Zeronomicon

Premium Exploit Acquisition Platform -- There are only 10 types of unknowns: those known, and those unknown.

[Zeronomicon @zeronomicon]

We turn down sellers, as we do with buyers. No Problemo. #NoProblemo

[Alfonso De Gregorio (@secyoure.bsky.social) @secYOUre]

What stops a well-intentioned exploit seller from disclosing his/her identity? Or, the assumptions has to be rethought, as per usual. #0days

[Zeronomicon @zeronomicon]

We will repeat it here, if ever there was the need for it:
There is no way to establish a working relationship with us from an anonymous/pseudonymous contact.

We hide the seller's identity to the buyer, and the buyer's identity to the seller. But we know each other.

[Zeronomicon @zeronomicon]

"Uh-uh-uh, you don't have the magic word!"

[Alfonso De Gregorio (@secyoure.bsky.social) @secYOUre]

#Plundervolt reminded me about DUDA, a novel malware class I introduced in 2003 (!!) in a COSIC seminar, during my time at KULeuven. DUDAs exploit workload characteristics (e.g., memory allocation patterns) to maximize the probability of observing faults https://t.co/TOayID3PE1

[Zeronomicon @zeronomicon]

Dropping an email from Protonmail is not a working recipe for establishing a fresh professional collaboration with us.

[Zeronomicon @zeronomicon]

CRSAH is the new HODL.

[Zeronomicon @zeronomicon]

Dear Friends, if you happen to be in town, join us tonight at the Atrium of the Court Church in #INNSBRUCK for some nice drinks. ;) We’ll be speaking about the past, present, and, most importantly, the future of vulnerability markets. See you in the capital of the Alps! #zeronomi

[Alfonso De Gregorio (@secyoure.bsky.social) @secYOUre]

@verovaleros @blackswanburst Counterpoint: Exploits can be understood as constructive proofs of the underlying vulnerabilities. And they can be validated by execution.

[Zeronomicon @zeronomicon]

@cypherseek MD5 hashes are 32bytes quantities. Here you've 60 chars. There is a well known prefix, that tells you this is simply an encoded bcrypt hash

[Zeronomicon @zeronomicon]

@cypherseek Hint: you can learn what is that by inspection ;)

[Zeronomicon @zeronomicon]

@cypherseek I'm so sorry; it was something more exotic than that

[Zeronomicon @zeronomicon]

@cypherseek Hey, thanks for asking. This challenge closed after #eko12. Yet, there will be many more to come. You're welcome to take part! Stay tuned ;)

[Alfonso De Gregorio (@secyoure.bsky.social) @secYOUre]

me: Gee, Brain, what do you want to do tonight?
@caseyjohnellis: The same thing we do every night, Pinky - try to take over the world!

[Alfonso De Gregorio (@secyoure.bsky.social) @secYOUre]

.@caseyjohnellis looking forward to part 2, as I'm truly happy to meet around & catch up w/ you - especially now that we're both Down Under!

[Zeronomicon @zeronomicon]

Windows 10 Version 1607 (Build 14393.693) LPE. Wishing you a very #HNY! The best is yet to come. #0day #Exploit

[Zeronomicon @zeronomicon]

#ZeroNights privet! We pay you $200,000 USD for a RCE on Microsoft Outlook on the web (OWA). Details at https://t.co/63icRw69Uw #exploit

[Zeronomicon @zeronomicon]

안녕하세요 #POC2016! 웹에서 Microsoft Outlook 원격코드실행(OWA)이 가능할 경우 $200,000 USD 상당의 상금을 부여합니다.

[Alfonso De Gregorio (@secyoure.bsky.social) @secYOUre]

@4Dgifts hey, provide me w/ your fave shipping address and you'll have'em. In BA @zeronomicon offered USB armories, books, and t-shirts :)

[Zeronomicon @zeronomicon]

Do you want to have your #free pair of slipper socks? Sure! Yet one more reason to join us at our booth at #POC2016 in Seoul on Nov 10-11 https://t.co/mMnFNCowP8

[Alfonso De Gregorio (@secyoure.bsky.social) @secYOUre]

On the way to #POC2016. It's a long jump to Seoul. But I've w/ me the @zeronomicon brand(ed) new slipper socks to pull up and stay happy! :)

[Zeronomicon @zeronomicon]

안녕하세요! We are honored to be a sponsor of #POC2016 to be held in Seoul, Korea on Nov 10-11. We're there to reward big your research. Join us!