Teri Radichel
@teriradichel
2nd Sight Lab. Cloud, AI Assisted Pentesting. Security and Technology Research. AWS Security Hero . Author on Amazon. Former IANS, SANS faculty. GSE. Masters Software & Infosec.
No time to blog but here's this: Visual ~ can write scripts to deploy resources on AWS with any method I want including an agent without giving access to deployment mechanisms. Can rearrange my org structure, rename, move things around.
Tracker diagram works. Now I can deploy in parallel and see what got deployed or failed. And I can rearrange and redeploy. More than this deployed but I deleted my tracker file and started over to methodically fix bugs. Models painfully slow and dense but faster than me alone.
1123 bugs fixed this week. 🐞🐛🐜🦟🪲🪳🕷️ By My AI agents. 🤖🤖🤖🤖🤖🤖🤖🤖🤖 But Kiro/Anthropic going so S-L-O-W 🥱 right now. The bug counts will not move as fast as a result. Opus 4.8. Kiro CLI. infosec.exchange/@teriradiche...
I created some VPC Endpoints to keep traffic to AWS services on private networks. I didn’t even create as many as I wanted. As you can see here it is my second highest cost. I shut them down for now. Network layer controls are not the same as application layer controls.
Used up another “$200” plan yesterday. What’s odd is I wasn’t billed the full $200 for each plan, unlike last month where I got billed $200 for a plan I couldn’t use at all. What is also interesting is that my cost per day steadily increased. Not sure if I was just working more.
If I’m working on your pentest right now this is your current line of defense right now.
I’ll write about the architecture AI agents struggle with later on blog. But basically this solves one of the problems with AWS control tower. More later. Progress: github.com/2ndSightLab/...
I started getting like 100 followers every two days on X and I was like wow people must really like my research. But then I started looking at the accounts and it was odd because none of the posted anything. So I looked at their followers and all following mostly the same 9 accounts.
Code Structure For An AI Generated Infrastructure Deployment Script How you structure your code makes it more maintainable and possibly consumes less tokens teriradichel.substack.com/p/code-struc...
Back home. My dog has now been to over 20 states. I’ve been to all 50 and a bunch of them multiple times. Back to work.
In Deadwood, SD this week a lady on the street told us not to pet the fluffy cows. My husband then had to buy this hat. Seeing a lot of fluffy content about AI. 🤖 I’d like to see more deep dives on data flows at all layers of AI products. It seems harmless but is it?
I have to take care of a family member. Headed out to help her for I don’t know how long but hope to be working on AI again soon. Trying to enjoy the scenery along the way waiting for her to get back home.
I noticed the person who suggested I was drinking when I posted these trying to figure out what was wrong with Opus 4.6 has deleted his comment. 😁 Some of us have spidey sense from doing this way too long. When you know you know. Glad they fixed it.
I’ve added links to my presentation on how I use AI 🤖 for pentesting 😈 in this post. Most of the slides have a related blog post and I’ll probably write more about all these topics as I research this further. The PDF has links to related posts. teriradichel.substack.com/p/how-i-use-...
The Computer History Museum is such an awesome place for a conference. Thanks to everyone who came to the AWS Community Day!
Latest scam. Interesting that when I used Apple cleanup to remove the ticket number it didn’t remove it but instead characters from another Arabic looking language showed up instead. This came as an attachment. Took screenshot. I did the cleanup like 5 times and then chars gone.
Humor me for one second. I am doing better than all the celebrities on @espn ~ it won’t last but I’ll enjoy the moment. I used AI to analyze one matchup I wasn’t sure about and stuck to original pick. The rest was me looking at stats and I saw a few games. Decent track record. 🏀
I know it’s only round one, but…how are your brackets doing? I missed a few the first day and thought I was going to do way worse than last year but had a comeback tonight. 🏀
My posts are free for 30 days past the date of publication. I might change that later. We’ll see how it goes. teriradichel.substack.com
Just vibe coded a script to see which AWS GuardDuty features are enabled with Kiro CLI in like a minute. Added a blog post with link to my code on GitHub. This one is in the aws-scripts repository. teriradichel.substack.com/p/code-on-gi...
Another weird thing keeps happening. I randomly see this screen every once in a while after I logged out. Is this legit? With Google login??