Maxime Arthaud

Facebook Product Security Engineer and former NASA Engineer. Interested in Static Analysis, Security, Compiler, CTF (pony7). Main developer of IKOS.

[the_storm @the_st0rm]

I am thrilled to announce that I will be presenting @BlackHatEvents
"Do You Speak My Language? Make Static Analysis Engines Understand Each Other"
https://t.co/709XlQpoCZ

Using static analysis to find security bugs cross-language and cross-repo
#BHUSA

[Engineering at Meta @Meta_Engineers]

Mariana Trench is an open source static analyzer written to detect and prevent security issues in #Android and #Java applications. It can review large codebases, provide feedback to engineers, and detect bugs before they are introduced into a codebase. https://t.co/R0F3iFSfOR

[Maxime Arthaud @MaximeArthaud]

Hey @lenovoUS, please follow the CAN-SPAM Act and stop sending me marking emails after I unsubscribed from it more than a month ago. This is becoming infuriating.

[Graham Bleaney @GrahamBleaney]

CVE-2019-19775 - The first CVE found by Pysa, during some work @the_st0rm and I did. Hopefully the first of many. https://t.co/OU7NCp4nv1

[Anastasia Mavridou @anmavrid]

The deadline for submitting your paper at the 12th NASA Formal Methods Symposium is approaching. Do not miss the chance to contribute your work. https://t.co/evbVfo5ifw #NFM2020

[Maxime Arthaud @MaximeArthaud]

@shafikyaghmour You meant "creates" real bugs. I think Clang should generate a proper warning since this could be hard to debug.

[Anastasia Mavridou @anmavrid]

The NASA Formal Methods Symposium (NFM 2020) Call for Workshops is out! https://t.co/HirthvPVby Looking forward to receiving your proposals! #NFM2020

[Tavis Ormandy @taviso]

I'm publishing some 🔥 research today, a major design flaw in Windows that's existed for almost *two decades*. I wrote a blog post on the story of the discovery all the way through to exploitation.
https://t.co/1DFW2VGQRb

[Maxime Arthaud @MaximeArthaud]

@johnregehr It's also funny to notice that "i" has type int and not unsigned..

[Local Man 🎯 @KiddBubu]

rather than do

if (condition){
dothis();
} esle {
exitGracefully()
}

do this instead

if (!condition){
exitGracefully()
return;
}
doThis()

Benefits
- easier to understand.
- less braces to mess up
- less nesting of blocks

[Maxime Arthaud @MaximeArthaud]

@ericwastl Too late: https://t.co/9W2OBMBrsO

[Charles Fol @cfreal_]

Apache Local Root: CVE-2019-0211: Vulnerability description. Exploit will come later.
https://t.co/5ch5lSImx3

[Maxime Arthaud @MaximeArthaud]

@jfbastien That gets() in bash scares me: https://t.co/YXW4dOyVE1

[LiveOverflow 🔴 @LiveOverflow]

I never thought I would experience a XSS on Google Search. But @kinugawamasato blew my mind!

This is a video going over the difficulties of sanitizing HTML in JavaScript.

https://t.co/T61VJJEuDE

[Luan Herrera @lbherrera_]

It's finally out! A detailed explanation on how I could've performed a XS-Search attack on Google's bug tracker to find out vulnerable source code

https://t.co/QpgjGr8yNo #BugBounty @GoogleVRP

[Maxime Arthaud @MaximeArthaud]

Infinite loop in bash:
#!/bin/bash
echo "echo loop" >> $0
echo "$0" >> $0

[Maxime Arthaud @MaximeArthaud]

@willkirkby

[Francois-Guillaume Ribreau @FGRibreau]

This projet defeat ReCaptcha with 91% accuracy 🤩. How? You might ask. They ask for the audio challenge, dl the mp3, forward it to Google Speech2Text API and submit the answer back... and it works 🤦🏻‍♂️ https://t.co/VRIs5L8zSM

[Maxime Arthaud @MaximeArthaud]

There have been a lot of interesting comments on reddit:
on r/c_programming: https://t.co/yocNEjAVaq
on r/programming: https://t.co/gLXm5GACCV
on r/cpp: https://t.co/73AwoiueMX
on r/rust: https://t.co/saTN6JvFCs

[Maxime Arthaud @MaximeArthaud]

Just released IKOS 2.1: https://t.co/rXEoI5YbLi
IKOS is a sound static analyzer for C and C++ based on LLVM.