Marcin Noga

Security Researcher / Pentester / Malware hunter

[Marcin Noga @_Icewall]

@yo_yo_yo_jbo @SEKTOR7net @yo_yo_yo_jbo That was my first idea.
But unfortunately AsusCertService.exe contains UAC manifest requiring this exe to be run with admin privilege's. So, trying to spawn this exec as a suspended process and then inject arb code won't work.

[Marcin Noga @_Icewall]

@yo_yo_yo_jbo @SEKTOR7net @SEKTOR7net thank you for mentioning this research!

[SEKTOR7 Institute @SEKTOR7net]

Exploiting Asus driver to escalate privileges.

With few clever tactics Marcin Noga managed to bypass several constraints implemented by the driver devs.

With hardlinks and ObfDereferenceObject() one can decrement PreviousMode of a process to enter god mode (this was patched in 24H2).

Nicely done, @_Icewall!

Post: https://t.co/wHMdSKs8gK

#redteam #maldev #malwredevelopment

[Marcin Noga @_Icewall]

Thanks, @GamersNexus, for presenting the bugs I found in ASUS Armoury Crate to a wider audience in such an accessible way!
https://t.co/kSX4sSEmxS

[Marcin Noga @_Icewall]

@Void_Sec I guess so, that's why I mentioned the timeline in the blog post . On pasted screenshots I only mention about mem leak primitive, but in general I wanted to signal that after 24H2 the exploit won't work.

[Marcin Noga @_Icewall]

Exploitation of Asus Armory Crate AsIO3.sys driver | authorization bypass + ObfDereferenceObject primitive to LPE - https://t.co/aHGxZexsvK

[Marcin Noga @_Icewall]

CVE-2025-1533 - Asus Armoury Crate AsIO3.sys stack-based buffer overflow vulnerability
https://t.co/eDbXCghbvg
Remember that Windows paths can be longer than MAX_PATH(260)!!! I wrote a few words about this 15 years (sick!) ago : https://t.co/wXklgdOiPA

[Aleks @FuzzyAleks]

The biggest takeaway from this talk is that macOS font renderer ALMOST never invokes the interpreter. If you were fuzzing TTF bytecode without paying attention, it was probably not hitting the interpreter at all.
I'll post slides shortly with other interesting details. #OBTS

[Marcin Noga @_Icewall]

@carste1n I have recently "built" for myself that thing : GMK87 + Brown Gaterons 3 Pro + Cherry profile PBT Dragon Ball keycaps

[Marcin Noga @_Icewall]

CVE-2023-39928 - Webkit MediaRecorder API stopRecording use-after-free vulnerability more info :
https://t.co/V0xQPtbzYs

[Marcin Noga @_Icewall]

@oshogbovx Radio Naukowe - https://t.co/p1vHMV98KV

[Aleks @FuzzyAleks]

Teammates have published an overview of five years worth of router security research which has resulted in hundreds of vulnerabilities discovered in routers from more than a dozen different companies.

[Gynvael Coldwind @gynvael]

On Friday I'll be doing my "PCI Express To Hell" talk:
https://t.co/h4dwzuhKjv
If you're building your own PCs you should check it out! Last year I reworked my whole computer setup and learned a lot about PCIE. Don't make the same mistakes I did ;)
Plz RT for range :)

[Marcin Noga @_Icewall]

@pedrib1337 https://t.co/f6n6aYWAPI

[Cisco Talos Intelligence Group @TalosSecurity]

Our vulnerability research team discovered 12 memory corruption vulnerabilities in MSRPC on #Apple macOS and #VMWare vCenter. We have a deep dive into how an attacker could exploit these vulnerabilities and what it says about the use of forked codebases https://t.co/zx3mqy6EgD

[Marcin Noga @_Icewall]

2 more to the collection :
CVE-2023-33133 - Microsoft Office Excel WebCharts out-of-bounds write vulnerability : https://t.co/e51pNDk79W

CVE-2023-32029 - Microsoft Office Excel FreePhisxdb arbitrary free vulnerability : https://t.co/fy3w2WpkLI

[Marcin Noga @_Icewall]

@maciej_je Gourdough's Big. Fat. Donuts.
[phone]
https://t.co/mzImDke6h5

[Hardik Shah @hardik05]

Ok, I am looking out for security researcher role. If you can help, please DM.
RT, like and recommendations are much appreciated. Here is My Linkedin profile, which will give you more details:
https://t.co/QO1V0Grmpl

[Aleks @FuzzyAleks]

Remember these? Original Lytro! Lightfield cameras of the future! I grabbed a few off eBay some time ago and took a peek at the firmware. Found secret unlock that enables full remote control of all camera features. Full writeup here: https://t.co/ztmWpMVgan

[Marcin Noga @_Icewall]

CVE-2022-31698
Pre-auth VMware vCenter Server Content Library denial of service vulnerability : https://t.co/uadH7rF2Tk