johannes

retweets are my not own 😺
occasionally dyhszlkehktikc

[johannes @wiknerj]

@satoki00 Congrats! 👏👏

[johannes @wiknerj]

CVE-2026-71151: Retbleed guest->host on virtualbox :)

[johannes @wiknerj]

Tomorrow I have the final slot at SEC-T. Still there are hypervisors do no not consider the threat of Spectre vulns worth mitigating. Let's see how they can be exploited end-to-end :)

[SEC-T @SEC_T_org]

Speaker spotlight -- johannes wikner.

They'll be presenting:
"Is Spectre Dead Yet? Eight Years In, Hypervisors Still Pwnable"

Day 2 | Main hall

See you in Stockholm.

#SECT #infosec #platformsecurity #exploitdev

[johannes @wiknerj]

@0xjprx amazing

[Daniël Trujillo @thedantrujillo]

Ever make a mistake when interrupted? So does your CPU! We identify Time-of-Neutralization-to-Time-of-Use (TONTOU) windows in Spectre mitigations, and introduce Interrupt Injection as a novel primitive to exploit these windows.

https://t.co/Tr6lcWx1H3

[johannes @wiknerj]

🚨 Breaking: AI agents aren’t “productivity tools.”

Individuals pushing massive amounts of code.

This isn’t just automation. It’s leverage.

[Garry Tan @garrytan]

Absolutely insane week for agentic engineering

37K LOC per day across 5 projects

Still speeding up

[Alex Mordvintsev @zzznah]

Working on the new simulator. I just wanted to see what Atari2600 fetching data from ROM looks like at CMOS FET level
(@tinytapeout TT09 Atari circuit by @__ReJ__)

[Eduardo Vela @sirdarckcat]

Me: Power corrupts
@wiknerj: Rowhammer is a good example of that

[johannes @wiknerj]

@__sethJenkins we made use of this repro retbleed on arm64 back some 3-4 years ago. Didn't care too much since KASLR is not really a problem for local attackers. We were hoping this was upstream arm64 local: "Android can't be _that_ bad." whops

[Google VRP (Google Bug Hunters) @GoogleVRP]

Our latest post details how we exploited Retbleed (a CPU vulnerability) to compromise a machine from a sandboxed process and VM!

Curious? 👇

https://t.co/CSD8kdlBjD

[johannes @wiknerj]

Great selection - in particular nr 6 😎
Excited for #blackhat2025. Hope to see many new and familiar faces in Vegas in the upcoming days :)

[Mr. Anthony 安東尼 @darkfloyd1014]

Blackhat USA 2025 will happen soon, this is my personal top 12 master selection:

1. HTTP/1.1 Must Die! The Desync Endgame
Speaker: James Kettle
Tracks: Application Security: Offense, Application Security: Defense
Format: 40-Minute Briefings
Location: Oceanside A, Level 2

2. Invitation Is All You Need! Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite
Speaker: Ben Nassi, Speaker: Or Yair, Speaker: Stav Cohen
Track: AI, ML, & Data Science
Format: 40-Minute Briefings
Location: Oceanside A, Level 2

3. Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Applications
Speaker: Fengyu Liu, Speaker: YouKun Shi, Contributor: Tian Chen, Contributor: Bocheng Xiang, Contributor: Junyao He, Contributor: Qi Li, Contributor: Guangliang Yang, Contributor: Yuan Zhang, Contributor: Min Yang
Tracks: Application Security: Offense, Exploit Development & Vulnerability Discovery
Format: 30-Minute Briefings
Location: Jasmine A & E, Level 3

4. Protecting Small Organizations in the Era of AI Bots
Speaker: Rama Hoetzlein
Tracks: Defense & Resilience, AI, ML, & Data Science
Format: 40-Minute Briefings
Location: Islander F & G, Level 0 - North Convention Center

5. Keynote: Chasing Shadows: Chronicles of Counter-Intelligence from the Citizen Lab
Speaker: Ron Deibert
Track: Keynote
Format: 40-Minute Keynote
Location: Oceanside A, Level 2

6. Racing for Privilege: Leaking Privileged Memory From Any Intel System Using a Microarchitectural Race Condition
Speaker: Sandro Rüegge, Speaker: Johannes Wikner
Tracks: Platform Security, Exploit Development & Vulnerability Discovery
Format: 30-Minute Briefings
Location: Mandalay Bay H, Level

7. Hackers Dropping Mid-Heist Selfies: LLM Identifies Information Stealer Infection Vector and Extracts IoCs

Estelle Ruellan | Threat Intelligence Researcher, Flare
Olivier Bilodeau | Principal Security Researcher, Flare
Date: Wednesday, August 6 | 3:20pm-4:00pm ( Oceanside C, Level 2 )
Format: 40-Minute Briefings
Tracks: Malware, AI, ML, & Data Science

8. Keynote: Three Decades in Cybersecurity: Lessons Learned and What Comes Next
Speaker: Mikko Hypponen
Track: Keynote
Format: 40-Minute Keynote
Location: Michelob ULTRA Arena, Concourse Level

9. Breaking Out of The AI Cage: Pwning AI Providers with NVIDIA Vulnerabilities

Andres Riancho | Security Researcher, Wiz
Hillai Ben-Sasson | Security Researcher, Wiz
Ronen Shustin | Security Researcher, Wiz
Date: Wednesday, August 6 | 11:20am-12:00pm ( Mandalay Bay H, Level 2 )
Format: 40-Minute Briefings
Tracks: Cloud Security, AI, ML, & Data Science

10. Booting into Breaches: Hunting Windows SecureBoot's Remote Attack Surfaces
Speaker: Jietao Yang
Tracks: Exploit Development & Vulnerability Discovery, Platform Security
Format: 40-Minute Briefings
Location: Islander E & I, Level 0 - North Convention Center

11. Burning, Trashing, Spacecraft Crashing: A Collection of Vulnerabilities That Will End Your Space Mission

Andrzej Olchawa | Offensive Security Researcher, VisionSpace Technologies GmbH
Milenko Starcik | Head of Cyber Security, VisionSpace Technologies GmbH
Ricardo Fradique | Cybersecurity Engineer, VisionSpace Technologies GmbH
Ayman Boulaich | Cybersecurity Intern, VisionSpace Technologies GmbH
Date: Wednesday, August 6 | 2:30pm-3:00pm ( Mandalay Bay H, Level 2 )
Format: 30-Minute Briefings
Tracks: Exploit Development & Vulnerability Discovery, Application Security: Offense

12. Dark Corners: How a Failed Patch Left VMware ESXi VM Escapes Open for Two Years
Speaker: Yuhao Jiang, Contributor: Xinlei Ying, Speaker: Ziming Zhang
Tracks: Exploit Development & Vulnerability Discovery, Cloud Security
Format: 40-Minute Briefings
Location: Jasmine A & E, Level 3

@BlackHatEvents

https://t.co/zz9YlaQUjy

[Brad Spengler @spendergrsec]

Huh, I didn't realize that the vibe-coded vulns inserted into 5 LTS kernels that still aren't fixed 22 days later haven't been fixed because the person who inserted them is busy telling everyone at a conference how great the AI he used to insert the vulns (that he didn't find) is

[johannes @wiknerj]

@UnderCoercion way to make 4% difference look like 90%

[Kav @kavehrazavi]

Happy to announce that the paper about IBPB problems that included the first real cross-process Spectre exploit just got a distinguished paper award at @IEEESSP! Dr. @wiknerj now has two of these awards in his thesis. What will he do next?!

[johannes @wiknerj]

Branch Race Conditions Predictor causes recent predictions to be added after more recent privilege switches (→ wrong privilege, eIBRS💥) prediction flushes (→ retained valid, IBPB💥) finish.

@sparchatus eventually figured it out 🙌

[Sandro @sparchatus]

Disclosing Branch Predictor Race Conditions (BPRC), a new class of vulnerabilities where asynchronous branch predictor operations violate hardware-enforced privilege and context separation in virtually all recent Intel CPUs. @wiknerj @kavehrazavi : https://t.co/sbI0Iqb2PS

[VUSec @vu5ec]

Spectre v2 is back again! Disclosing "Training Solo": 3 new self-training attack classes, 2 end-to-end exploits, and 2 new hardware issues that break domain isolation even when implemented perfectly. Joint work by @SanWieb @c_giuffrida: https://t.co/q957LoPrXe

[Patrick @pjattke]

🔨 Posthammer (USENIX Sec '25) brings Rowhammer back in the browser!

What if visiting a website was enough to trigger a Rowhammer attack? Posthammer shows how to bring non-uniform Rowhammer patterns into the browser.

More information: 📄https://t.co/AFop8i7Xs0

[Battle Programmer Yuu @netspooky]

The @phrack 72 CFP horny emojipasta has hit the chats

[johannes @wiknerj]

Thanks for the 21st @h2hconference! Always a joy to meet the mix of researchers, enthusiasts, academics, hackers. Special thanks to the organizers and yes the 🚌 trip to Rio went smoothly @bsdaemon @gabrielnb 😄 has a moment to enjoy this very special zine on the journey..

[johannes @wiknerj]

@bsdaemon Thanks for everything you've done for H2HC!