A big honor to coauthor with @abc_sup and Gulshan the very first blog from Android Red Team on analysis and exploitation of CVE-2023-20938 in Android Binder driver at https://t.co/UF6nlbbzqT 🔥
The slide-deck presented at @offensive_con is available at https://t.co/CYzOLpWK0B
My new article: "Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel"⚡️
I tell a bug collision story and introduce my pet project kernel-hack-drill, which helped me to exploit the hard bug that received @PwnieAwards 2025
https://t.co/0DJzCJYEfm
Slides for my talk at @h2hconference 2024:
Diving into Linux kernel security 🤿
I described how to learn this complex area and knowingly configure the security parameters of your Linux-based system.
And I showed my open-source tools for that purpose!
https://t.co/5VXLNnuDe5
Excited to share our latest post on memory safety! We're tackling spatial safety in our massive C++ codebase by hardening libc++ *by default*. It adds bounds checks to things like std::vector, preventing a fair bit of out-of-bounds vulnerabilities: https://t.co/Dek3jJaTxn
“Break into the world of vulnerability research... and become a zero-day hunter.” I have a new book with @nostarch!
Behind the curtain of zero-day research, there are fundamental building blocks you can learn. In early access now and out in Spring 2025!
https://t.co/aPcgtFKYMi
Getting made fun of because you cover laptop webcam with a sticker? 😭
Here are materials from my talk about controlling ThinkPad X230 webcam LED over USB presented at POC by @POC_Crew 😎
Use these as a comeback 😁
Slides: https://t.co/REAm5XYAPm
Code: https://t.co/qxlPG6FMVK
A while ago I've given a talk on how to build exceptional security research teams: https://t.co/IUOLEdYNnI - I continue convinced that is all that is needed. The adage "Great people leave managers, not companies" continues to be true.
CVE-2024-9143 (https://t.co/ApXML9Eiuv) was disclosed recently, which was found by OSS-Fuzz-Gen! This is a pretty proud example of our team showing the promise of leveraging LLMs enable more fuzzing coverage.
I've written a post on SELinux and some public bypasses for Android kernel exploitation. It's especially relevant for Samsung and Huawei devices due to their use of hypervisors. Check it out here: https://t.co/UHesQZgjuv
IDAlib is the first idiomatic Rust bindings library for @HexRaysSA IDA SDK, helping go beyond C/C++ or Python in RE automation. Huge thanks to @xorpse for making it happen! Binarly team ❤️ Rust 🙌
🛠️use idalib::idb::*;
🦀https://t.co/FVnTJmKezi
We have cleaned up the #LibAFL example fuzzers!
This makes things easier to find and understand.
Thanks to @rmalmain
Take a look 👀👀
https://t.co/5W2tPWyJsT
I’m super excited about this blogpost. The approach is so counterintuitive, and yet the results are so much better than anything else that we’ve tried for memory safety. We finally understand why.
https://t.co/cBc3gMLzO6
Exciting story on collaboration between Google Android Offsec and ARM product security on proactively securing Mali GPU attack surface in Android and beyond. Among proactively identified and mitigated issues is CVE-2024-0153 in GPU firmware.
We teamed up with @Arm to boost GPU security on #Android! Fuzzing, firmware analysis, and close collaboration led to key vulnerability discoveries and a stronger #Android ecosystem. Read more in our joint blog: https://t.co/3daV3ZWHx7
Continuing the series on exploiting Android Binder with Binder internals blog https://t.co/PS2g21SGLi Deep dive into Binder driver by @abc_sup and Gulshan. We also release https://t.co/IoTE5Eex4P -- tiny lib featuring how to do IPC via Binder driver. Happy Binder hacking!
A big honor to coauthor with @abc_sup and Gulshan the very first blog from Android Red Team on analysis and exploitation of CVE-2023-20938 in Android Binder driver at https://t.co/UF6nlbbzqT 🔥
The slide-deck presented at @offensive_con is available at https://t.co/CYzOLpWK0B
Slides and recording from my "SLUB Internals for Exploit Developers" talk at @LinuxSecSummit yesterday 🥳
Slides: https://t.co/wleH6nJDeW
Slides PDF: https://t.co/1x5cvc6wjh
Recording: https://t.co/jjzxebiBOp