Chai Yichen

U-uwawa uwa

[『ちいかわ』アニメ公式 @anime_chiikawa]

⭐️明日放送⭐️

TVアニメちいかわ第348話

フジテレビ系列「めざましテレビ」内にて
6月2日(火)7時36分頃放送予定💕

(放送終了後に「めざましテレビ」のYouTube、FOD、TVerにて1週間限定見逃し配信あり／第1〜5話はしばらくの間無料で配信します)

お楽しみに♪

#アニメちいかわ
#ちいかわ

[Thomas H. Ptacek @tqbf]

More frontier model vulnerability research news.

[HACHIWARE LOVER!!! #1 @OomfieLoomfie]

King must NOT bow to someone🔥🔥🔥

[Symbolic Software @symbolicsoft]

Today we're releasing hpke-ng: a clean-slate Rust implementation of HPKE (RFC 9180) and a drop-in replacement for Cryspen's hpke-rs, the subject of our critical nonce reuse vulnerability discovered in February.

Faster, smaller and more hardened than hpke-rs across every metric.

[Chai Yichen @Hacker_Chai]

Advanced LLMs have really made plenty of fools look smart. Emphasis on "look smart", it's not too hard to see through it

[Sacha @SachaKozma]

With @Hacker_Chai we just published our second blog post on Samsung security research! This one is about a local arbitrary APK install in Galaxy Store, combining a few vulns like a broken signature check, a file write, etc. Check it out here: https://t.co/nJkAr9gmjJ

[Chai Yichen @Hacker_Chai]

To those interested, I mainly focus on the memory corruption side of vulnerability research / exploit dev, but after this Samsung stuff I also have a bit of experience with Android (i.e. Java, JNI, binder etc.)

[Chai Yichen @Hacker_Chai]

Our second blog post is out here: https://t.co/mUjTMFpVqN ! We managed to install arbitrary APKs on the Samsung Galaxy S25 from an app without install permissions. For this, @SachaKozma did most of the work, but it was great looking into Samsung's cloud gaming component with him

[Chai Yichen @Hacker_Chai]

From the looks of it, cloud gaming (i.e. games running on the cloud, streamed to your phone) may be coming in future for Samsung phones 👀. Idk what it's like now, but more stuff is being added

[Chai Yichen @Hacker_Chai]

Credit where credit is due. https://t.co/LxsRs8qtUY and https://t.co/8BbcDSV7oQ look much more interesting

[Chai Yichen @Hacker_Chai]

*free and pointer discarding. The dangling pointer exists for a fleeting moment during packet processing before it's gone. You'd think that's a memory leak then, but the ptr if not freed then is freed somewhere else, iirc. mbufs are kinda cool and my memory's hazy

[Chai Yichen @Hacker_Chai]

Revising this UAF I found a while back in FreeBSD's pf firewall: https://t.co/3LzOQPc86m . Unlike some who find bugs in components nobody has touched for years with Claude and parade them around like they've found the bug of the century, we find bugs in code people actually use

[Chai Yichen @Hacker_Chai]

Sadly, this one's probably unexploitable; couldn't find a way to extend the gap between free and realloc, and FreeBSD's UMA allocator is not a fan of zone crossing, which means we most likely can only replaced the dangling mbuf ptr with another mbuf

[Chai Yichen @Hacker_Chai]

*Revisiting dammit iOS

[Chai Yichen @Hacker_Chai]

Did I mention I still have a remote kernel panic against all FreeBSD Wi-Fi users (again probably quite little). You're connected to Wi-Fi, receive my wireless frame, bam, panic. Marked duplicate (the previous guy barely had a PoC), not fixed

[Chai Yichen @Hacker_Chai]

I know these stuff are old news, but I just recalled some of the minor bugs I found in FreeBSD in the past. If I had a PR team, each of these could be an "impressive find in a highly secure OS"

[Chai Yichen @Hacker_Chai]

Sure hope money in banks are safe with the FCA's wonderful talents

[Chai Yichen @Hacker_Chai]

Check out my GOAT Sacha at @SachaKozma and go follow him! His blog is at https://t.co/uIH7lwwdSb !

[Chai Yichen @Hacker_Chai]

@leonjza @bugscale @1ns0mn1h4ck @SachaKozma Thank you for coming, glad you liked it!