Mickey

Low hanging fruit maven. Cluster Head. Tweets are my own.

[BSides Portland @BSidesPDX]

Board election reminder! We will be hosting elections for one board position tonight at 7PM. If you're interested in running, please be sure to attend the meeting and join our Google group for more details on how to sign up https://t.co/grUiYWcopR

[Or Yair @oryair1999]

Fresh @safebreach Labs research! 🔥
CVE-2025-59199 breaks down a highly creative low-integrity Windows LPE path.
Learn how Notifications, COM objects, URIs, DevTools, and Windows Apps chain together in a single exploit. Great work team! 👇
https://t.co/1PgKB1WIxe

[Costin Raiu @craiu]

The Three Buddy Problem visits Ekoparty Miami: Jordan Wiens, co-founder of Vector 35 and creator of Binary Ninja, talks about a decade spent building a decompiler in a market everyone told him not to enter. He walks through why accessibility drove the whole project, how Binja's intermediate-language system stacks up against IDA, Ghidra, and Radare, and why language-specific decompilation for Rust, C++, and Go is the next real frontier.

Plus, thoughts on AI disruption and why "the model can do it" misses the point that the model is just driving the tool, what verifiability really means, whether AI tilts the field toward offense or defense, and questions around subsidized tokens, the collapse of the CTF talent pipeline, and what happens to a craft when the shortcut is always one prompt away.

Apple Podcasts https://t.co/1ZcIAbSGO5

Spotify https://t.co/wDEbdngWwa

Transcript https://t.co/DcJBmcTuEl

[Joe Fitz @securelyfitz]

The clock is ticking! This is the last week for early registration prices at @BlackHatEvents USA.

I have a new class this year: How to use Secure Boot and Encrypted Firmware.

https://t.co/llqu94TQJ3

[LABScon 2026 @labscon_io]

LABScon25 Replay 📺

Joe Fitzpatrick: Please Connect to the Foreign Entity to Enhance Your User Experience (@securelyfitz)
https://t.co/MnTltSEO01

[Joe Fitz @securelyfitz]

Hardware Hacking and AI* all using LLMs*:

I've been teaching courses about *Attacking *IoT at Black Hat for over a decade - often using tools that include *Logic *Level *MOSFETs.
Here's my take on some of the hardware courses and what pairs well for different skill levels:

[Joe Grand @joegrand]

Finally releasing some work with @LennertWo! https://t.co/zQJ0uNZZg8

[Joe Grand @joegrand]

Reverse Engineering a Ledger Nano X Hardware Implant (@_TROPICON) slides are up! https://t.co/90F35XPLnr

[impulsive @weezerOSINT]

AMD is shipping a vulnerable kernel driver in the Razer Blade 16 BIOS updater. its sitting in the same folder as ANOTHER vulnerable driver that's been publicly known and documented as dangerous for years

both are signed. both can be weaponized by malware to bypass your antivirus, take complete control of your computer from the inside, read anything stored in memory including passwords and crypto wallet keys, and load ransomware /Malware without your PC putting up a fight

this is exactly what ransomware / malware operators and state backed groups hunt for every single day

[impulsive @weezerOSINT]

GPU-Z is on basically every gaming PC on earth. TechPowerUp makes it. they also make Sapphire TRIXX. What I found is insane...

both ship TRIXX.sys. IOCTL 0x800060C4 calls HalSetBusDataByOffset with user-controlled bus, device, function, and offset. any local process. no admin.

reprogram any PCI BAR to any physical address. map it. arbitrary physical memory R/W from ring 3.

a GPU info tool with the keys to your entire system. EV cert. valid through April 2028.

[club1337 @club31337]

Signed to Kill: Reverse Engineering a 0-Day Used to Disable #CrowdStrike EDR

The article presents a reverse-engineering analysis of a kernel driver used in a BYOVD (Bring Your Own Vulnerable Driver) attack to disable security software, including @CrowdStrike Falcon EDR. The researcher discovered multiple variants of a Microsoft-signed driver that expose a dangerous IOCTL interface capable of terminating arbitrary processes.

https://t.co/aMglNThCln

[impulsive @weezerOSINT]

https://t.co/I7ZRtFhti5
found a 25KB WHQL signed driver from https://t.co/dpXTuPquUc. its a french hardware inventory tool people install to check what GPU they have. 7 IOCTLs, zero validation.

no security descriptor on the device. FILE_ANY_ACCESS on every IOCTL. any user can open it. no admin needed. no UAC.

unrestricted wrmsr. no whitelist. write IA32_LSTAR and every syscall on the system hits your code. the instruction takes single digit nanoseconds.

arb physmem read up to 2MB per call, MSR read/write, port I/O, PCI config R/W.
It wasn't on loldrivers. not on hvci blocklist. no CVE. 0/68 on VT

[MG @_MG_]

Russia hid spy hardware in the walls of TechEx, an Ukraine defense company that builds drones.

They don’t really explain what it is beyond “wire tap”, so let’s do a quick analysis on the hardware to configure out what it does!
🧵1

[Joe Grand @joegrand]

https://t.co/omMyx9sRqb

[Paul Asadoorian @[email protected] @securityweekly]

We found 9 vulnerabilities across 4 low-cost IP-KVM vendors. These $30 devices give attackers the equivalent of physical access to everything they connect to. Below the OS, EDR, and pretty much every security control you've deployed.

[Joe Grand @joegrand]

https://t.co/gLeDoHBzQC

[Daniel Cuthbert @dcuthbert]

Everyone today is a hacker in a sense but there are very few OG hackers on which shoulders we stand

Oh dude, Felix “FX” Lindner you were so much a hackers hacker and you will be missed

RIP my friend and thank you

[Mickey @HackingThings]

Thank you for everything FX, you will be missed 😞

[Travis Goodspeed @travisgoodspeed]

I'll be teaching a practical, introductory workshop on reverse engineering a mask ROM from a photo of a microchip at @BlueHatIL in Tel Aviv.

If you're interested and in town, please join on either 10 or 11 March. You'll start with a microscope photo, end with disassembly code.