learning more reverse engineering and tried to make a basic agr recorder so i started with bo2, still a very much wip but the long term goal is to support multiple games
My Phrack article, "Calling All Hackers" is finally out!
It's about what I learned going from a hacker to running a company—and how hackers can make a difference in today's world. And the shitty parts of startup culture no one talks about.
Read here: https://t.co/bkwCtyo9Wg
So far, I have written 706 pages to help the security community. My goal will be writing new articles of the Exploiting Reversing Series (ERS), which is focused on security research. However, I am planning to write one or two additional articles of my previous series MAS (Malware Analysis Series) to finish it off.
10. https://t.co/6SNMK1u99L
09. https://t.co/YMTSBl5HLa
08. https://t.co/yvXoY9uWtf
07. https://t.co/DIcpSdRpfW
06. https://t.co/AvjPAaTmQN
05. https://t.co/4wFVoBGapZ
04. https://t.co/PE7JeEM5lm
03. https://t.co/QXa2To5Z4S
02. https://t.co/BPt9L7QFdW
01. https://t.co/vGnT26NOin
#windows #idapro #kerneldrivers #kernel #infosec #reversing #malwareanalysis #vulnerability #securecode
This weekend, I watch teams competiting in Google CTF and did nothing else... Oh actually I wrote the solution for ZKPOK, enjoy :)
https://t.co/mbGeIAap9k
Release: VM Escape Exploit for Parallels Desktop Hypervisor (Pwn2Own 2021) https://t.co/QDj9wYcMwT (source code + video walkthrough)
A virtual machine escape exploit will typically require kernel privileges in the guest OS. In this exploit I chose to offload the reverse-engineered toolgate protocol implementation to a Python module, while keeping my low-level kernel code minimal, just enough to implement the attack interface - a nod to the principle of least privilege in systematic software engineering, which we miss a lot in non-trivial exploit development. -- @alisaesage
Today I received a $12,000 bounty using the Sandwich Attack ! 🤑
The vulnerability allowed me to enumerate the API Keys of other users 🤯
How did I do that ? Well the API key was a UUIDv1. If you are not familiar with UUIDv1s you need to know that they are constructed in 6 sections:
High, Mid, Low, Clock Sequence, Node ID, and UUID version.
Interestingly, the Node ID corresponds to the MAC address of the system generating the identifier. This means that if two consequent UUIDs are generated on the same device, this part remains the same, similar to the Clock Sequence.
When High, Mid, and Low are combined, they reveal a timestamp represented in hexadecimal value.
Using some basic mathematics it's possible to subtract the offset between the Gregorian Calendar and the Julian Calendar and then divide by 1000 to get an Epoch TimeStamp.
Ok now that we know that they are generated by a timestamp + machine ID, it means that we could generate them back if we know when the API keys were created 🧐
Luckily enough the API Key that I was using was generated in a batch, meaning I could use the Sandwich Attack in order to brute force the API Keys of other users easily 🔥
If you want to know more about how I exploited the Sandwich Attack, go check my video about this on my YouTube channel 🤟