Tal Lossos

Security Researcher

[Tal Lossos @TalLossos]

@antoniozekic I doubt it as well. Reported a remote DoS a few months ago and got a reply that it isn't a "security implication"

[Tal Lossos @TalLossos]

@Guluisacat Same here!
Two marked as “addressed”, but one of them is still exploitable with the exact same PoC :)

[Tal Lossos @TalLossos]

@karmaz95 And there is the case when they agree that the reported issue is a vulnerability, they fix it but don't grant a CVE 🙃

[Tal Lossos @TalLossos]

@karmaz95 This happened to me as well. I reported a TCC bypass to Apple and they replied that it is an "expected behavior" for some reason...

[Tal Lossos @TalLossos]

Happy to share that some of my reports were fixed in the new macOS version :)
https://t.co/jNKNR8Rpe8

[Alon Zahavi @Alon_Z4]

Had an amazing experience at @1ns0mn1h4ck this year, talking about adding NVMe-of/TCP to syzkaller.

In case you want to check it out:
Here’s the recording - https://t.co/7waJkjcg8A
And the slides - https://t.co/FosaAhYvc4

[Tal Lossos @TalLossos]

Quite a few people asked me if we’ve found more vulnerabilities in the NVMe Linux kernel driver. So, here is my answer!
Check out the blog post of my colleague Alon on his journey of fuzzing the driver with some lovely findings!

[Alon Zahavi @Alon_Z4]

Be sure to check out my recent blog about my latest research “Your NVMe had Been Syz’ed”. In there I show how to add new subsystems to syzkaller, and how to use it to find new vulnerabilities.

https://t.co/7qqyhm0YPF

[Shak Reiner 🍍 @ShakReiner]

Finally got around to publishing this post on a 𝙘𝙧𝙞𝙩𝙞𝙘𝙖𝙡 𝙫𝙪𝙡𝙣𝙚𝙧𝙖𝙗𝙞𝙡𝙞𝙩𝙮 𝙞𝙣 𝙖 #𝗖𝗼𝘀𝗺𝗼𝘀𝗦𝗗𝗞 𝙘𝙝𝙖𝙞𝙣!
Dive in if you're interested in the security of the #IBC protocol and the Cosmos in general 🪐✨

https://t.co/Xla0lEhSOS

[0xor0ne @0xor0ne]

Interesting reading on how to use Static Code Analysis tools for finding vulnerabilities (with a NULL Pointer Dereference in the NVMe driver of the Linux kernel as practical example)
Credits @TalLossos (@TalLossos)

https://t.co/ImxV7XyZ2r

#Linux #kernel #infosec

[CyberArk Labs @CyberarkLabs]

Check it out! Our resident expert reverse engineer @TalLossos giving his talk on at REcon Montreal.

Topic: Vulnerabilities in the NVMe (Non-Volatile Memory Express) protocol and its extension, NVMeoF (NVMe over Fabrics).

[Tal Lossos @TalLossos]

The recorded session of my talk at @reconmtl is live!
https://t.co/GlrgvQGXZV

[awxylitol @awxylitol]

#HITB2023HKT
The blog post version of this talk is now available https://t.co/7O4VlFjLui and the slides are here https://t.co/Bex0mNDiYn

[LaurieWired @lauriewired]

Did you know that NVMe over TCP exists? I sure didn't, but it's a super interesting attack vector.

@TalLossos just put out an excellent blogpost of using CppCheck to find a null pointer deference in the Linux kernel’s NVMe driver. Check it out!

https://t.co/jxvlA0hkSR

[Tal Lossos @TalLossos]

A deep dive into how we've found some cool low-hanging-fruits in the Linux kernel 🐞🔍https://t.co/ANXrs8watc

[Tal Lossos @TalLossos]

Very excited to present my talk at @HITBSecConf !
Cya soon :)
https://t.co/pQPVc9BWaB
#HITB2023HKT

[HITBSecConf @HITBSecConf]

#HITB2023HKT NVMe: New Vulnerabilities Made Easy - Tal Lossos - https://t.co/GeLZk4T7io

[REcon @reconmtl]

Recon 2023 Talk selection has been released, https://t.co/6claXNMpJx The Conference schedule will be published soon. Register here: https://t.co/ZSllUboiiu See you in June!
#cybersecurite #REcon2023 #ReverseEngineering

[CyberArk Labs @CyberarkLabs]

.@TalLossos explaining how he's exploiting 3rd party kernel modules.
In this case, OpenRazer...

#RSAC2023 #opensource #bufferoverlow #fuzzing

[Tal Lossos @TalLossos]

I'm excited to share that I will present one of my latest projects at @reconmtl !
Stay tuned and cya there :)

[REcon @reconmtl]

We are proud to announce Tal Lossos @TalLossos as a speaker for Recon 2023! Thanks a lot for your contribution!
See full talk description here:https://t.co/EauAHWDgvq #ReverseEngineering #REcon2023 #cybersecurite

[Tal Lossos @TalLossos]

Had a blast.
You should definitely check it out if you wanna see how I've exploited it to a LPE, in a colorful way of course 🔴🔵🟢🟡

[NULLCON @nullcon]

🔴🔵🟢🟡Colorful #vulnerabilities on your ⌨️keyboard!

💡Tal @TalLossos & Eran @EranShimony shared their analysis & investigation of Razer's #Linuxkernel module, followed by finding several #0day bugs with a live demo

🍿Enjoy the talk▶️https://t.co/wE1tCnTqau

#NullconDE2023

[Tal Lossos @TalLossos]

@LiveOverflow inb4 macOS