Phuong Nguyen

[Phuong Nguyen @pdnx00]

@thegrugq Maybe NSA never got discovered?? :D

[TyphoonCon🌪️ @typhooncon]

🌪️ SOS! Thai Nguyen & Chuong Nguyen are showing us how to discover and exploit 0-days from 1-days at scale

[Cyber Advising @cyber_advising]

CVE-2024-7479 & CVE-2024-7481: exploit proof of concept of a vulnerability in TeamViewer that enables an unprivileged user to load an arbitrary Kernel Driver into the system.

PoC
https://t.co/VpW1aNdYW5

[Michael Bargury @mbrg0]

we got an ~RCE on M365 Copilot by sending an email

by ~RCE I mean full remote control over
its actions - search for sensitive content (sharepoint, email, calendar, teams), execute plugins
and outputs - bypass DLP controls, manipulate references, social engineer its users on our behalf
#BHUSA #DEFCON @tamirishaysh

[JD Work @HostileSpectrum]

If a single corrupted driver can BSOD Windows this badly, there is likely some very interesting attack surface just below the rotten wood here. The amount of offensive cap dev investment surging into weaponizing this potential over this weekend alone is likely to be surprising.

[chompie @chompie1337]

microsoft: Exploit Code Unporoven

me: i literally gave you a compiled PoC and also exploit code

m$: No exploit code is available, or an exploit is theoretical.

me:

[Rebane @rebane2001]

just finished a new blogpost on how i exploited the V8 javascript engine at a CTF!

it's a beginner friendly journey from a memory corruption to a browser pwn, and features lots of cool CSS to help you understand various concepts along the way.

have fun!!
https://t.co/rByOeFSwDP

[MalwareHunterTeam @malwrhunterteam]

😂

[blasty @bl4sty]

the xz sshd backdoor rabbithole goes quite a bit deeper. I was just able to trigger some harder to reach functionality of the backdoor. there's still more to explore.. 1/n

[raptor @0xdea]

Two Bytes is Plenty: #FortiGate #RCE with CVE-2024-21762 ✊

https://t.co/riQiuMpKSV

https://t.co/E2DIsXJuhc

[Prof. Feynman @ProfFeynman]

Teaching is a powerful tool to learning.

[James Forshaw @tiraniddo]

I try an avoid this hellsite, but I did a quick dive into sudo in Windows and here are my initial findings. https://t.co/Q1k1KAUlmB

The main take away is, writing Rust won't save you from logical bugs :)

[Phuong Nguyen @pdnx00]

@thegrugq Managing the company better than us and many other people

[Bogdan Djukic @bdjukic]

A group of security researchers from Technical University in Berlin managed to get root access to @Tesla's Autopilot computer by exploiting Secure boot mechanism with voltage glitching. #37c3 #tesla #carhack

[raptor @0xdea]

Exploring UNIX pipes for #iOS #kernel #exploit primitives

https://t.co/O54bxeg3vn

https://t.co/9Me5UNAdg1

[Phuong Nguyen @pdnx00]

:)) ransomware and compliance as a service...

[Alexander Leslie @aejleslie]

…what.

I don’t know what to say about this one. Is this a first?

It appears that the ALPHV (BlackCat) ransomware group has…filed an SEC complaint on behalf of one of their victims. Are we entering into a new era of extortion via compliance failure?

I have questions…

[ringzerø.training && @[email protected] @_ringzer0]

Escaping the Google kCTF container with a Data-only exploit https://t.co/VEsWV4LbA2

[Today In Infosec @todayininfosec]

1996: "Smashing The Stack For Fun And Profit" was published in the hacker zine, Phrack. The article by Elias Levy (aka Aleph One) introduced many to stack buffer overflow vulnerabilities and how to exploit them.

[Jesse D'Aguanno @0x30n]

Want to level up your exploit development skills?

CTFs are great, I owe a lot of my early education to them, but there’s often a significant disconnect between real world vulnerabilities and CTF challenges.

I advise writing exploits for n-days. Find CVEs that seem interesting and write an exploit for it. To start, choose ones that have working PoCs and full write ups. That way you know it’s exploitable.

This removes one of the biggest challenges for new vuln researchers — the unknown.

Jumping into a new target can be daunting not knowing if there’s anything to find. Building the skill and intuition to know where to look and when to stop takes time and experience.