Social media and "cybersecurity experts" had a big role in this. Stuff like "EU SAYS THIS IS A URGENT VULNERABILITY" and even the Prime Minister of Japan doing a nighttime PSA. They cite "the experts" posts on social media about the initial advisory, while the very same so-called experts share google search AI output mitigation strategies. None of these organizations or bodies had any details other than what was on the advisories and social media. (e.g "CVSS 10, that's bad!!")
To me, it seems more more akin to broadpwn, technically severe, wide scope (millions of iphones), yet will never be a one-size-fits-all-PWN-button.
Even in the age of AI, I don't think this is going to be weaponized down the line like how Eternalblue was... but I'm not the social media cybersec guy with 15000 followers, so don't take my words at face value ;)
I feel like half of working in the cybersecurity industry is just cultivating your social media persona. It's bizarre. I left a viral up-and-coming startup over it. It was mixing into everyone's personas at work in weird and uncomfortable ways, as someone who doesn't use traditional social media.
you'll find egomaniacs in any industry. From experience the people who actually speak regularly at cybersecurity conferences do tend to have a "cult of personality" aura about them. Part of it is industry incentives too. If you have a bunch of stuff on Github / technical blog posts / social media presence it helps a lot finding a job. So I wouldn't necessarily entirely blame them for cultivating a social media persona.
It’s unfortunate but you’re correct.
There are a few “social media famous” cybersecurity folks really worth their salt who didn’t immediately dumpster their morals and skills at the first sign of an ego boost.
People like Krebs, Allison Nixon, Joanna Rutkowska.
Most of them though are just addicted to likes as it’s become a core part of their self worth.
Most cybersecurity is performative, like war, cybersecurity is mostly boring and if you are doing your job, zero drama. If you want to stand out you need piercings and hot takes.
I would argue that Krebs is exactly the type of guy who will do anything for a good story, whatever it costs. I saw him lying more than once and this eroded my trust completely.
I think you’re talking about Brian Krebs while the person you’re replying to is talking about Chris Krebs.
Both of them are well known in cybersecurity but are very different people with very different reputations.
Would you have examples to share? I'm genuinely curious.
Marketing, for a while, has been about the personalities of the people involved - socMed just amplifies that
Not everything needs to be abbreviated
I actually rather like 'SOCMED', given that social networks these days can be weaponized in various ways, so it deserves a name akin to 'OPSEC' and other military-like terms