- reply

@npub1t8u…c7sk Because VCs have all day to spend on Twitter.

2024-07-08 20:09:28

- reply

@npub1f0m…0fu6 Opens fine for me in incognito

2024-07-08 20:07:12

There was some political news last week, so I don't blame you for not reading my OpEd on AI regulation in my old hometown paper, the Sacramento Bee.
I argue for California legislators to focus on the real negative impacts of AI that we are seeing today instead of creating open-ended liability regimes for I’ll defined existential risks that will only serve to drive AI research out of California.
Even the EU’s regulations are much better targeted than SB 1047.
https://www.sacbee.com/opinion/op-ed/article289516808.html

2024-06-28 00:38:03

- reply

@npub1rv4…ft5j And before employees visit the rows and rows of H100s you have to get your epidermis burned off by Xenon lamps. Just because.

2024-06-23 21:16:22

- reply

@npub1l20…0c0w “How do you like to handle configuration management for developer Macs?” followed by “Does your computer ever seem to have a mind of its own?”

2024-06-23 21:12:33

I’m interviewing three people this week for various CISO roles and I’m wondering how to work these questions into the flow.
https://youtu.be/9S1EzkRpelY

2024-06-18 15:29:45

- reply

@npub1kls…44gj Yeah, folks working on online security and safety are speed-running what the climate scientists went through.

2024-06-16 23:38:58

- reply

@npub19l2…g6se Yup, I asked for protection and fixes and my account was suspended, even though you are supposed to be able to comment on your own talk page to ask for admin support. Oops!

2024-06-16 04:43:40

- reply

@npub15zy…pqjg “Has an impossible to understand Californian accent, unlike the Sheila”

2024-06-16 04:43:04

- reply

@npub1kk0…vn9f Yeah, I rather they just delete it instead of allowing VPN exit nodes blame me for things that happened at companies before I got there or weren't my responsibility.

2024-06-16 04:13:26

Gosh, I really enjoy Wikipedia allowing anonymous IP addresses to write a living person's biography, especially one who has come under highly politicized attacks.
Great job, folks!

2024-06-16 04:13:26

Gosh, I really enjoy Wikipedia allowing anonymous IP addresses to write a living person's biography, especially one who has come under highly politicized attacks.
Great job, folks!

2024-06-02 14:36:30

- reply

@npub1gye…0k08 Yeah, you can use cloudflare's warp-cli for upstream traffic (mostly requests to other instances) and cloudflared to proxy the external traffic downstream.

2024-05-29 00:59:52

Has anybody created a “Yann LeCun Has a Posse” logo and t-shirt yet?
https://techhub.social/@Techmeme/112519941004777699

2024-05-28 19:39:11

Testing propagation...
Sorry for the noise, but I just migrated my server and need to make sure folks are seeing my posts. Could the first person who sees this post reply to let me know? I'll delete it right afterward.
Thank you. Just totally normal social media things.

2024-03-30 16:47:02

- reply

This back door is the most interesting hack of the year and proves what everybody suspected about the supply-chain risks of OSS. Should hopefully drive some serious investment by the companies that profit from open-source to look for back doors using scalable means.

2024-03-26 18:39:17

- reply

We especially are looking for folks who have run corporate security teams and can help bring large corporate networks up to best-practice. This means deep knowledge of Microsoft's cloud stack, AzureAD/Entra, modern zero-trust networking concepts and cloud endpoint management and response.
Join us!
https://www.sentinelone.com/jobs/?gh_jid=5822009003

2024-03-26 18:39:01

- reply

We're looking for somebody who can help our Global 500 clients both left and right-of-boom. These are some of the world's most important companies, facing the highest level of adversity from commercial and state-sponsored actors, and we work with them at the leadership and technical level to live up to their obligations to their customers, employees, shareholders and societal stakeholders.

2024-03-26 18:38:47

PinnacleOne, the strategic advisory group at SentinelOne that was born out of the acquisition of Krebs Stamos Group, is hiring a technical director!
https://www.sentinelone.com/jobs/?gh_jid=5822009003

2024-03-12 01:00:10

On the latest episode of Moderated Content, @npub1k7z…lde9 and I discuss the TikTok divestment bill and why those who are concerned about TikTok’s PRC ownership (like me, less so Evelyn) should probably not support this specific bill.
In short: the bill has all kind of constitutional issues and creates a strong incentive for Google and Apple to fight it on behalf of TikTok.
Listen here:
https://law.stanford.edu/podcasts/the-netchoice-cases-reach-the-supreme-court/

2024-03-01 22:04:16

Live shot of Rapid7 adding a Connectwise payload to Metasploit on a Friday afternoon.
https://twitter.com/metasploit/status/1763655905084604909
https://assets.cybervillains.com/media_attachments/files/112/022/693/657/550/059/original/adbaf80ab9dff233.png

2024-02-03 00:15:08

- reply

If AnyDesk wanted to help defenders protect against possible abuse of their stolen certificate, they could:
1) Publish the details of their compromised certificate, so enterprises can search across their fleet for installs.
2) Publish a list of known good hashes of AnyDesk releases. If an attacker creates a malicious anydesk.exe only the victim might see it, so it's important to be able to exclude real releases while hunting.

2024-02-03 00:12:48

AnyDesk was popped, with 170,000 advertised users.
They claim their install base is secure, but that the code signing cert was stolen. From the changelog, its clear that they knew this on January 29th but didn't announce until the end of the day on a Friday. Not cool.
Based upon their actions so far, I would recommend all enterprises kill AnyDesk across their fleet using EDR or other means for now until we know more.
https://anydesk.com/en/public-statement
https://anydesk.com/en/changelog/windows

2024-01-26 22:35:21

- reply

@npub1l20…0c0w MY NAME IS NOT QUAID!
https://assets.cybervillains.com/media_attachments/files/111/824/634/926/585/738/original/636950f8d36f607f.png

2024-01-26 22:32:04

- reply

@npub1l20…0c0w Yeah, except if you don't pay Microsoft then you have ongoing risk of breach as long as you use their products.

2024-01-26 22:20:46

I wrote about what the latest disclosure of Russia's successful breach of Microsoft teaches us about the company's dangerous addiction to security revenue, and what Microsoft can do to regain the trust of its customers.
https://www.linkedin.com/pulse/microsofts-dangerous-addiction-security-revenue-alex-stamos-1ukzc/

2024-01-24 17:29:19

A great episode of Risky Business this week, with original news coming from an interview with Rob Silvers of DHS:
https://risky.biz/RB733/

2024-01-21 04:18:31

Niners!

2024-01-21 01:51:22

- reply

@npub13dg…ejem @npub17lg…9uux Not a surprise such a tenant existed, but they don't explain how somebody could crawl from tenant admin on contoso.com to microsoft.com production tenant. Federation? Two-way trust? Some kind of complicated hybrid-mode arrangement?
This is what I want to see documented, partially so the rest of us can protect ourselves! Not a single piece of actionable intelligence in Microsoft's Friday dump.

2024-01-19 22:09:44

Microsoft just announced that they were breached by the SVR, the same Russian intelligence agency that broke into Solarwinds.
This is a big deal, and Microsoft owes all of us a much more detailed description of what happened.
https://msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/

2023-12-31 14:04:10

- reply

The most important flaw discovered was an undocumented hardware feature that allowed the attackers to bypass a good deal of Apple's security protections. Finding and exposing this technique, which would be useful for any iOS exploit chain, is probably causing a lot of heartburn (cough) *somewhere*.
https://assets.cybervillains.com/media_attachments/files/111/675/405/004/406/285/original/3eb4b78de0abf039.png

2023-12-31 14:03:45

This entire video is worth a watch for anybody interested in the cutting edge of mobile exploitation. Impressive work by Kaspersky analyzing an incredible exploit chain and malware platform.
https://youtu.be/1f6YyH62jFE?feature=shared

2023-12-21 02:33:20

- reply

@npub175n…uuxk @npub1rgd…fyzy You should read the paper.

2023-12-20 15:59:06

- reply

Lots of people have worried about CSAM in training sets, including the LAION team themselves, but David actually created a novel mechanism to detect it.
Hopefully this will change the way these training sets are created in the future.
@npub1rgd…fyzy
https://assets.cybervillains.com/media_attachments/files/111/613/571/450/087/116/original/18359c48832f490d.png

2023-12-20 15:58:47

How does Stable Diffusion 1.5 know how to create CSAM? It turns out it was trained on thousands of illegal images contained in the extremely popular LAION-5B image set.
I’m so incredibly proud of my friend and colleague @npub1rgd…fyzy
Story:
https://www.404media.co/laion-datasets-removed-stanford-csam-child-abuse/
Paper:
https://stacks.stanford.edu/file/druid:kh752sm9123/ml_training_data_csam_report-2023-12-20.pdf

2023-11-20 15:48:09

https://assets.cybervillains.com/media_attachments/files/111/443/659/147/959/881/original/fbc512e227f6bdef.png

2023-11-01 19:54:52

Here are some initial takeaways from the Biden AI Executive Order.
https://intel.ks.group/p/ai-executive-order-key-takeaways

2023-10-08 20:06:52

The terrible events of the last 48 hours have made it clear how important social media is during fast-moving historical events.
Sadly, the destruction of the teams Twitter put in place to fight organized manipulation makes it harder for individuals to speak to a global audience as their message gets buried by troll farms, state propaganda organs and grifters.
(This video is a celebration of a football championship in Algeria in 2020)
https://assets.cybervillains.com/media_attachments/files/111/201/157/386/603/511/original/ff042dd7c35c5b14.png

2023-09-28 22:33:33

The highest risk talk at the Trust and Safety Research Conference just started. Pray for us.
https://conferences.law.stanford.edu/tsrc/
https://assets.cybervillains.com/media_attachments/files/111/145/150/702/019/782/original/fb3f6e1027d7caf7.jpeg

2023-09-22 13:52:21

The Stanford Internet Observatory team has updated our work earlier this year on Self-Generated Child Sexual Abuse Materials.
https://cyber.fsi.stanford.edu/io/news/update-sg-csam-ecosystem
Some key takeaways:
1) X’s elimination of academic API access has seriously hampered our ability to fight child exploitation on the platform. Using alternative means, we still found 81 accounts openly selling CSAM on Twitter, as well as advertisements from large companies running beside them.

2023-08-24 23:31:43

I can't believe I'm saying this, but with today’s update Mastodon beat Threads to full-text search.

2023-08-18 19:06:05

Removing blocking from a social media site doesn’t only worsen the experience for almost everybody, but it totally changes the value of a fake account.
If a zero-follower account can continuously reply to large accounts and get engagement, running thousands of those accounts becomes more valuable. This isn’t just about harassment, but also spam. Twitter is becoming a fantastic platform for organized spam and trolling operations.

2023-07-09 00:57:02

Here are meta-results: the engagement on Twitter, Threads and Mastodon for my last post about engagement on Twitter, Threads and Mastodon. Now with more Excel features!
Threads is the winner by a mile.
https://assets.cybervillains.com/media_attachments/files/110/681/405/430/506/274/original/0a6f4091f99c577a.png

2023-07-08 01:17:05

Here are the results of a rather unscientific test of 23 hours of engagement for the exact same thread I posted on Twitter, Mastodon and Threads. The thread was a text heavy, technical discussion of the tech policy issues involving Threads and ActivityPub.
Despite having way more followers on Twitter, the amount and quality of engagement was way worse. Threads shows real promise, but for a serious tech policy discussion the quality of engagement using my own Mastodon server was better.
https://assets.cybervillains.com/media_attachments/files/110/675/821/964/632/776/original/75a2c3c27b11b152.png

2023-07-07 02:34:45

Some more thoughts on the challenge of #Meta #Threads integrating ActivityPub support while living up to their normal obligations.
1) Enforcing actor and behavior-based content moderation will be hard.
All content moderation is either against the actor, behavior, or content (ABC model). With Federation, the metadata that big platforms use to tie accounts to a single actor or detect abusive behavior at scale aren't available (IPs, cookies, JS proof-of-life, TLS signatures, etc).

2023-07-06 17:22:53

The amount of misinformation on Mastodon around Threads and the EU is a great demonstration of how motivated reasoning is not a problem only for commercial social media platforms.

2023-07-04 17:14:55

This is an excellent piece by @npub1e2d…c6dt with analysis from @npub1u69…qfp9.
A perfect demonstration of why destroying the authentication value of the blue check mark was such a huge mistake, and an unfortunate preview of the kind of rage-baiting that is going to dominate our political sphere in 2024.
https://www.washingtonpost.com/technology/2023/07/04/twitter-erica-marsh-suspended/

2023-07-04 00:37:29

The upcoming performance review cycle for the #Meta team that failed to ship #Threads in time to capitalize on the RateLimitPocalypse will, um, not meet expectations.
It’s an amazing whiff: Meta has millions of servers, exabytes of storage, billions of users with current accounts and all of the backend services and people to support a Twitter replacement, but they just can’t get it shipped.

2023-07-04 00:37:29

2023-07-03 16:21:09

- reply

@npub19qm…sn8k “Chinese citizens have their phone backups being turned over to the Ministry of State Security because Apple didn’t threaten the business model of The New York Times Co.” is another dystopian thread in our shard of reality.

2023-06-24 02:24:00

Anybody interested in current events in Russia should be following @npub1fvv…yw2w

2023-06-16 16:41:10

Registration is now open for the second annual Trust and Safety Research Conference!
Registration:
https://www.eventbrite.com/e/trust-and-safety-research-conference-tickets-625692512147
Preliminary agenda:
https://conferences.law.stanford.edu/tsrc/agenda/

2023-06-07 14:07:11

Over the last several months, our team at the Stanford Internet Observatory has been exploring the phenomenon of self-generated child sexual abuse material (SG-CSAM), the commercial sale of CSAM created by or with the assistance of teenagers themselves.
We explored a network of hundreds of sellers and tens of thousands of buyers. The most important platform for this trade is Instagram, as well as Twitter, Dropbox, Telegram and gift card trading sites.
Our blog post: https://cyber.fsi.stanford.edu/news/addressing-distribution-illicit-sexual-content-minors-online

2023-06-05 14:20:26

In the course of conducting a large investigation into online child exploitation, our team at the Stanford Internet Observatory discovered serious failings with the child protection systems at Twitter.
This discovery, that Twitter’s systems for stopping the posting of known child sexual abuse material (CSAM) had failed, occurred in the context of a larger project that we will release later this week alongside the Wall Street Journal.
cc @npub1rgd…fyzy @npub17u8…uhnv
https://www.wsj.com/articles/twitter-missed-dozens-of-known-images-of-child-sexual-abuse-material-researchers-say-58d44f7b

2023-04-13 03:56:24

"He seemed very confused and lost as to what to do..."
Um, you perhaps:
1) Call a lawyer
2) Stop talking to your Discord friends
3) Turn yourself in, hopefully in time to avoid the need to replace your front door
This story just gets more and more bonkers.
https://www.washingtonpost.com/national-security/2023/04/12/discord-leaked-documents/
https://files.cybervillains.com/media_attachments/files/110/189/485/856/225/385/original/37d63bfccddccd24.png

2023-04-07 20:40:33

- reply

#[0] It’s a very different pathology on Substack, where the need to constantly tell your paying subscribers what they want to hear serves as your editor.

2023-04-07 01:11:39

I recommend watching this whole video of Mehdi Hasan and Matt Taibbi.
https://www.youtube.com/watch?v=a597e6Wv_xg
Mr. Taibbi decided to pre-emptively retract three of his many false statements about EIP, and then un-retract one. Here are the facts about that claim:
https://twitter.com/alexstamos/status/1644093075441201153