Emanuele Cozzi

malware&reversing

[Simone Aonzo @packm4d]

🚨 New research from EURECOM & Univ. of Milan!
[1/3] “Unveiling BYOVD Threats: Malware’s Use and Abuse of Kernel Drivers” (to appear at NDSS’26) reveals how malware exploits signed drivers to gain kernel privileges. This work led to the discovery of 7 unknown weaponized drivers💣

[nSinus-R (@[email protected]) @nSinusR]

Heya! Our new research on client-side game cheating & anti-cheat systems is out: https://t.co/15godGKYMO

Joint work with Sam Collins, Alex Poulopoulos, and @TomChothia.

Full paper: https://t.co/fSQDADdhbK

[NinjaLab @NinjaLabFr]

We are very excited to share our last research work: 𝐄𝐔𝐂𝐋𝐄𝐀𝐊, authored by Thomas Roche.

An electromagnetic Side-Channel Vulnerability in the ECDSA implementation of all Infineon security microcontrollers, notably impacting all YubiKey 5 Series.

https://t.co/CUqmlUTRh8

[Simone Aonzo @packm4d]

In a few minutes I will present our work on Android evasive malware to @ASIACCS2024 [1].

What better occasion to reveal that DroidDungeon, the sandbox developed for this work, has evolved into a commercial product?

Join the beta -> https://t.co/4v5JaZkgjt

[Fabio Pagani @pagabuc]

Excited to share (albeit with a little delay) that our @binarly_io talk about #LogoFAIL at BlackHat EU is available! Check it out to see the vulnerabilities we found in UEFI image parsing and their security implications:
https://t.co/VSKcj0pT8E

[Simone Aonzo @packm4d]

We are setting up a user study to measure the impact of LLMs during the Reverse Engineering process.
If you have ever used LLMs for reversing, click here to start the survey (5 mins) 👉 https://t.co/9gsjnIAboE

You can leave your email address for the second phase-with prizes💰

[vx-underground @vxunderground]

The xz situation is absolutely insane and almost certainly state sponsored.

This is an excellent example of a widely used software being maintained by basically one person.

Read this web article and then frown and become sad.

https://t.co/0nHEh7hsBY

[rev.ng @_revng]

🚀 BIG ANNOUNCEMENT! 🚀

The full rev.​ng decompiler pipeline is now fully open source!
Also, we'll soon start to invite people to participate in the UI closed beta.

Check out our latest blog post: https://t.co/9YchJS4RIG

[Moritz Schloegel @m_u00d8]

Fuzzing is hard, evaluating fuzzing is harder 🔥

For our new @IEEESSP paper, we studied 150 fuzzing evals and found issues such as lackluster documentation, bad experiment setups, or questionable CVEs

📄 Paper https://t.co/wmVgzVuCCI

🔧 Help us fix this https://t.co/efNjsJf4kR

[Zion Leonahenahe Basque @mahal0z]

I'm about 50% done integrating SAILR into angr master: https://t.co/jnHS5ieTmb 🎉

P.S.: You can also use angr's decompiler more easily now. Try this out:
```
pip3 install angr && \
angr decompile /bin/true --functions main
```

[Akihiro Suda (@[email protected]) @_AkihiroSuda_]

elfconv: AOT compiler for translating Linux/aarch64 ELF → LLVM bitcode → WASM

By my colleague @ming_rrr

https://t.co/ZO9SJEAk0D

[Antonio 's4tan' Parata @s4tan]

Sono lieto di annunciare la disponibilità del primo corso di malware analysis in italiano: "Introduzione alla malware analysis: Un approccio pratico"

Oltre 9 ore di corso: https://t.co/xWmTtWv7GV (utilizzate questo link, non cercate il corso su udemy ^^)

condivisione gradita :)

[Zion Leonahenahe Basque @mahal0z]

2024 is the year of the decompiler! Start your year off right by reading a post on the last 30 years of decompilation and one of its hardest problems: structuring! https://t.co/iEuvhdszXq

Part 2 to be released next week.

[stacksmashing @ghidraninja]

I just published the code and hardware for Tamarin-C, the iPhone 15 USB-C exploration tool I presented at #37c3.

https://t.co/S3KhHgwvAZ

[Aurélien Francillon @aurelsec]

As WOOT becomes a more formal Conference, we want to keep receiving industry submissions! WOOT experiments a new model: in addition to the academic submissions, there is a practitioner's track. Submit a draft early, inerract with reviewers to get this written as a paper.

[Lukasz Olejnik @lukOlejnik]

They HACKED A TRAIN. For real. Train operators asked for this to see why their trains didn't run after servicing. Turns out that vendor/producer implemented a geofence lock for trains serviced somewhere else. Amazing story, one of the best hacks in 2023. https://t.co/1ZFpIVfLZr

[tmp.0ut @tmpout]

Check it out, it's tmp.0ut Volume 3!

https://t.co/Gm9erN8hTJ

[Tavis Ormandy @taviso]

New write-up on an Intel Ice Lake CPU vulnerability, we can effectively corrupt the RoB with redundant prefixes! 🔥 An updated microcode is available today for all affected products, cloud providers should patch ASAP.
https://t.co/7fPo45iddV

[Zion Leonahenahe Basque @mahal0z]

I'm excited to announce a new decompilation control flow structuring algorithm, SAILR, which is the first to precisely revert compiler optimizations in decompilation. Find out how in our USENIX 2024 paper: https://t.co/sFY44elDht. Code, info, and links in the 🧵

[Ian Beer @i41nbeer]

Earlier this year @AmnestyTech and @_clem1 from Google TAG found an in-the-wild iPhone zero day full chain. Today I’m publishing my analysis of the Safari sandbox escape component, the first in-the-wild sample to break into the new Safari GPU process.