Danny

[Samuel Groß @5aelo]

Here are the slides from the "Attacking JavaScript Engines in 2022" talk by @itszn13 and myself @offensive_con. It's a high-level talk about JS, JIT, various bug classes, and typical exploitation flows but with lots of references for further digging! https://t.co/DtHsLa34Da

[Ian Beer @i41nbeer]

Today we're publishing a detailed technical writeup of FORCEDENTRY, the zero-click iMessage exploit linked by Citizen Lab to the exploitation of journalists,
activists and dissidents around the world. https://t.co/RYsqpTHF5j

[TrendAI Zero Day Initiative @thezdi]

The schedule for #Pwn2Own 2021 is live! Check out all of the attempts set for the next 3 days. We'll be updated the schedule with results as we get them. https://t.co/iLyRzBIb6g

[Can Bölük @_can1357]

It's been a while since I wrote anything so I wrote an article on how to discover the entire x86-64 instruction set in seconds including any hidden instructions and learn their basic properties while on it. There were some pretty interesting results!

https://t.co/t7vMwYDYas

[Clint Gibler @clintgibler]

🐋 How Netflix secures their containers using User Namespaces ("rootless containers")

Great overview of the problem space + a discussion of how their architecture has changed over time

by @fabiokung @sargun @aspyker @heliousc6 @anwleung et al

https://t.co/7G0V0A83Pc

[Danny @dannyc_dev]

Thread-Per-Core Buffer Management for a modern Kafka-API storage system https://t.co/RyAcMVpTFY

[Ben Awad @benawad]

Introducing VSCode Stories, the extension you've always wanted but been too afraid to ask for

[Danny @dannyc_dev]

Amazon Announces the Preview of AWS Controllers for Kubernetes (ACK) https://t.co/nIClO9Gumu

[China Xinhua News @XHNews]

A nimble robot dog: Meet A1, a lifelike four-legged robot that can tumble and run as fast as a man. #tradefair

[Sam Curry @samwcyo]

"Hacking Starbucks and Accessing Nearly 100 Million Customer Records" - write up on a recent directory traversal vulnerability found with @Rhynorater ☕️

https://t.co/3Ug0SSrRI5

[XSS Payloads @XssPayloads]

The smallest sandbox escape for AngularJS, by @PortSwiggerRes
{{{}.")));alert(1)//"}}
And the full (?) list in the cheat sheet: https://t.co/A3I7Q7BTk4

[Matthew Prince 🌥 @eastdakota]

There’s a lot of buzz right now about a “massive DDoS attack” targeting the US, complete with scary-looking graphs (see Tweet below). While it makes for a good headline in these already dramatic times, it’s not accurate. The reality is far more boring. 1/X https://t.co/4wDIlKnfQg

[Tom Carver @tomcarver_]

Just finished my first blog post on a AMSI bypass technique utilizing function hooking as well as dll injection https://t.co/WsvbHzEQtx

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

This new Microsoft Terminal is very #mimikatz friendly ❤️🥝

[Danny @dannyc_dev]

Cool seeing the app sec world adopting tools like this. "This bot hunts software bugs for the Pentagon" https://t.co/nuacYRih58

[Cn33liz @Cneelis]

Making an antivirus engine : the guidelines
https://t.co/xDHuehCETC

Very useful reference to understand basic AV internals!

[Samuel Groß @5aelo]

In case you missed @natashenka's talk at @BlackHatEvents this week, here is a video showing a remote exploit for one of the iMessage bugs we found: https://t.co/iEb1tvZpt0 Be sure to read https://t.co/w9iHf4WwmS if you are interested in these kinds of attacks!

[Natalie Silvanovich @natashenka]

Today, @5aelo and I unrestricted five bugs in iMessage! Here are some highlights:

[Danny @dannyc_dev]

Ten months old tweetable bug leads to RCE https://t.co/Y9d8qt9r8b