VulnerabilitiesrUs

Likes to learn how things tick. I am a security researcher protecting everyone. PC, Console, Mobile, vulnerability researcher; music producer. @DawnDevTeam

[VulnerabilitiesrUs @TempAccountNull]

Today, we identified a previously unknown vulnerable driver in the latest update of the software, resulting in a local privilege escalation (LPE) on the latest version tested.

The issue allows a standard user to escalate privileges to NT AUTHORITY\SYSTEM.

The impact does not stop there. We have also confirmed read/write capabilities affecting both physical and virtual memory, alongside additional issues that are still being investigated.

At this time, technical details and the PoC are being withheld while we work to establish a valid coordinated disclosure path with the affected vendor.

If either disclosure platform can help connect us with the appropriate security team, please get in touch. Our goal is to ensure the issue can be responsibly reported, addressed, and users can be protected as quickly as possible.

@Bugcrowd @BugcrowdSupport @Hacker0x01 @kernullist @horsicq @weezerOSINT @0XDbgMan @mrexodia @kernelstub

#togetherwehack #LPE #ResponsibleDisclosure #BugCrowd #BYOVD

Stay safe out there. There's more lurking in the shadows.

0x21ED7623CB59A7A073D143A1222DCD31AAF01FC46E2D24A683D1C085DACB3CD8

PoC video below.

[isinternets @isinternets]

the goat raz does it again. forge in dawn

[Haxx @Haxxington]

Treasure awaits below. It calls to you, yes?

[Haxx @Haxxington]

If you know what this place is, you're a real one

[Dawn @DawnDevTeam]

Did someone say Forge?

[Millie @Nyxaraaaa]

Dawn - When I said last week I'd been rewriting the backend to make everything easier; this is the culmination of that work so far!
Patrols, Public Events, Lost Sectors, Region Chests, Destination Chests and Materials!
Aswell as this, curse cycles are in, I hooked Dawn up to the steam API for use of social features, moved a ton of stuff over to the client to host, increased tickrate across the board to 30hz, and implemented a client desirability metric for seamless host transition if/when we decide to bring multiplayer in.

Lots of work to be done, been a busy week! You've seen what the rest of the team have been cooking too, more to come!

[VulnerabilitiesrUs @TempAccountNull]

Update #3: https://t.co/L5DVRMwjiQ

[Kyle @KyleThmpsn]

golden bomb ez @LukeCB14

[VulnerabilitiesrUs @TempAccountNull]

Guardians, here's a look at what Kyle and I have been working on behind the scenes. More to come. What do you think? #Destiny2 #Guardians #Dawn #ProjectSunrise

[VulnerabilitiesrUs @TempAccountNull]

Update: https://t.co/L5DVRMvLti

[Kyle @KyleThmpsn]

golden bomb ez @LukeCB14

[VulnerabilitiesrUs @TempAccountNull]

Hey guardians! Good news!

Me and Kyle finally figured out multi-bubble things, so here's one from late last night of Sword Base, please keep in mind though guardians, that this is still wip. There's so much more to come in the future!
Note: The Lighting and decals are not perfect but, it's starting to come together.

Till we meet again, Guardians.

https://t.co/PY5rGlbni4

#Dawn #Sunrise #Reach #Destiny2

[VulnerabilitiesrUs @TempAccountNull]

Guardians, here's a look at what Kyle and I have been working on behind the scenes. More to come. What do you think? #Destiny2 #Guardians #Dawn #ProjectSunrise

[VulnerabilitiesrUs @TempAccountNull]

@AreYouFlummoxed @KyleThmpsn @LukeCB14 Well; we’ve been super busy what can I say!

[Kyle @KyleThmpsn]

golden bomb ez @LukeCB14

[Centro LEAKS @CentroLeaks]

A second Switch 2 exploit has now been revealed.

There's also apparently a third one already discovered on a physical cartridge that also allows userland code execution.

[Raz @aimbotRaz]

Destiny 2 forge - Super early WIP

[soul @chnsvw]

The H.E.L.M. in Pre Beyond Light
https://t.co/tz8UrJkpFl

[isinternets @isinternets]

wrath on the new engine would be really funny wouldn't it

[soul @chnsvw]

In my dreams I see this place
https://t.co/tz8UrJkpFl

[Kyle @KyleThmpsn]

slipspace rupture detected

[Kyle @KyleThmpsn]

what's your favorite Reach weapon?

[VulnerabilitiesrUs @TempAccountNull]

@squashidk @isinternets @NuCaloric Not currently ready, there's a few things that need to be polished first. Especially, lighting. Lighting is of very poor quality, and you guys deserve the best quality before it gets released.

[isinternets @isinternets]

yes. you will start off with only the D1 director and as you progress through the story more and more shit gets done. Exotics will be updated to be modern (we have a buncha fellas that working on balancing and qa). The video was a super early sneak and not at all closed to the finished product, lighting is unfinished, armor is unfinished. There is no world where we release this as a product as is.

[Dawn @DawnDevTeam]

I can't wait to go fishing
https://t.co/cJxDebX9jh