Yaniv David

Program analysis, Security & Systems. Assistant Professor @ Technion. Reverse Engineer. Developer.

[Kostas @Kostastsale]

Regarding the xz backdoored binary, see the one-liner below to check the version you have installed.

**I wouldn’t suggest folks running the malicious binary with -v option🫠🫣

for xz_p in $(type -a xz | awk '{print $NF}' | uniq); do strings "$xz_p" | grep "xz (XZ Utils)" || echo "No match found for $xz_p"; done

Some systems might have two different versions installed (i.e. if you have homebrew). The above command will check both. You can run the which command if you want to see which binary would run by default upon being called interactively. Good luck! 🙏

[Yaniv David @YanivDa]

@urialon1 @GoogleDeepMind @denny_zhou Congrats 🥳!

[Yaniv David @YanivDa]

TIL about `nvitop` (https://t.co/XdbzHbMcIp)
A super useful tool for monitoring GPUs

[Andreas Zeller @AndreasZeller]

@mboehme_ Where exactly is that park? I’d like to run a replication study :-)

[Yaniv David @YanivDa]

This is my account on Mastodon - YanivDa_at_infosec.exchange - verified by @twittodon_com https://t.co/2lPHjFLxkc https://t.co/fArav0pKtz

[Lex Fridman @lexfridman]

Back in my day...

[Conf42 @conf42com]

⚙️ "Going Beyond Metadata: Why We Need to Think of Adopting Static Analysis in Dependency Tools" - a talk by @jhejderup Endor Labs at #Conf42 DevSecOps 2022!

👉 Free RSVP: https://t.co/4H2FDv7rf6

✨Join us online on the 1st of December!✨
#online #conference #DevSecOps

[Yaniv David @YanivDa]

"There’s a bug in my bug!" Cool vuln walk-through for SQLite. Bonus: Compiler decisions almost prevent exploitation!

[Trail of Bits @trailofbits]

Our strange journey to finding the vuln started with a vulnerability in PHP that seemed like the perfect candidate for a variant analysis. So then we dove into SQLite string formatting: https://t.co/vDsZKqvsoi

[Manuel Rigger @RiggerManuel]

Please share! @xwangsd and I are looking for artifact evaluation committee members for PLDI '23. You can either nominate yourself (see https://t.co/EoB3NM07xw) or a student/colleague (https://t.co/VtymoprCwI). Help make science better! cc @PLDI

[Brendan Dolan-Gavitt @moyix]

Proposal: PhD-level course in "how to get stuff to build and run". The final exam assigns you a random GitHub repo for a paper from no less than five years ago and asks you to get it running within 24 hours

[eBPF Summit @eBPFsummit]

Stateful + eBPF?

@zhong_yuhong breaks down how to do it @eBPFsummit

[Can Bölük @_can1357]

@BiophysicsFL @katiedimartin

[Oddvar Moe @Oddvarmoe]

This is so true 🤣

[Asaf Cidon @asafcidon]

Attending @MLSysConf? Check out the presentation today by my brilliant student Wei Hao (@HaoWh2473). He will talk about how adapting ML models to mobile devices complicates the lives of MLOps teams by making it hard to debug model performance

[Arrigo Triulzi @cynicalsecurity]

Is there an official complaints desk if you don't like the APT name you are assigned?

[Yaniv David @YanivDa]

@zeshan_nobin A good resource written by @michael_w_hicks : https://t.co/bqEncgM75K . The example is for a PL paper but is otherwise relevant for every field.

For NPL-specific tips, maybe try looking at other open rebuttals in https://t.co/xlUCMdxlpw and see what works?

Good luck.

[Ivan Gotovchits @ivg_t]

CMU Binary Analysis Platform (BAP) 2.5.0 is out! We now have scalable floating-points enabled by default and bap is now much much faster (x2 or even x3)! Lots of other new features, in one of the biggest releases. Check it out:
https://t.co/GOBvyVN0mI

[ColumbiaCompSci @ColumbiaCompSci]

Congrats to our Software Systems Laboratory group for winning a Best Paper Award at the @usenix OSDI'22. Six papers from the department were accepted to the conference. Find the abstracts here: https://t.co/U335k13CIM

[Yaniv David @YanivDa]

I am excited to present our work "UPGRADVISOR: Early Adopting Dependency Updates Using Hybrid Program Analysis and Hardware Tracing" in #OSDI22 at 3:15 PM PDT!