Matt Jones

%n

[Matt Jones @volvent]

/part

[Matt Jones @volvent]

@riskybusiness 🔥🔥🔥

[Matt Jones @volvent]

@Caiwrote That slide is pretty win

[Matt Jones @volvent]

@dave_au @ChangeAus "... and if they don't, we'll do it for them!"

🚔🚔🚔

[James Forshaw @tiraniddo]

New blog release "Accessing Access Token for UIAccess" on restoring some small part of the older token stealing attack which was killed in Windows 10 RS5. Contains an example PS script to script an admin command prompt 😄 https://t.co/dXFopv4A8j

[Matt Miller @epakskape]

Here's the video recording for my presentation at #bluehatil last week on "Trends, Challenges, and Strategic Shifts in the Software Vulnerability Mitigation Landscape" https://t.co/SHEILQmZRX

[Borys Popławski @boryspop]

Check out our blog post about research @adam_iwaniuk and I did that lead to CVE-2019-5736!
https://t.co/sxZJGvEZCL

[Project Zero Bugs @ProjectZeroBugs]

Android: binder use-after-free via fdget() optimization https://t.co/knDAZfApwe

[Matt Jones @volvent]

@k8em0 @S9k A leaderboard for orgs who've blown a fortune on bb lhf and neglected internal processes would be a neat spin. Yahoo/Oath and Shopify would be top 10 fo sure.

[j00ru//vx @j00ru]

For those interested in coverage-guided fuzzing, I've just released CmpCov - an instrumentation module for clang/SanitizerCoverage, which breaks down CMP/strcmp()/etc. into bytes and writes the extra coverage data to standard .sancov files. Get it here: https://t.co/eU1aHiswNT

[haroon meer @haroonmeer]

The always erudite @timoreilly on why the SV “blitzscaling” mantra causes more harm than good.

I feel that part of the reason so many security products are so user-hostile (& mostly suck) is because currently, VCs pick winners instead of customers.

https://t.co/9ODhFOaWVi

[Abhishek Arya @infernosec]

8 years and 27K bugs later, ClusterFuzz is now available for anyone to use - https://t.co/ahkqY6gvxe

[Matt Miller @epakskape]

Posted the slides from my #bluehatil talk covering trends, challenges, and strategic shifts in the software vulnerability landscape. Questions, comments, and alternative perspectives welcome 🙂 https://t.co/6IAzb2AaR8

[Katie🌻Moussouris (she/her/she-ra/she-hulk) 🪷 @k8em0]

I'm all for people being paid for their work.
I'm all for there being better channels for vuln disclosure making it easy for people to help protect the public.
I even totally get the need for an offense market.
The defense market would do well not to normalize extortion further.

[Matt Jones @volvent]

@0xCC_sh @lady_nerd Amazing 🔥

[Matt Jones @volvent]

@Infoschmeck @joshcorman @adamshostack @elttam Thx 😉

[Ben Hawkes @benhawkes]

Project Zero blog: "The Curious Case of Convexity Confusion" by Ivan Fratric (@ifsecure) - https://t.co/p5syliZdA3

[James Forshaw @tiraniddo]

To go with a release of NtObjectManager v1.1.19 I've written a brief history of BaseNamedObjects and the "new" BNO isolation feature sneaked into Windows 10. https://t.co/VJKA0CCyqP

[Ben Hawkes @benhawkes]

Project Zero blog: "Examining Pointer Authentication on the iPhone XS" by Brandon Azad (@_bazad) - https://t.co/KKrgNinRFB

[Matt Jones @volvent]

@damienmiller @mdowd Yeah in high school for me it was quite heavy, esp. with stolen generation