trotmaster

[TrendAI Zero Day Initiative @thezdi]

Success! The @mwrlabs wrapped up the #Pwn2Own Tokyo contest with a successful demonstration of a browser exploit on the #Xiaomi Mi6. Now off to the disclosure room for details and verification.

[trotmaster @trotmaster99]

What an event. Massive thanks to the @zdi team for running this year's #P2Otokyo . And big shout out to @fluoroacetate for a seriously impressive set of submissions!

[TrendAI Zero Day Initiative @thezdi]

Confirmed! @mwrlabs popped a captive portal with no user interaction, followed by an unsafe redirect and an unsafe application load to get code execution on the #Samsung #Galaxy S9. The exploit chain earns them another $30K and 6 more Master of Pwn points.

[TrendAI Zero Day Initiative @thezdi]

Confirmed! The folks from @mwrlabs chained together 5 different logic bugs - including the silent installation of an app via JavaScript - to get code execution over Wi-Fi on the #Xiaomi Mi6. They earned themselves $30K USD and 6 Master of Pwn points.

[TrendAI Zero Day Initiative @thezdi]

#Pwn2Own Tokyo is underway! The contest order has been decided via random drawing. Our program starts with @fluoroacetate targeting the #Xiaomi Mi6 with an NFC exploit. See the full schedule and updated results at https://t.co/KOA4HJYUvy. #P2OTokyo

[TrendAI Zero Day Initiative @thezdi]

The drawing to determine the order of attempts will be at 9am tomorrow with the first attempt coming at 9:30. Until then, enjoy this preview of the Master of Pwn jackets.

[trotmaster @trotmaster99]

Using @intel Remote Web Console? Time to patch! https://t.co/XZn7NWtZgS

[Ben Hawkes @benhawkes]

Project Zero blog: "OATmeal on the Universal Cereal Bus: Exploiting Android phones over USB" by @tehjh - https://t.co/fCsz8WUgvF

[TrendAI Zero Day Initiative @thezdi]

Announcing #Pwn2Own Tokyo 2018. This year, we bring #IoT devices along with phones as targets. Over $500,000 USD available in cash and prizes. Get all the details here: https://t.co/BQOe6uFg1v. See you in Tokyo! #P2OTokyo

[WithSecure Labs @FSecureLabs]

#DNSRebinding isn't just for owning your router, it's also for owning your #AWS #cloud deployments, @alxk_mwr pops headless analytics services https://t.co/n25SE8BomZ

[trotmaster @trotmaster99]

Awesome news to wake up to. Thanks everyone!!!

[@mikko @mikko]

@trotmaster99 @munmap Congrats! You just won a Pwnie!

[Pwnie Awards @PwnieAwards]

The 2018 Pwnie Awards nominees are up!

https://t.co/QBbaxuPNQd

[Jake Archibald @jaffathecake]

📝 New post! I stumbled across a serious browser security bug & I can finally talk about it. The post covers:

➡️ An exciting new logo.
➡️ Range requests.
➡️ "No-cors" requests.
➡️ Sneaking past origin security.
➡️ The importance of standards.

https://t.co/0hyb1dKBB0

[trotmaster @trotmaster99]

@mikko Thanks Mikko!

[WithSecure™ @WithSecure]

A very warm welcome to F-Secure @mwrinfosecurity! F-Secure takes a big step towards cyber security leadership by acquiring MWR InfoSecurity https://t.co/3b4sxzd2gS

[Alex Plaskett @alexjplaskett]

Last batch of bugs now patched from Mobile Pwn2own 2017 for the Huawei Mate 9 Pro: https://t.co/0HlNDU7JOR. Tech whitepaper to follow later in the week #pwn2own

[trotmaster @trotmaster99]

This year at @InfiltrateCon we're being honest, both with our exact methodology for pwn2own, and with our tour T-shirts ;)

[trotmaster @trotmaster99]

@munmap

[trotmaster @trotmaster99]

😢 https://t.co/0XtkOtT5Dw

[Richard Johnson @richinseattle]

Cool research from Georgi https://t.co/9wheGwZsUW

[F-Secure Consulting @FSecure_Consult]

At #CYBERUK18 next Tuesday? Our very own Robert Miller and Georgi Geshev talk vulnerabilities and automating the research process to make efficiency savings [14:50 - Exchange Auditorium] | #infosec #vuln https://t.co/sIePDknFBt