Alyosha Sintsov

was born in '85, still alive...

[b1ack0wl @b1ack0wl]

"we would look at xrefs to strcpy() and write a highly reliable exploit by the end of the day"

[Alyosha Sintsov @asintsov]

Hey, we are looking for an Incident Response Engineer in Mexico! #job https://t.co/lEbAZh56a8

[Alyosha Sintsov @asintsov]

How can we measure the Return on Security Investment (RoSI) of Bug Bounty programs? @ygoltsev and I have explored various numbers to find answers, and we'd like to share our ideas with you - https://t.co/Qxy4YKPiit! #ROI #bugbounty #metrics #okr

[Alyosha Sintsov @asintsov]

Yes, I was right - https://t.co/6Q84zVil8K

[Alyosha Sintsov @asintsov]

Is Ivanti 0days based on path traversal + command injection in backup endpoint?

[Cristofaro Mune @pulsoid]

Let me say that again...

You store pointers at the _destination_ address of a memcpy.
You glitch during memcpy ().
You get that pointer into PC.

No, it's not sci-fi. It's the "instruction corruption" fault model. And we pioneered that.

See thread below 1/N.

[Alex Matrosov @matrosov]

Application Security and Vulnerability Assessment getting a significant advantage from GenAI (context-driven knowledgebase). That helps security teams understand the root cause of the problem faster and significantly reduces the latency in producing security fixes at scale.

[Alex Matrosov @matrosov]

"... detected several remotely exploitable bugs in AMI MegaRAC BMC"

"... whole attack sequence: from having zero knowledge about a remote AMI BMC with enabled IPMI (yeah, right) to flashing a persistent firmware implant to the server SPI flash"

Looking forward to this talk!

[joernchen @joernchen]

Our lovely Red Team at @gitlab is looking for a Senior Red Teamer

https://t.co/t5XTkIhBhC

[Alyosha Sintsov @asintsov]

@joernchen I call it D&D already. I also think we should have network map and mini-figures!

[Alyosha Sintsov @asintsov]

Also found interesting, that ChatGPT works much better if you ask to use LangSec approach: translate logic into grammar, and input as a language and try to find a Weird Machine, works more efficient at my example than just "check the pseudocode/logic for security issues"

[Alyosha Sintsov @asintsov]

And on other side: "fraud/propaganda" is also a language for creating "weird machines"...

[Alyosha Sintsov @asintsov]

Think lately about weird machines, and found myself that jokes and humor is an example of such for human beings.

[offensivecon @offensive_con]

A Dark Side of UEFI: Cross-Silicon Exploitation by @matrosov and @flothrone now #OffensiveCon23

[Alyosha Sintsov @asintsov]

@virustotal @bquintero Can anyone please run Code Insight against that file: https://t.co/cBasZxjqIF

[offensivecon @offensive_con]

My dear humans and non-humans, I present to you the speakers for #OffensiveCon23
https://t.co/3OTgbcmlvV

[PT SWARM @ptswarm]

📝New research by @lmpact_l: "Fork Bomb for Flutter"

There are more and more Flutter applications, and security analysis of these apps is in high demand. Our member Phil shares his knowledge and presents his reFlutter tool.

Read the article: https://t.co/8sLDdgB8Ul

[Alyosha Sintsov @asintsov]

@xplus_cat Or you can use other tricks of Social Engineering

[Alyosha Sintsov @asintsov]

Future of hacking... ha ha, It is really fun, thx!