Maxim Suhanov

Computer forensics, computer forensics tool validation, etc.

[Maxim Suhanov @errno_fail]

CVE-2024-13745 in EDK II (likely, "WONTFIX"): "what you measure is not what you use".

The story about firmware measuring bytes different from ones being used. It affects PCR[5], so the severity is low (nobody cares about PCR[5] by default).

https://t.co/K09lww7uR9

[Maxim Suhanov @errno_fail]

@weezerOSINT You forgot about CVE-2026-20928, CVE-2025-21202, CVE-2024-43513. All of them are related to WinRE.

[Maxim Suhanov @errno_fail]

@th31nitiate @spendergrsec NetScaler VPX/MPX

[Maxim Suhanov @errno_fail]

The vendor reported that this issue has been fixed in 14.1-60.52.
No security advisory, CVE ID, release notes entry was published. Although this is a minor vulnerability, it is a vulnerability. 2/2

[Maxim Suhanov @errno_fail]

NotCVE-2026-0002: if you run two NetScalers in the high availability (HA/HA-INC) deployment, no SSH host key checks are performed between them, even when you followed every advice listed here: https://t.co/V5M7nz1Xsv (see: Set up secure communication between peer appliances) 1/2

[Maxim Suhanov @errno_fail]

My story of recovering cleared RDP logs from a completely unrelated EVTX file: https://t.co/MUxfObI5c8 #DFIR

[Maxim Suhanov @errno_fail]

@matrosov A similar story: putting disclosed vulnerabilities under "embargo" (no security advisory is posted before some insane deadline, although everything is public already).

[Maxim Suhanov @errno_fail]

- BestCrypt Volume Encryption breaks many XTS mode guarantees (and the vendor doesn't care). 4/4

[Maxim Suhanov @errno_fail]

My long post about wide-block & AEAD modes in full-disk encryption: it cover threat models, vulnerabilities, and edge cases.

Key points:
- It's common for FDE implementations to fail outside of the encryption layer.

https://t.co/ze4H8jBF48

1/4

[Maxim Suhanov @errno_fail]

directory entries).
- Defusing the Elephant diffuser: injecting a bunch of null bytes into the BitLocker-encrypted volume (AES-CBC with Elephant diffuser). An interesting but unexploitable bug present since Vista. 3/4

[Maxim Suhanov @errno_fail]

Do we really need XTS key scopes here? 5/5

[Maxim Suhanov @errno_fail]

Unfortunately, this paper from 2017 is still relevant.

https://t.co/UH7MZpi1Cl

1. BestCrypt Volume Encryption (BCVE) allows watermarking attacks.
2. BCVE allows plaintext injection attacks.
3. BCVE allows forced decryption of some sectors.

1/5

[Maxim Suhanov @errno_fail]

The third attack allows adversaries to remotely force the decryption of some sectors (like those belonging to a database used by a web-facing application) through spraying (repeatedly causing the INSERT operation of) a specific 16-byte pattern.

4/5

[Maxim Suhanov @errno_fail]

@yarden_shafir Most vendors use it to embed the MICROSOFTELAMCERTIFICATEINFO data. No real checks implemented.

[Maxim Suhanov @errno_fail]

@wdormann open .7z inside the mount point using 7-Zip*

[Maxim Suhanov @errno_fail]

(A new class of symlink attacks is mentioned below.)

According to Microsoft (MSRC), attacks involving symlinks stored on removable drives or in file system images (like VHDX) are not vulnerabilities.

If an unprivileged user manages to quickly replace a regular file... 1/7

[Maxim Suhanov @errno_fail]

@wdormann Test setup: .vhdx containing .7z containing .exe.
Test #1: open .vhdx in 7-Zip, navigate to .7z inside that container, extract .exe. Result: MotW present.
Test #2: mount .vhdx using Explorer, open .7z inside the mount point, extract .exe. Result: MotW absent.