I found a Linux 0day vuln with @rqda_A, and $80,000+ rewarded for it by Google kernelCTF!
The vuln has been surprisingly hidden for about 19 years.
We've published an English version of the blog post!
https://t.co/Xsx1GyEtT4
Onelogon: Taking over Active Directory Accounts via Netlogon🔑
We analyzed Netlogon, bypassed the Zerologon patch, resulting in a full auth bypass. An attacker can leverage this to compromise computer accounts, or even the entire AD. Non-standard config must be present tho 🧵
‼️🚨 Security researcher ggwhyp demonstrated a full-chain Firefox exploit on Windows.
He opens an HTML page, Firefox runs the code, cmd.exe spawns, Calculator opens. Signature of a browser-to-OS exploit.
Prepared for Pwn2Own. ZDI rejected it. According to the researcher, it was responsibly disclosed to Mozilla.
I just reverse engineered the YellowKey BitLocker bypass
Microsoft shipped code that checks for a flag called "FailRelock" in every Windows 11 recovery image. When it's set to 1, after recovery unlocks your BitLocker drive, it never relocks it. All you need is a USB stick.
This code only exists in the recovery environment. Not in normal Windows. They left an entire debug testing framework in production.
.LNK files are implemented as COM objects. You need IShellLink + IPersistFile to create, read, or modify them programmatically. New video + write-up, code included, security angle too. https://t.co/rXhnOQSyxd
📦LiveContainer IPA Installer can run an unlimited number of apps for free without TrollStore or a jailbreak 🔖
https://t.co/XgOKbCd1mE
Here's a full guide on how to install LiveContainer on any iPhone or iPad! It works on-device🚀