BEDNAR~1 (Now on @[email protected])

Programmer, maintainer of Termux PRoot, Android bug hunter, driver assistance systems (ADAS) testing at work, they/he, @[email protected]

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

Published my writeup and exploit for installed app to system privilege escalation on Android 12 Beta through CVE-2021-0928, a `writeToParcel`/`createFromParcel` serialization mismatch:
https://t.co/dM4alCS9j2

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

Published new writeup, in which I show bypass for Intent validation inside AccountManagerService on Android 13 despite "Lazy Bundle" mitigation

https://t.co/fCSCTaoYlD

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

Published writeup and exploit for CVE-2022-20452, privilege escalation on Android 13 via Parcel use-after-recycle()

https://t.co/ZQe1kHU3jI

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

Trying out Mastodon: https://t.co/vTEGgSOqS8

(No idea where I'll be active, I'm rarely active anywhere, although I'll probably have some cool writeup in about month, will post announcement to both if nothing collapses)

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

TIL about C++ chrono default constructors:

This defaults to zero (epoch):
std::chrono::steady_clock::time_point a;

This defaults to whatever memory was there:
std::chrono::steady_clock::duration b;

https://t.co/qMdGdjQo7w

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

[Old bug, CVE-2018-9492] On Android 8 and 9 apps could grant themselves access to any ContentProvider through use of FLAG_GRANT_PERSISTABLE_URI_PERMISSION, which made system skip checking if caller itself has permission which is being granted. Fix commit: https://t.co/GKcShaUcyZ

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

@_bagipro Long time ago there was ThreadLocal in ActivityManagerService that overridden ALL permission checks done under IActivityManager.openFile, later after my report this was restricted and it only affected ContentProvider.openFile: https://t.co/0odQYte0H4

[Sergey Toshin @_bagipro]

Bypassing ContentProvider.openFile() internal security checks in Android

[1/3]
I've discovered an interesting trick that you may use to access private information using a content provider

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

@_bagipro Later this was changed to use AttributionSource but behaviour regarding custom enforceCallingPermission remained https://t.co/YW59os8xvL

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

@_bagipro That introduced behaviour you've described, old one could be used to perform AppOpsManager.setMode using media_server permissions (So I'm partially at fault for what you're describing here)

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

@gynvael https://t.co/HtsT4fOB32

TL,DW:
>>> t = ([],)
>>> t[0] += [1]
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
TypeError: 'tuple' object does not support item assignment
>>> t
([1],)

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

@foxgirl_IRL No, I mean that is it that "var randomSel" inside while is different variable (due to extra "var", shadowing outer variable) and outside while "randomSel" stays the same (?)

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

@foxgirl_IRL Is this about randomSel being shadowed inside while? (I don't know Haxe but this looks suspicious and in alt-text you didn't point that)

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

@foxgirl_IRL asciiquarium

[Toby @xenotrope]

The important thing here isn't to poo-poo new tools, it's to share.

I just learned about "ss -plant" a year or two ago and it makes "netstat -na | grep LISTEN" or lsof unnecessary.

[Lynn (finally free) @chordbug]

“Is this the simplest (and most surprising) sorting algorithm ever?” https://t.co/ucjbOCh0mA

Abstract:
We present an extremely simple sorting algorithm. It may look like it is obviously wrong, but we prove that it is in fact correct.

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

@foxgirl_IRL Although other effect of using shared server was that there was time when fork-bombs were breaking everything for everyone

There were class where we were writing programs with fork(2) and many made one by mistake

[BEDNAR~1 (Now on @[email protected]) @BednarTildeOne]

@foxgirl_IRL Yeah, we had that at university, students were write(1)-ing messages to annoy other classes