ZwClose

[ZwClose @zwclose]

Multiple vulnerabilities in the Realtek card reader driver. The vulns allow a non-privileged user to write to virtual kernel memory and gain access to physical memory via the DMA controller. Dell, Lenovo and other OEMs affected. The first part of the post: https://t.co/BJhP76fNdA

[ZwClose @zwclose]

@dcolascione @karollooool The vuln resurfacing period sheds some light on the average employment time in the project.

[ZwClose @zwclose]

@PetrBenes Not sure about analogy, but hasn't "asking AI for code and making sure it's correct" become the new norm? At least for routine tasks? There's definitely a shift and it feels that there will be even more of it.

[ZwClose @zwclose]

Some researcher has a grudge against Microsoft

[cr3ghost @cr3ghost]

One anonymous researcher dropped 9 working Windows zero-days in 3 months. Each one timed for the day after Patch Tuesday to maximize the unpatched window. The latest one, LegacyHive, dropped 17 hours ago.

BlueHammer. RedSun. UnDefend. YellowKey. GreenPlasma. MiniPlasma. RoguePlanet. GreatXML. LegacyHive. All targeting Windows Defender, BitLocker, and core Windows components.

Three were exploited in the wild before patches shipped. CISA added them to KEV. Huntress confirmed live intrusions using BlueHammer, RedSun, and UnDefend together in a single attack chain.

MiniPlasma revived a 2020 Google Project Zero bug that Microsoft said was fixed. The original PoC still worked unmodified. Six years “patched.”

Microsoft invoked its Digital Crimes Unit and called it criminal activity. GitHub banned the repos. GitLab banned the repos. The same pattern we saw with @jonasLyk @WeirdQuadratic and @5mukx. The community pushed back hard. Microsoft walked it back within days.

The researcher self-hosted on their own Gitea server. “Microsoft cannot unwrite my code.”

Blog: https://t.co/bmBCvUbhCd

Blogspot: https://t.co/FCwXHUwpqL

GitHub: https://t.co/kDKoj1R9vO

Gitea: https://t.co/LpZmYRHd50

@ChaoticEclipse0

#InfoSec #WindowsInternals #ThreatIntel

[ZwClose @zwclose]

@vxunderground I guess this is the right name for it: https://t.co/moZlEYT24W

[ZwClose @zwclose]

@67_throwaway Network implies RCE, definitely worth looking!

[ZwClose @zwclose]

A vulnerability in Realtek's card reader driver allows non-privileged users to program the DMA controller, enabling arbitrary physical memory reads and writes. Neither additional hardware nor a custom kernel driver is required to exploit the vuln. Details: https://t.co/yyrtYjeYW2

[ZwClose @zwclose]

@0gtweet Would it save this guy from arrest: https://t.co/LfJ4u8ewIX ? Seriously, though, I've never heard of that, should try it.

[vx-underground @vxunderground]

> Peter Stokes
> Scattered Spider guy
> Arrested
> Microsoft helps FBI
> Read court documents
> Page 12
> Microsoft tracks Stokes from GDID
> Microsoft Global Device Identifier (GDID)
> Stokes used Windows
> Page 34
> GDID assigned to each OS install
> GDID unique to each device
> GDID only change if OS wiped
> Stokes GDID 6755467234350028
> GDID reported internet activity to Microsoft
> GDID showed Stokes using Ngrok
> GDID reported Stokes IP address
> GDID showed Stokes web activity
> GDID showed timestamps of web activity
> GDID mapped with video game activity
> GDID showed games played
> GDID undocumented
> GDID only mentioned in one MSDN document
> Azure UCDOStatus
> Azure Monitor Logging

[ZwClose @zwclose]

@vxunderground @s00pcan I can only interpret the placement of the TL;DR at the end of the post as a twisted form of sadism.

[ZwClose @zwclose]

@PetrBenes Can't say that I disagree with that, especially after seeing this: https://t.co/HeLijo5d81

[kernullist @kernullist]

Just shipped a WinDbg x64 extension that turns live disassembly into verified pseudocode via LLM — chunked multi-pass analysis, in-process HTTP, mock fallback, and a verification pass that cross-checks LLM output against original analysis facts.
https://t.co/8rXb1fGOuT

[ZwClose @zwclose]

When it comes to Windows kernel networking, ChatGPT becomes pretty hallucinatious. Once I spent an hour looking for a non-existent !wfp extension, which GPT recommended to me, and now it's suggesting !afd.

By the way, these extensions would be very useful if they existed.

[ZwClose @zwclose]

@HaifeiLi Yesterday I spent an hour searching for a WinDbg extension that doesn't seem to exist; I fell to Copilot's hallucination. I also watch the selloff, but I'm sure it will bounce back.

[Michael Maltsev @m417z]

Check out the KUSER_SHARED_DATA docs that were submitted to NtDoc by @sixtyvividtails, and are probably the most comprehensive source of information about this struct known to humanity.
https://t.co/5tuv09ckJj
Also featured on @pagedout_zine, issue #7, page 33, check it out!

[ZwClose @zwclose]

@artem_i_baranov Considering Intel's recent performance, they either didn't read the Grove's book or it's not that helpful :)

[ZwClose @zwclose]

Older WDKs are back! With each update Microsoft dropped pieces like code samples, so I hoarded a few WDKs, and even planned to search far corners of the web to get more. This is not needed anymore: MS just published a collection of legacy WDKs: https://t.co/YRiXBXhL8R

[ZwClose @zwclose]

@yo_yo_yo_jbo This post is not only interesting, but also demonstrates that readme md can be a blogging platform.

[Jonathan Bar Or (JBO) 🇮🇱🇺🇸🇺🇦 @yo_yo_yo_jbo]

This blogpost is interesting - has Windows internals, my own novel solution to a problem red teamers have had for a while, EDR bypasses, debugging and much more.
Spoofing command lines on Windows and solving the problem of length limitations:
https://t.co/4R5FCfNvsV

[ZwClose @zwclose]

@FuzzySec Hey, I have a conference-related question, may I dm?