splitline 👁️🐈‍⬛

友民党 / CTF with ${cYsTiCk} / script kiddie at @d3vc0r3 / Tâi-gí, zh-TW, en-US, es-PY / 🐈‍⬛

[splitline 👁️🐈‍⬛ @_splitline_]

@terrynini38514 @kyo_p * fix the link https://t.co/NYVYHIkUWy

[splitline 👁️🐈‍⬛ @_splitline_]

@albinowax btw this feels like the part where I'm supposed to drop a blog link, maybe I should write faster 😭

[splitline 👁️🐈‍⬛ @_splitline_]

@albinowax omg not me getting name-dropped by James Kettle

well I should probably try to pwn the other half so I can keep avoiding storytelling...

[DEVCORE @d3vc0r3]

DEVCORE CONFERENCE 2027 | CFP is open

#Redteam, #VulnerabilityDiscovery, #Physicalsecurity, firmware and hardware RE, #AI attack surfaces. Bring the research that starts from a hacker's view.

Deadline: Oct 11, 2026, 23:59 GMT+8
https://t.co/hdvlNsAobJ

[splitline 👁️🐈‍⬛ @_splitline_]

@albinowax @SEC_T_org Can’t wait for your talk too!

[splitline 👁️🐈‍⬛ @_splitline_]

Tomorrow at @SEC_T_org, I’ll be breaking down the journey of how I found paths to compromise software supply chainS.

We’re going down the Linux side this time ;)

[splitline 👁️🐈‍⬛ @_splitline_]

@Bugcrowd guys give me one more like for 67

[splitline 👁️🐈‍⬛ @_splitline_]

I earned $67.6767 for my submission on @bugcrowd https://t.co/0M4qoQ0ec0{id: "splitline"} #ItTakesACrowd

[Tim Wilson @actualTimWilson]

In case you were wondering

[Nadim Kobeissi @kaepora]

0 = 1 proven in Lean. Exciting and novel result! https://t.co/pFaztdXWj3

[splitline 👁️🐈‍⬛ @_splitline_]

bug bounty still works, sure
problem is how much critical infra sits nowhere near it
most of it hasn't even had someone lazily throw a "hey chatgpt, find a 0-day for me make no mistakes" prompt at it yet

[HITCON @HacksInTaiwan]

你是否也習慣將「官方網站下載」、「Microsoft Store 上架」或「官方套件管理庫」當作萬無一失的信任背書？
但「官方」真的就代表安全嗎？
從建置、簽章到發布，每一層都有可能成為攻擊者的切入點。

​今年 HITCON，三場硬核議程將從三個完全不同的信任層級拆解軟體供應鏈，顛覆其安全想像：

💥 原初之穢：先莫管供應鍊夆毒，阮直接共官方發布源頭駭掉矣 | 講者：splitline
如果負責宣告「這是官方版本」的發布系統被駭了呢？
本場演講將揭露 Python、Ubuntu、Go、Alpine 與 Windows 套件生態系上游發布端的脆弱盲區。即便最終執行檔帶有合法數位簽章，只要上游建置環境遭滲透，簽章也可能無法保證你拿到的東西安全。
現場將公開多個實戰案例，展示攻擊者如何用非預期的邏輯漏洞直接拿下控制權。
☠️ Not Just Spies Anymore: DPRK's Espionage Actors Are Coming for Your Crypto | 講者：Seongsu Park
當原本專注於國家間諜行動的 APT 組織轉向加密貨幣撈金，攻擊者開始重新利用各種「可信」背書。
從架設高擬真交易平台、申請公司簽章，到成功把木馬化應用程式上架到 Microsoft Store，再結合 AI 輔助開發、macOS TCC 權限操作與精準白名單投遞，這場議程將展示官方通路沒有被攻破，也可以被攻擊者拿來建立信任，造成極致濫用。
🚨 黑吃黑: 瞄準駭客的供應鏈攻擊 | 講者：Jason3e7、Samuel

當獵人自己成為獵物？
攻擊者密切盯著高熱度 CVE 的公開資訊，在社群瘋傳、復現 PoC 的黃金時間，將高度混淆與多階段載入的後門深埋在 PyPI 工具的深層依賴鏈中。
當研究員為了復現漏洞，在終端機按下執行的瞬間，測試環境就已淪為被控端點。
三場議程，三個不同的信任位置。
從官方建置環境、官方的發布通路，到你以為只是研究工具的第三方依賴——當「看起來可信」不再等於「真的安全」，我們還能相信什麼？

📅 HITCON 2026：8 月 21 日－8 月 22 日
🔎 完整議程：https://t.co/e3iWdoBtzI
🎫 購票連結：https://t.co/qpV9Z02Deq

#HITCON2026 #HITCON #供應鏈安全 #漏洞復現

[Angelboy @scwuaptx]

My #BHUSA 2026 slides are online!

It was an honor to share our AFD research and how a different perspective led to 30+ Windows kernel vulnerabilities.

Blog post coming soon — check out the slides here:
https://t.co/l8xIaRtL7V

[splitline 👁️🐈‍⬛ @_splitline_]

so i actually got more than one RCE chain (~2.5?) for SharePoint at Pwn2Own this year, even though i ended up using the freakishly simple one (for strategic reasons :p)

here's another one of them:
https://t.co/OfefQK73KH

[splitline 👁️🐈‍⬛ @_splitline_]

@orange_8361 TM比我好看的没我骚🤷‍💨比我骚的没我好看

[splitline 👁️🐈‍⬛ @_splitline_]

I put this meme into my bh talk lol @AikidoSecurity

[DEVCORE @d3vc0r3]

Two of our researchers hit the #BHUSA stage for the first time.

Angelboy(@scwuaptx ) shares how a different angle on AFD led to 30+ new #Windows kernel vulnerabilities. Splitline(@_splitline_ ) exposes backdoor risks in Go, Python & Flutter pipelines.

#VulnerabilityResearch

[splitline 👁️🐈‍⬛ @_splitline_]

@BlackHatEvents Teaser #2

https://t.co/YZpC3aeE2u

[splitline 👁️🐈‍⬛ @_splitline_]

an incredibly simple but also incredibly critical bug i found on Python[.]org!

big thanks to PSRT and the maintainers for the quick fix and thorough follow-up

for the tl;dr: i can do this:

[splitline 👁️🐈‍⬛ @_splitline_]

Next week at @BlackHatEvents #BHUSA, I'll present “Born Corrupted: How We Backdoored Trusted Language Binaries”

We found ways to compromise Python, Go, Flutter & Julia at the supply-chain layer, turning trusted bins into whatever hackers want them to be!

Check out the abstract:

[splitline 👁️🐈‍⬛ @_splitline_]

@BlackHatEvents Teaser #1

https://t.co/u4OB2bbTWQ

[splitline 👁️🐈‍⬛ @_splitline_]

some supply chain compromise