Security but not as in "national security". Playing CTFs with @redrocket_ctf (and @Sauercl0ud). Pwn2Own Vancouver 2020..=2024\{2023}. @manf@infosec.exchange
Outside of computed bounds
Joined January 2020
- Tweets91
- Following309
- Followers5.3K
- Likes405
Manfred Paul retweeted
CVE-2025-4941 - Trend ZDI analyst @hosselot details the Firefox bug used at #Pwn2Own Berlin by Manfred Paul. Includes root cause analysis and video demo. zerodayinitiative.com/blog/2…
If you're a security researcher and in Germany, consider signing cysec-reform.jetzt/ . Decriminalizing research might not be the top political priority right now, but it's still important!
Manfred Paul retweeted
@MITAmalta, this is not how you build up a cybersecurity community in your country. It was great to see a lot of ECSC players show their support people like @_mixy1 who faced both disqualification and legal action. As the vulnerability research community, we should do the same.
Had a great time playing for the German team at @ecsc2024, shout out to the organizers for putting on a really great competition!
Only low point though was the lack of a Maltese team, apparently due to @MITAmalta blocking some of the (already qualified) team from coming after they were arrested for responsibly disclosing(!) a vulnerability in a student app in 2022. timesofmalta.com/article/win…
@MITAmalta, this is not how you build up a cybersecurity community in your country. It was great to see a lot of ECSC players show their support people like @_mixy1 who faced both disqualification and legal action. As the vulnerability research community, we should do the same.
Manfred Paul retweeted
This strange tweet got >25k retweets. The author sounds confident, and he uses lots of hex and jargon. There are red flags though... like what's up with the DEI stuff, and who says "stack trace dump"? Let's take a closer look... 🧵1/n
Manfred Paul retweeted
Exploit for Pwn2Own CVE-2024-29943, an Integer Range Inconsistency caused OOB access! Analysis will be updated later. Shoutout to
@_manfp for finding this bug. And shoutout to @maxpl0it for his integer range inconsistent PoC.
github.com/bjrjk/CVE-2024-29…
Manfred Paul retweeted
Keeping open a bug to support a government operation is isomorphic to opening a backdoor to support a government.
I'm pretty sure you wouldn't want Google to keep a bug open for the benefit of China, Chris.
alecmuffett.com/article/1099…
Manfred Paul retweeted
theguardian.com/world/2022/f…
Is this the "counterterrorism operation" by a U.S.-allied Western government that's being referenced? If saying the country and "terrorist" group involved paints a flattering picture of these exploit tools, why aren't they saying which ones are involved?
This argument feels deeply unsettling to me. No matter your stance on states exploiting vulnerabilities, shifting the moral obligation to vendors and researchers and demanding they be complicit in it is a dangerous precedent and short-sighted.
New blog post "Google: Stop Burning Counterterrorism Operations"
My reflection on an incident where Project Zero and TAG knowingly shut down an active Western counterterrorism cyber operation, and the real-world harm that could have resulted from it.
poppopret.org/2024/06/24/goo…
This really just feels like the discourse of backdooring encryption all over again. There is no "secure but with exceptions for when the good guys need access". That's called being insecure.
Manfred Paul retweeted
This years Google CTF Qualification is over. Congratulations to @kalmarunionenDM, kijitora and Zer0RocketWrecks! The top 8 teams qualified for Hackceler8 2024 in Málaga. More details at goo.gle/ctf.
¡Vamos!
Manfred Paul retweeted
Good news: vote on chatcontrol postponed. But this monster keeps raising its head: efforts to stop it need to be continued.
Etappensieg: Die EU-Staaten einigen sich heute nicht auf eine Position zur #Chatkontrolle – Die Ratspräsidentschaft nimmt die Abstimmung von der Tagesordnung netzpolitik.org/2024/etappen…
Happy to have my write-up on @thezdi's blog again - after so many fights with some kind of range analysis, a bug that just directly gives every type confusion you want felt quite fun
In a new guest blog, #Pwn2Own winner @_manfp details CVE-2024-2887 - a bug he used to exploit both #Chrome and #Edge during the contest on his way to winning Master of Pwn. He breaks down the root cause and shows how he exploited it. Read the details at zerodayinitiative.com/blog/2…
Manfred Paul retweeted
Congrats to #Mozilla for being the first vendor to provide patches for bugs disclosed during #Pwn2Own Vancouver. bleepingcomputer.com/news/se…
