mattless_

security researcher && low-level dev

[0xor0ne @0xor0ne]

Excellent writeup on Windows kernel vulnerable drivers and how to identify them
Takahiro Haruyama (@VMware)

https://t.co/PnIAH0b5wN

#cybersecurity #Windows

[Objective-See Foundation @objective_see]

Just published our (8th) annual:
"The Mac Malware of <Year>" white paper: https://t.co/ntDJJQaJ8m

It's a technical deep dive into every new macOS malware specimen of 2023, detailing:
💉 Infection
💾 Persistence
📡 Capabilities

...plus samples, detections, & more! 👾🍎💻

[mattless_ @mattless_]

@zodiacon Not a full book, but some idea for chapters might be RPC, ALPC, DCOM, performance analysis

[Windows On Windows @wowstartsnow]

Microsoft
○
く|)へ
〉
￣￣┗┓ Windows 7 & 8.1
┗┓　 ヾ○ｼ
　　 ┗┓ ヘ/ 　 　
　 ┗┓ノ
　 　 　 　 　 ┗┓

[mattless_ @mattless_]

@KevinNaughtonJr a classic

[mattless_ @mattless_]

@sk3wl @ilfak any spoiler on the release? 🙂

[mattless_ @mattless_]

you’ll never end learning #windows

[Daniele Cono D'Elia @dcdelia]

@lcavallaro & I are thrilled to announce “Benefits and Outlook of Program Analysis for Systems Security”.
This COSE special issue seeks technical & vision papers capitalizing on the rich cross-pollination ongoing among Computer Security, PL, and SE research.
RTs appreciated! ▶️🧵

[mattless_ @mattless_]

#github is the new #instagram

[mattless_ @mattless_]

Alternative way of letting #msdt execute stuff without the usual cmdline (@harr0ey)
https://t.co/bp21GmfdZt

[Haifei Li @HaifeiLi]

The rtf format of the “ms-msdt” 0day is using the URL Monkier to load and run the IE engine, which does remind me of my own presentation years ago. Same/similar bug, different paths.

https://t.co/BoeHP0YQwP

#youneverreallyknowCOM

[Nasreddine Bencherchali @nas_bench]

The "PCW.debugreport.xml" file inside %localappdata%\Diagnostics and %localappdata%\ElevatedDiagnostics (for elevated instances) is generated when executing the #follina thingy and it contains the payload. Maybe good for #dfir

Did anyone look into this?

[mattless_ @mattless_]

@DebugPrivilege It’s painful when working with binary data

[mattless_ @mattless_]

I’d like to suggest to #Conti devs the existence of IWbemServices::ExecMethod without the need of #wmic

https://t.co/tKORHjax2z

#ContiLeaks

[Paolo Stagno (VoidSec) @Void_Sec]

This blog post sums up my yearlong Windows Drivers research, detailing my own methodology for reverse engineering drivers, finding possible vulnerabilities, and understanding their exploitability: https://t.co/iPJGGlDnzB

[Und3rf10w @Und3rf10w]

Some time ago, I wrote a proof-of-concept implant framework called Shlyuz that took some design cues from the CIA Assassin implant framework as described in #vault7.

I'm happy to finally be able to share it with the world; but first, some background:

https://t.co/aDr5yCKsPJ

[mattless_ @mattless_]

linux: “everything is a file”
windows: “everything is a COM object”

[mattless_ @mattless_]

Such a marvelous conf. An icebreaker opportunity for me since it was my first time as a speaker. If you are curious go take a look at our talk. @dcdelia

[No Hat Con @nohatcon]

⚠️Talks recordings available on our YT channel https://t.co/M4yzVPam1t Thanks again to all our speakers for making #nohat2021 such great event! @embyte @daviddiaul @gannimo @fabsx00 @ursachec @EranShimony @OcamRazr @LimitedResults @dcdelia @mattless_ @hookgab @Kapellmann @FlUxIuS

[Michael Gillespie @demonslay335]

💡 Bit of advice for #ransomware devs... Use SetFilePointerEx, 🛑 NOT 🛑 SetFilePointer.
Don't be like AvosLocker, who fuck up tons of data in the middle of 4GB+ files because they ignore the high move value and return... Pays to read the damn documentation. 📚

[Dr. Brok @sebbfar]

@diversenok_zero And the code: https://t.co/aB6TXK2cv9