Malcolm Stagg

Ethical hacker @synackredteam. Working on software/electronics, AI and robotics projects @sodium_24. Former @DARPA challenge competitor. Opinions are my own.

[Malcolm Stagg @malcolmst]

At this point, there have been a large range of vendor reactions to this research, ranging from “intended design” and “totally bogus” to reports accepted at P1 priority. Still curious to see how it all unfolds in terms of vendor patches prior to disclosure.

[Malcolm Stagg @malcolmst]

I’m excited to be presenting at Black Hat USA this year! My presentation is titled “Breaking Trust Boundaries: Exploiting Design Assumptions in Network Infrastructure” https://t.co/kFwlmr4uEG

[Malcolm Stagg @malcolmst]

This will be available as an on-demand briefing to conference attendees, then later published on the YouTube channel. This research is currently under coordinated disclosure with multiple vendors affected. I’ll try to share more details closer to the conference.

[Malcolm Stagg @malcolmst]

Thank you @GoogleVRP I really like the shirt!

[Malcolm Stagg @malcolmst]

#JusticeForPeanut #Vote

[Elon Musk @elonmusk]

Government overreach kidnapped an orphan squirrel and executed him …

[Malcolm Stagg @malcolmst]

@Jo3Ram Good luck!

[Malcolm Stagg @malcolmst]

@Jo3Ram AFAIK you’ll probably need to see someone with a badge for a hint, unless they added something online since then

[Malcolm Stagg @malcolmst]

@Microsoft @MicrosoftHelps Is there any way I can have correct formatting without being forced to change my privacy settings @Microsoft?

[Malcolm Stagg @malcolmst]

Apparently if you have the Office 365 privacy setting “Turn on all connected experiences” turned off, the Apsos font no longer renders correctly. It silently uses Apsos Display which is totally different spacing. Is this expected @Microsoft? Why force me to have this turned on?

[Malcolm Stagg @malcolmst]

@Microsoft @MicrosoftHelps the only difference between these two screenshots is turning the privacy setting on or off. This shouldn’t cause the formatting to be completely different.

[Malcolm Stagg @malcolmst]

I have a video demo showing exploitation against an enterprise extension
https://t.co/9PbzsxpbT9

[Malcolm Stagg @malcolmst]

Appreciate @synack @README_Security publishing my writeup about CVE-2024-0333:
https://t.co/u6sB4a1ayM

[xvonfers @xvonfers]

(CVE-2024-0333)[1513379][Extensions][Updater ][crx_file]CRX3 File Signature Verification Bypass via Embedded ZIP64 Payload is now open with a PoCs.
https://t.co/hgsDFQzMGR

[Malcolm Stagg @malcolmst]

Thanks to the Chromium team for their great work on this!

[Malcolm Stagg @malcolmst]

Interesting Google Chrome vulnerability I reported before Christmas was fixed today (CVE-2024-0333). I’ll post more details later after people have a chance to update.

https://t.co/QzCBiq7QTI

[Malcolm Stagg @malcolmst]

@DARPA @defcon @AnthropicAI @Google @GoogleDeepMind @Microsoft @OpenAI @openssf Will the talk be recorded?

[Malcolm Stagg @malcolmst]

The new @DARPA challenge from @perribus looks very exciting! Seriously considering coming out of DARPA challenge “retirement” to work on this one.

[Perri Adams @perribus]

I’m excited to announce the AI Cyber Challenge, a major, two-year @DARPA competition challenging the best and the brightest in cybersecurity and AI to secure the systems on which all American rely.

https://t.co/mZR4ZNSiaM

[README_ @README_Security]

As we prepare for the holidays, we’re counting down our most popular stories of 2022, starting with “How I hacked my way to the top of DARPA’s hardware bug bounty” by @malcolmst (with art by Si Weon Kim) from January: https://t.co/4isLf1rNXC

[Malcolm Stagg @malcolmst]

Incredibly happy and excited to become an American citizen today! I love this country and all it represents. It is truly the greatest nation in the world. God Bless America!

[Malcolm Stagg @malcolmst]

@Dinosn So now you can just use Notepad to brute-force passwords? That seems convenient 😀