Max retweeted
Fortunately this http.sys bug was an internal find by our team. This one thanks to @_mxms, @fzzyhd1 and everyone who contributes to our tooling and automation.
Happy Patch Tuesday! #Adobe and #Microsoft have released their regularly scheduled updates, and @dustin_childs has all the details of the bugs squashed this month - including a wormable bug in http.sys. bit.ly/33xsfxl
Max retweeted
Do you want to gamble on fat bears for charity? #FatBear2020 is here. Get your brackets in before the 30th!
Details here: gist.github.com/yrp604/088bd…
Max retweeted
These, combined with recent @WIRED reporting on Chinese espionage campaign Operation Skeleton Key targeting the Taiwan Semiconductor Industry (wired.com/story/chinese-hack…), suggests possibility of an explosion of new homegrown semiconductor companies in the mainland.
This quoted post is unavailable.
There’s also a format string bug going the opposite direction (when your phones name is %p%p%p...) xitter.cf/fransrosen/status/1179…
Max retweeted
The second annual infosec fat bear bracket is here. Let’s gamble on some fat bears for charity. Brackets due ASAP.
dpaste.de/OZ1U
Max retweeted
It's not obvious from the advisory, but the same code runs in RDP client. The issues have been patched in both.
This would have allowed a malicious server to compromise a client without any alerting behavior, or a MitM attack with a warning confirmation.
Max retweeted
August Patch Tuesday includes fixes for our internal finds in RDP, including RCE and remote info disclosure, and affecting Win 10 latest. The team successfully built a full exploit chain using some of these, so it's likely someone else will as well.
Patch and enable NLA.
August 2019 Security Update includes fixes for wormable RCE vulnerabilities in Remote Desktop Services (RDS), affecting all in-support versions of Windows. These should be patched quickly. For more information, see msrc-blog.microsoft.com/2019…
Max retweeted
We've built tools for fuzzing based on emulation of a process snapshot captured via minidump. We're considering open sourcing the tool, and I'm curious about interest level from the rest of the world. (1/3)
Max retweeted
#RealWorldCTF2018 RPISEC has successfully pwned the Safari browser and spawned a calculator on the victim host at their first attampt during the demostration!
Max retweeted
Vectorized Emulation: Hardware accelerated taint tracking at 2 trillion instructions per second
gamozolabs.github.io/fuzzing…
Max retweeted
After Trump was elected, I felt unsafe. I thought that electing a man as president who has assaulted women would normalize that behavior, make assault seem inconsequential to a perpetrator. Right now, I feel worse. It’s normalized, all right.
Max retweeted
Came in 1st in CSAW 2018 Quals! Kudos to all who played, it was a tough competition this year! See y'all at finals!
48-hour Quals is officially done. Nicely done, @osirislab! #CTF scoreboard is frozen. Thank you so much to all the teams who participated this weekend. Check out the scores here: ctf.csaw.io/scoreboard. Official announcement of Finalists will be posted in early October.
Max retweeted
Honored to be speaking at the Forbes 30 under 30 cyber security panel in Boston this October! #under30summit
Max retweeted
My first technical analysis piece at @RecordedFuture! TL;DR:
1) Chinese backdoor with a daily 180 second entry-window found in Tibet
2) Qinghua University infrastructure, connected to backdoor, scanning #BeltandRoad partners/ US gov entities denouncing #USChinaTradeWar.
Recorded Future’s Insikt Group uncovers new #cyberespionage operations by Chinese attackers against potential and current trade partners worldwide, emanating from the infrastructure of a top Chinese university: bit.ly/2KXS3Hd #ThreatIntelligence #Analysis
Max retweeted
Excited we got 10th at #defconctf. Thanks to @oooverflow for hosting. Congrats to all the other teams, it was a hard fought battle. See you all next year!
