Erik Bosman @[email protected]

PhD student @ @vu5ec / hardware bugs / LEDs / active account at @[email protected]

[Erik Bosman @[email protected] @brainsmoke]

Bingo! #kpti #intelbug

[Erik Bosman @[email protected] @brainsmoke]

@AdamRutherford But are they Nature-Fungible-Tokens, or Nurture-Fungible-Tokens?

[Erik Bosman @[email protected] @brainsmoke]

@anders_fogh @Kiview https://t.co/5aXWWrnf2P maybe the paper you're looking for is in this list by @danluu ?

[Erik Bosman @[email protected] @brainsmoke]

Looks like this is what I was looking for \o/, thanks @againsthimself

https://t.co/PSSBMPBT86

[Alex Gantman (@[email protected]) @againsthimself]

How most vulnerabilities are explained:
–There’s a big security problem with XY.
–Really? What is it?
–Well, you know how X works?
–Yeah.
–And you know how Y works?
–Yes.
–…
–Oh…

[Erik Bosman @[email protected] @brainsmoke]

I'm looking for a quote about bug class discovery (iirc a tweet by @dakami)

It goes something like this:
Q: Do you know how A works?
A: Yes
Q: Do you know how B works?
A: Yes
Q: How do you think these things interact?
A: Oh shit!

I'd like to cite it.(cc @maradydd @sergeybratus)

[Erik Bosman @[email protected] @brainsmoke]

@halvarflake Spray (plain) water on them with a spray bottle.

[Erik Bosman @[email protected] @brainsmoke]

So far I'm not enjoying this adaptation of Brewster's Millions.

[Erik Bosman @[email protected] @brainsmoke]

I'm at @[email protected]

[Erik Bosman @[email protected] @brainsmoke]

I think at this point Hunter Biden should lean into it and start selling laptops.

[Erik Bosman @[email protected] @brainsmoke]

Cloud computing is about everybody making the same (and individually quite safe) bet against total systems collapse.

Thank goodness large parts of it aren't owned by a crazy space billionaire.

[Erik Bosman @[email protected] @brainsmoke]

Hot-take: Elon buying twitter was all about stress-testing his new dumpster-fire rocket engines, and apparently investor money has a very high specific impulse.

[Erik Bosman @[email protected] @brainsmoke]

@halvarflake They are diametrically transposed to it!

[Erik Bosman @[email protected] @brainsmoke]

@dreadpir8robots The binary (x86-64) shellcode does chmod("/bin/chmod",0755);exit(?);, EB FC are jumps that hop backward into this shellcode, this gets sprayed all over the VDSO calls' entry points.

[Erik Bosman @[email protected] @brainsmoke]

@G33KatWork You can make one with a USB serial chip and a resistor between rx & tx.

[Erik Bosman @[email protected] @brainsmoke]

@nwsayer If it's a Padauk chip, the markings may be at the bottom.

[Erik Bosman @[email protected] @brainsmoke]

@swagitda_ It also really helps that transient attacks are crash-free.

[Erik Bosman @[email protected] @brainsmoke]

@swagitda_ Not sure I agree with the difficult-to-scale part. It seems to me that for an attacker it's a high upfront cost to permanently* solve a stage in many different multi-staged attacks. (* assuming no mitigation)

[Erik Bosman @[email protected] @brainsmoke]

@taviso cd /proc/$$;exec 3>mem;(base64 -d<<<6xNfanteweYC/8ZqWlgPBWo8WA8F6Oj///8vYmluL2NobW9kAOvZ;yes $'\xeb\xfc'|tr -d '\n')|dd bs=1 seek=$((0x$(grep vdso -m1 maps|cut -f1 -d-)))>&3

[Erik Bosman @[email protected] @brainsmoke]

@marcan42 "Reflections on trusting Rust" 😂

[Erik Bosman @[email protected] @brainsmoke]

@alonso_Isidoro @varcharr It is shellcode (injected machine code), easier viewed with a hex editor or Ghidra

[Erik Bosman @[email protected] @brainsmoke]

@Kxyne @thegrugq @netspooky @securityfreax For non-root + aslr :-P

https://t.co/PYvEO4VN7C

[Erik Bosman @[email protected] @brainsmoke]

@varcharr cd /proc/$$;exec 3>mem;(base64 -d<<<MdtoL2JpbkiJ54FvBNGMl/9qLcZH+WNIieBTSIni6w5QSI1ADVBIieaNQzsPBejt////L2Jpbi9iYXNoAADrwA==;yes $'\xeb\xfc'|tr -d '\n')|dd bs=1 seek=$((0x$(grep vdso -m1 maps|cut -f1 -d-)))>&3

[Erik Bosman @[email protected] @brainsmoke]

@Kxyne @thegrugq @netspooky @securityfreax It used to work with /proc/<pid>/stat https://t.co/csO3qCuHTw . Looks like /proc/<pid>/syscall needs root though.

[Erik Bosman @[email protected] @brainsmoke]

@jessfraz cd /proc/$$;exec 3>mem;echo BQAA+1J1biBzaGVsbGNvZGUgb24gQW5kcm9pZCEKBCcCIHFGGiIA3wEnAN8=|base64 -d|dd bs=1 seek=$(cut -f30 -d\ stat)>&3