0xsysenter

[0xsysenter @0xsysenter]

New year, new blog! I am pleased to announce my personal blog is now online at: https://t.co/Eu0UoQiTeZ. If you are into reversing and/or iOS, there is already a mini-series of 3 posts regarding iOS apps reverse engineering. More posts and topics will be added in the near future!

[Exodus Intelligence @XI_Research]

We’re opening the Exodus research vault.

Over the coming weeks, we’ll publish technical writeups highlighting vulnerability research, exploit development, and deep reverse engineering from our team.

First up: Michele Campa’s Adobe Acrobat Reader Escript.api use-after-free RCE.

https://t.co/iycMuZQLix

#VulnerabilityResearch #ExploitDevelopment #ReverseEngineering #OffensiveSecurity #CyberSecurity

[OtterSec @osec_io]

We achieved a guest-to-host escape by exploiting a QEMU 0-day where the bytes written out of bounds were uncontrolled.

Full breakdown of the technique, glibc allocator behavior, and our heap spray/RIP-control primitive ↓

[Robert Sterling @RobertMSterling]

I don’t want to connect my coffee machine to the wifi network. I don’t want to share the file with OneDrive. I don’t want to download an app to check my car’s fluid levels. I don’t want to scan a QR code to view the restaurant menu. I don’t want to let Google know my location before showing me the search results. I don’t want to include a Teams link on the calendar invite. I don’t want to pay 50 different monthly subscription fees for all my software. I don’t want to upgrade to TurboTax platinum plus audit protection. I don’t want to install the Webex plugin to join the meeting. I don’t want to share my car’s braking data with the actuaries at State Farm. I don’t want to text with your AI chatbot. I don’t want to download the Instagram app to look at your picture. I don’t want to type in my email address to view the content on your company’s website. I don’t want text messages with promo codes. I don’t want to leave your company a five-star Google review in exchange for the chance to win a $20 Starbucks gift card. I don’t want to join your exclusive community in the metaverse. I don’t want AI to help me write my comments on LinkedIn. I don’t even want to be on LinkedIn in the first place.

I just want to pay for a product one time (and only one time), know that it’s going to work flawlessly, press 0 to speak to an operator if I need help, and otherwise be left alone and treated with some small measure of human dignity, if that’s not too much to ask anymore.

[Ivan Fratric 💙💛 @ifsecure]

Don't panic now, but LLM-based agent discovered a previously unknown real-world vulnerability. Details in https://t.co/AS4V0J4Mcp

[TrendAI Zero Day Initiative @thezdi]

In a new guest blog, @cogallag describes the bug he used to exploit #Oracle #VirtualBox at #Pwn2Own Vancouver. He gives an in-depth analysis of how he used a race condition to win $20,000 at the contest.
https://t.co/yrgXTCj2HV

[Maddie Stone @maddiestone]

We're naming names 🔥 because the harm is not hypothetical.

Today we share "Buying Spying", our new report diving into the commercial surveillance/spyware industry. We dive into the players, the campaigns, the spyware, & the harm it perpetuates.

https://t.co/D8Lx4wRrw6

[0xor0ne @0xor0ne]

Excellent writeup by @saidelike on exploiting a use-after-free in Linux kernel 5.15 (Ubuntu 22.04) (CVE-2022-32250)

https://t.co/NKTlRmplK6

#Linux #kernel #cybersecurity

[Pedro Ribeiro @pedrib1337]

Behind Great Walls: LPE in openKylin, a Chinese distro used by large corporates and gov institutions in China 🤠

https://t.co/PeJDfDCnrd

[Alex Plaskett @alexjplaskett]

Jailbreaking the Sonos Era 100

https://t.co/CQeOagTCFf

The Era 100 is Sonos’s flagship device, released on March 28th 2023 and is a notable step up from the Sonos One. @NCCGroupInfosec found multiple weaknesses within the bootloader which could lead to full compromise

#sonos

[Maddie Stone @maddiestone]

🪲 New RCA up for CVE-2021-4102 by @btiszka! It's a wild one in Chrome's Turbofan #itw0days

https://t.co/Vr5Wj6aLSu

[Alisa Esage Шевченко @alisaesage]

Lots of universal patterns in vulnerability research, which can inform ultra efficient bug hunting.

By way of abstract level knowledge, one tiny tip can suddenly boost your workflows and bring much success
https://t.co/RZCcJt6Llc

[j j @mistymntncop]

Flattered that someone did a writeup for the 2nd hole exploitation technique I used for my CVE-2023-2033 exploit (Korean). Shoutout to the author "Rotiple_"
https://t.co/w6PrZ2Eezl

[Bill Marczak @billmarczak]

NEW: Kaspersky releases full details on how they captured the “Triangulation” (suspected US Government) exploits and iPhone spyware targeting their employees. https://t.co/Krladw07eD

[Kev @kevin_backhouse]

This video shows my PoC for libssh CVE-2023-2283 (authentication bypass vuln). The attacker logs in with ED25519 authentication, despite not knowing the private key.

[Alex Plaskett @alexjplaskett]

If you missed @saidelike and my @offensive_con talk on Exploit Engineering - Attacking the Linux Kernel it is now up on https://t.co/cGGbit08yZ

Slides: https://t.co/x6XafuC86R

#OffensiveCon23

[Hossein Lotfi @hosselot]

Apparently, recent Apple Safari in the wild full chain exploit used 3 vulnerabilities:
1/3- Information disclosure within "RegExpGlobalData::performMatch" (CVE-2023-28204):
https://t.co/wOy4Rctzhl

This vulnerability is potentially used to leak information to adjust shellcode.

[Maddie Stone @maddiestone]

Here are the slides from @tiraniddo and my talk, "The Print Spooler Bug that Wasn't" this morning at @offensive_con. We take you through our investigation into CVE-2022-41073, an in-the-wild 0-day that Microsoft patched in Nov 2022. #OffensiveCon2023
https://t.co/nM1T5a5XoR

[Moshe Kol @0xkol]

Here are the resources for my talk "Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel" at @offensive_con today.

Write-up: https://t.co/PlA8ailV90

Slides: https://t.co/kZSHsixM4X

PoC for CVE-2022-20421: https://t.co/Pi8qQhJQIZ

#OffensiveCon2023

[Michael Maltsev @m417z]

Leveraging XFG to help with reverse engineering, can your favorite reverse engineering tool do that?
https://t.co/zk3GWyzfiS