Alexander Ermolov

Security researcher, team lead & speaker. Low-level design, firmware and system software. Fuzzing & testing automation for CI/CD pipelines.

[Paolo Stagno (VoidSec) @Void_Sec]

Bug count != exploitable bug. Finding != chaining.
LLMs are exceptional at pattern recognition on known bug classes. They are not reasoning about novel failure modes in complex multi-component systems.
The hard bugs still require humans. https://t.co/RISinVDT3d

[FuzzingLabs @FuzzingLabs]

New blog post: exploring NVIDIA’s open-source GPU drivers.

Kernel modules, IOCTL attack surface, mmap primitives, UVM internals, and CPU↔GPU interactions (pushbuffers → firmware).

Not just graphics: a large, exposed kernel surface.

https://t.co/2LO5vVXdM0

[Nikolaj Schlej @NikolajSchlej]

Don't want to cry wolf just yet, but this magenta-boxed part of LOTS of Insyde H2O-based UEFI FWs is highly suspicious, even if they are currently empty.

Neither BootGuard nor FlashDeviceMap covers those volumes, and presence of PEI deps section suggests they are processed.

[Mark Ermolov @_markel___]

Intel SGX has fallen! Its most important key is in our hands: we extracted the Global Wrapping Key from an instance of the Intel Gemini Lake platform

[BINARLY🔬 @binarly_io]

Slides and demos for our @REverseConf talk by @francesco_ev and @xorpse are up! If you missed the conference, now's you're opportunity to take a look at the talk content and demos.

Slides & demos: https://t.co/B97vstMQEZ
VulHunt framework: https://t.co/L6vwhyR9kH

[Rodrigo Branco @bsdaemon]

Vulhunt is now open-source, this is a game changer: https://t.co/kTLFiaktkV @binarly_io @vulhuntdev

[Sam Thomas @xorpse]

We @binarly_io just open-sourced our VulHunt framework at @REverseConf!

GitHub: https://t.co/G7bRkP81Gu
Documentation: https://t.co/LSNxpHXGNj
Slack: https://t.co/RMFggNV9sM

https://t.co/recuxjHJZh

[Sam Thomas @xorpse]

I'm pleased to announce a new release of the Rust bindings for @HexRaysSA IDA SDK! This release includes v9.3 compatibility.
Code: https://t.co/4wnfZvRXIH
Docs: https://t.co/nrIyNLv0Kg
Thank you to @yeggorv who contributed to this release, and to @HexRaysSA for their support.

[Nikolaj Schlej @NikolajSchlej]

Published my OFFZONE 2025 presentation slides (in Russian) on GitHub: https://t.co/xoPNdCgKv8

Had a great time at the conf, kudos to https://t.co/JH7qp0fcCW and other sponsors and crew members for organizing and running it.

[Yongdae Kim ([email protected]) @yongdaek]

🔍 Full paper:
📄 https://t.co/DqAeEiBzhr
💻 https://t.co/wvliSHIDvx (coming soon)
📢 USENIX Security 2025
Authors: @hdtuanss , @ohtaekk_ , @cheoljun_p, @insu_yun , @yongdaek
#LLFuzz #BasebandSecurity #Fuzzing #CyberSecurity #USENIXSecurity

[ZeroNights @ZeroNights]

ZeroNights CFP is open 🔥

Long time no see. ZN will take place on Nov 26, 2025 https://t.co/eU1fKt0H0V

The program committee is accepting talks in Offensive and SecOps tracks, rewarding exclusive in-person presentations

Submit https://t.co/jsjBKJ1wJI
@cfptime

[Nikolaj Schlej @NikolajSchlej]

Published the third part of my blog series about Hydroph0bia (CVE-2025-4275) vulnerability, this one is about the fix as Insyde applied it, and my thoughts on improvements for it.
https://t.co/vEIkUNH3Ey

[Nikolaj Schlej @NikolajSchlej]

Preliminary analysis shows that Insyde fixed Hydroph0bia (CVE-2025-4275) by forcefully removing the NVRAM vars that lead to exploitation during SecureFlashDxe driver startup, and setting a restrictive variable policy for them, so such vars can't be set from the OS anymore.

[Nikolaj Schlej @NikolajSchlej]

Published, go check it out, it is a fun ride indeed:
https://t.co/nkk0WkIzFt

Part 3 will be done when I see how Insyde fixed the vulnerability and if we could do something about that fix.

[BINARLY🔬 @binarly_io]

🚨Binarly is documenting the discovery of CVE-2025-3052, a memory-corruption flaw in a Microsoft-signed UEFI module that lets attackers bypass Secure Boot and run unsigned code before the OS starts.

🔗 Full details: https://t.co/mFUeMjEhhr
🛡️ Advisory: https://t.co/dMpzoYgyIr

[Nikolaj Schlej @NikolajSchlej]

The embargo (12:00 UTC 2025-06-10) is over, let's start a thread on Hydroph0bia (CVE-2025-4275), a trivial SecureBoot and FW updater signature bypass in almost any Insyde H2O-based UEFI firmware used since 2012 and still in use today.

English writeup: https://t.co/DYLj3oBDkg

[Adam 'pi3' Zabrocki @Adam_pi3]

Together with @AlexTereshkin we managed to summarize NVIDIA Offensive Security Research (OSR) work on breaking BMC (reference to our DefCon talk https://t.co/4VBhcLhcUa). This blog post also includes a link to the full paper.

[raptor @0xdea]

If for some reason #semgrep doesn’t fit your use case, here’s a port of my C vulnerability research ruleset to #weggli:

https://t.co/xeiK9oqvL3

Read the linked blog post and check it out!

[Sam Thomas @xorpse]

We're are happy to announce a new release of our #Rust bindings for @HexRaysSA idalib.

What's new:
- New APIs for working with IDBs, segments, and more
- Rust 2024 support
- New homepage: https://t.co/m3dJuKWdfr

H/T to our contributors @yeggorv & @0xdea

https://t.co/BVvdGP1L7X

[Andrey Konovalov @andreyknvl]

Gave a talk on external fuzzing of Linux kernel USB drivers with syzkaller at SAFACon by @SAFATeamGmbH.

Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver.

Slides: https://t.co/ca479wDoRV