Working on the new simulator. I just wanted to see what Atari2600 fetching data from ROM looks like at CMOS FET level
(@tinytapeout TT09 Atari circuit by @__ReJ__)
@__sethJenkins we made use of this repro retbleed on arm64 back some 3-4 years ago. Didn't care too much since KASLR is not really a problem for local attackers. We were hoping this was upstream arm64 local: "Android can't be _that_ bad." whops
Our latest post details how we exploited Retbleed (a CPU vulnerability) to compromise a machine from a sandboxed process and VM!
Curious? 👇
https://t.co/CSD8kdlBjD
Blackhat USA 2025 will happen soon, this is my personal top 12 master selection:
1. HTTP/1.1 Must Die! The Desync Endgame
Speaker: James Kettle
Tracks: Application Security: Offense, Application Security: Defense
Format: 40-Minute Briefings
Location: Oceanside A, Level 2
2. Invitation Is All You Need! Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite
Speaker: Ben Nassi, Speaker: Or Yair, Speaker: Stav Cohen
Track: AI, ML, & Data Science
Format: 40-Minute Briefings
Location: Oceanside A, Level 2
3. Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Applications
Speaker: Fengyu Liu, Speaker: YouKun Shi, Contributor: Tian Chen, Contributor: Bocheng Xiang, Contributor: Junyao He, Contributor: Qi Li, Contributor: Guangliang Yang, Contributor: Yuan Zhang, Contributor: Min Yang
Tracks: Application Security: Offense, Exploit Development & Vulnerability Discovery
Format: 30-Minute Briefings
Location: Jasmine A & E, Level 3
4. Protecting Small Organizations in the Era of AI Bots
Speaker: Rama Hoetzlein
Tracks: Defense & Resilience, AI, ML, & Data Science
Format: 40-Minute Briefings
Location: Islander F & G, Level 0 - North Convention Center
5. Keynote: Chasing Shadows: Chronicles of Counter-Intelligence from the Citizen Lab
Speaker: Ron Deibert
Track: Keynote
Format: 40-Minute Keynote
Location: Oceanside A, Level 2
6. Racing for Privilege: Leaking Privileged Memory From Any Intel System Using a Microarchitectural Race Condition
Speaker: Sandro Rüegge, Speaker: Johannes Wikner
Tracks: Platform Security, Exploit Development & Vulnerability Discovery
Format: 30-Minute Briefings
Location: Mandalay Bay H, Level
7. Hackers Dropping Mid-Heist Selfies: LLM Identifies Information Stealer Infection Vector and Extracts IoCs
Estelle Ruellan | Threat Intelligence Researcher, Flare
Olivier Bilodeau | Principal Security Researcher, Flare
Date: Wednesday, August 6 | 3:20pm-4:00pm ( Oceanside C, Level 2 )
Format: 40-Minute Briefings
Tracks: Malware, AI, ML, & Data Science
8. Keynote: Three Decades in Cybersecurity: Lessons Learned and What Comes Next
Speaker: Mikko Hypponen
Track: Keynote
Format: 40-Minute Keynote
Location: Michelob ULTRA Arena, Concourse Level
9. Breaking Out of The AI Cage: Pwning AI Providers with NVIDIA Vulnerabilities
Andres Riancho | Security Researcher, Wiz
Hillai Ben-Sasson | Security Researcher, Wiz
Ronen Shustin | Security Researcher, Wiz
Date: Wednesday, August 6 | 11:20am-12:00pm ( Mandalay Bay H, Level 2 )
Format: 40-Minute Briefings
Tracks: Cloud Security, AI, ML, & Data Science
10. Booting into Breaches: Hunting Windows SecureBoot's Remote Attack Surfaces
Speaker: Jietao Yang
Tracks: Exploit Development & Vulnerability Discovery, Platform Security
Format: 40-Minute Briefings
Location: Islander E & I, Level 0 - North Convention Center
11. Burning, Trashing, Spacecraft Crashing: A Collection of Vulnerabilities That Will End Your Space Mission
Andrzej Olchawa | Offensive Security Researcher, VisionSpace Technologies GmbH
Milenko Starcik | Head of Cyber Security, VisionSpace Technologies GmbH
Ricardo Fradique | Cybersecurity Engineer, VisionSpace Technologies GmbH
Ayman Boulaich | Cybersecurity Intern, VisionSpace Technologies GmbH
Date: Wednesday, August 6 | 2:30pm-3:00pm ( Mandalay Bay H, Level 2 )
Format: 30-Minute Briefings
Tracks: Exploit Development & Vulnerability Discovery, Application Security: Offense
12. Dark Corners: How a Failed Patch Left VMware ESXi VM Escapes Open for Two Years
Speaker: Yuhao Jiang, Contributor: Xinlei Ying, Speaker: Ziming Zhang
Tracks: Exploit Development & Vulnerability Discovery, Cloud Security
Format: 40-Minute Briefings
Location: Jasmine A & E, Level 3
@BlackHatEvents
https://t.co/zz9YlaQUjy
Huh, I didn't realize that the vibe-coded vulns inserted into 5 LTS kernels that still aren't fixed 22 days later haven't been fixed because the person who inserted them is busy telling everyone at a conference how great the AI he used to insert the vulns (that he didn't find) is
Happy to announce that the paper about IBPB problems that included the first real cross-process Spectre exploit just got a distinguished paper award at @IEEESSP! Dr. @wiknerj now has two of these awards in his thesis. What will he do next?!
Branch Race Conditions Predictor causes recent predictions to be added after more recent privilege switches (→ wrong privilege, eIBRS💥) prediction flushes (→ retained valid, IBPB💥) finish.
@sparchatus eventually figured it out 🙌
Disclosing Branch Predictor Race Conditions (BPRC), a new class of vulnerabilities where asynchronous branch predictor operations violate hardware-enforced privilege and context separation in virtually all recent Intel CPUs. @wiknerj@kavehrazavi : https://t.co/sbI0Iqb2PS
Spectre v2 is back again! Disclosing "Training Solo": 3 new self-training attack classes, 2 end-to-end exploits, and 2 new hardware issues that break domain isolation even when implemented perfectly. Joint work by @SanWieb@c_giuffrida: https://t.co/q957LoPrXe
🔨 Posthammer (USENIX Sec '25) brings Rowhammer back in the browser!
What if visiting a website was enough to trigger a Rowhammer attack? Posthammer shows how to bring non-uniform Rowhammer patterns into the browser.
More information: 📄https://t.co/AFop8i7Xs0
Thanks for the 21st @h2hconference! Always a joy to meet the mix of researchers, enthusiasts, academics, hackers. Special thanks to the organizers and yes the 🚌 trip to Rio went smoothly @bsdaemon@gabrielnb 😄 has a moment to enjoy this very special zine on the journey..
The first ever end-to-end cross-process Spectre exploit? I worked on this during an internship with @grsecurity! An in-depth write-up here:
https://t.co/mze3LQkpJR
HW defenses against Spectre are tricky: they need to be applied correctly by the SW, and we need to trust that the HW does what its supposed to. Our latest work "Breaking the Barrier" exploits loopholes in both of these issues on Intel and AMD parts.
https://t.co/DBzOXdf75h