ZeusBox

Playing with Pandora's box. Sometimes it's better not to open it. Sometimes, it's better not to know.

[MicrosVuln @microsvuln]

Jit-Picking: Differential Fuzzing of JavaScript Engines (ACM CCS'22)

https://t.co/kvN7cJoW1v

[ZeusBox @Zeusb0x]

@ashtoncirillo Soon the collective west will have to deal with big waves of Ukrainian refugees. Winter is coming. The energy situation is not rosy. If Ukraine wouldn't have violated the international law this wouldn't have happened. They can anytime capitulate and end this mess now.

[reverseame @reverseame]

Understanding the Compound File Binary Format and OLE Structures to Mess with CVE-2022-30190 https://t.co/tIps5TNhDN

[Maddie Stone @maddiestone]

💥 And another new RCA up today: CVE-2022-2294, the itw 0-day in WebRTC that targeted Chrome! Authored by @natashenka

https://t.co/BSDMmx3JJu

[Dreg @therealdreg]

Bochs its now in github https://t.co/86MiXiQy6c we will be glad to see your contribution, Looking for new devs :D

[Theori @theori_io]

Our intern @_qwerty_po was destined to analyze a recent Linux kernel LPE vuln (CVE-2022-32250), a bug found and reported by @FidgetingBits.

Here's a brief write-up on the analysis of the bug and the exploit development. Check it out! https://t.co/hYaClfbEYp (exploit included)

[I.Zhilyakov @m0br3v]

Backdoors in the system partition of budget Android device models target arbitrary code execution in the WhatsApp and WhatsApp Business messaging apps. Devices are counterfeit versions of famous brand-name models

https://t.co/9e2h3ov9US

[Blue Frost Security @bluefrostsec]

New blog post released!
Windows Segment Heap: Attacking the VS Allocator by @_vepe https://t.co/TRnkOS5JqG

[k0shl @KeyZ3r0]

We @KunlunLab will share the vulnerability and exploitation I used in the TianfuCup2021 for escaping Adobe Reader sandbox on #BCS2022, this vulnerability existed in Named Pipe File System for nearly 10 years since AppContainer was born. We called it "Windows Dirty Pipe".(1/2)

[Mobile Security @mobilesecurity_]

Android Universal Root: Exploiting Mobile GPU / Command Queue Drivers
#MobileSecurity #AndroidSecurity
#BlackHatUsa2022 [SLIDES] by @1ce0ear @ExploitDr0id @jon_bottarini
https://t.co/I2HzAWIceT

[Linux Kernel Security @linkersec]

CVE-2022-29582, an io_uring vulnerability

A detailed and well-written article by @Awarau1 and @pqlqpql about exploiting a slab use-after-free vulnerability in the io_uring subsystem.

https://t.co/ZdxXTdN1qm

[Maddie Stone @maddiestone]

Detailed analysis of an Android in-the-wild 0-day exploit developed by surveillance vendor Wintego by Xingyu Jin from Android Security Research team: https://t.co/MCuDkUkZ1y

[ZeusBox @Zeusb0x]

@bitfield It's like chess. Most people can think only a few moves ahead. The bright ones can see the whole game. If you need to hire such a person, leetcode is definitely useful.

[Maddie Stone @maddiestone]

Kudos to Microsoft for this move to share more symbols 👏🏽

https://t.co/eoJnkHbFpS

[ZeusBox @Zeusb0x]

@ejmalrai , not to mention a direction confrontation with the enemies. Look at the Kaliningrad blockade: they acted and then they backed up. The same with Kosovo, and the same will happen with Taiwan. They are thus acting only in the realm of tragic comedy.

[ZeusBox @Zeusb0x]

@realadamqureshi @China2ASEAN The americans have announced their intention to grossly violate the international law. China can do whatever is necessary to protect it's sovereignty and territorial integrity.

[ZeusBox @Zeusb0x]

@NinjaParanoid I believe the guard pages are there to prevent you from reading/parsing the EAT. One can bypass that by walking backwards in memory and looking at page boundaries for the PE header of the main exe/dll. Inspect IAT recursively and use HellsGate to grab syscall id's dynamically.

[ZeusBox @Zeusb0x]

@mmolgtm Some of those with locked bootloaders will build you a statue for this.

[ZeusBox @Zeusb0x]

💥💥Sign extension of bit fields => DANGEROUS.
When comparing signed stuff of different sizes sign extension happens. Since "a" has 1 as the most significant bit, it will be sign extended to -1. For unsigned stuff zero extension happens and we don't have this issue.

[Tim Misiak @timmisiak]

PSA: The BOOL type is a signed integer. So if you define a single bit bitfield of type BOOL, it will be "-1" when it is TRUE. Which means that it won't be equal to TRUE.

[GitHub Security Lab @GHSecurityLab]

In this post "Corrupting memory without memory corruption" @mmolgtm is showing how a powerful kernel bug, CVE-2022-20186, can be used to root a Pixel 6 from a malicious app https://t.co/uNXeHk749w