友民党 / CTF with ${cYsTiCk} / script kiddie at @d3vc0r3 / Tâi-gí, zh-TW, en-US, es-PY / 🐈⬛
Tsu-lô-Kuān, Formosa / Taiwan
Joined July 2019
- Tweets373
- Following640
- Followers2.5K
- Likes3K
omg not me getting name-dropped by James Kettle
well I should probably try to pwn the other half so I can keep avoiding storytelling...
splitline 👁️🐈⬛ retweeted
DEVCORE CONFERENCE 2027 | CFP is open
#Redteam, #VulnerabilityDiscovery, #Physicalsecurity, firmware and hardware RE, #AI attack surfaces. Bring the research that starts from a hacker's view.
Deadline: Oct 11, 2026, 23:59 GMT+8
sessionize.com/devcoreconfer…
Tomorrow at @SEC_T_org, I’ll be breaking down the journey of how I found paths to compromise software supply chainS.
We’re going down the Linux side this time ;)
splitline 👁️🐈⬛ retweeted
0 = 1 proven in Lean. Exciting and novel result! github.com/endrazine/lean-cv…
bug bounty still works, sure
problem is how much critical infra sits nowhere near it
most of it hasn't even had someone lazily throw a "hey chatgpt, find a 0-day for me make no mistakes" prompt at it yet
splitline 👁️🐈⬛ retweeted
你是否也習慣將「官方網站下載」、「Microsoft Store 上架」或「官方套件管理庫」當作萬無一失的信任背書？
但「官方」真的就代表安全嗎？
從建置、簽章到發布，每一層都有可能成為攻擊者的切入點。
今年 HITCON，三場硬核議程將從三個完全不同的信任層級拆解軟體供應鏈，顛覆其安全想像：
💥 原初之穢：先莫管供應鍊夆毒，阮直接共官方發布源頭駭掉矣 | 講者：splitline
如果負責宣告「這是官方版本」的發布系統被駭了呢？
本場演講將揭露 Python、Ubuntu、Go、Alpine 與 Windows 套件生態系上游發布端的脆弱盲區。即便最終執行檔帶有合法數位簽章，只要上游建置環境遭滲透，簽章也可能無法保證你拿到的東西安全。
現場將公開多個實戰案例，展示攻擊者如何用非預期的邏輯漏洞直接拿下控制權。
☠️ Not Just Spies Anymore: DPRK's Espionage Actors Are Coming for Your Crypto | 講者：Seongsu Park
當原本專注於國家間諜行動的 APT 組織轉向加密貨幣撈金，攻擊者開始重新利用各種「可信」背書。
從架設高擬真交易平台、申請公司簽章，到成功把木馬化應用程式上架到 Microsoft Store，再結合 AI 輔助開發、macOS TCC 權限操作與精準白名單投遞，這場議程將展示官方通路沒有被攻破，也可以被攻擊者拿來建立信任，造成極致濫用。
🚨 黑吃黑: 瞄準駭客的供應鏈攻擊 | 講者：Jason3e7、Samuel
當獵人自己成為獵物？
攻擊者密切盯著高熱度 CVE 的公開資訊，在社群瘋傳、復現 PoC 的黃金時間，將高度混淆與多階段載入的後門深埋在 PyPI 工具的深層依賴鏈中。
當研究員為了復現漏洞，在終端機按下執行的瞬間，測試環境就已淪為被控端點。
三場議程，三個不同的信任位置。
從官方建置環境、官方的發布通路，到你以為只是研究工具的第三方依賴——當「看起來可信」不再等於「真的安全」，我們還能相信什麼？
📅 HITCON 2026：8 月 21 日－8 月 22 日
🔎 完整議程：hitcon.org/2026/zh-TW/agenda…
🎫 購票連結：hitcon.kktix.cc/events/hitco…
#HITCON2026 #HITCON #供應鏈安全 #漏洞復現
splitline 👁️🐈⬛ retweeted
My #BHUSA 2026 slides are online!
It was an honor to share our AFD research and how a different perspective led to 30+ Windows kernel vulnerabilities.
Blog post coming soon — check out the slides here:
i.blackhat.com/BH-USA-26/Pre…
so i actually got more than one RCE chain (~2.5?) for SharePoint at Pwn2Own this year, even though i ended up using the freakishly simple one (for strategic reasons :p)
here's another one of them:
msrc.microsoft.com/update-gu…
splitline 👁️🐈⬛ retweeted
Two of our researchers hit the #BHUSA stage for the first time.
Angelboy(@scwuaptx ) shares how a different angle on AFD led to 30+ new #Windows kernel vulnerabilities. Splitline(@_splitline_ ) exposes backdoor risks in Go, Python & Flutter pipelines.
#VulnerabilityResearch
Teaser #2
xitter.cf/_splitline_/status/207…
Teaser #1
xitter.cf/_splitline_/status/206…
Next week at @BlackHatEvents #BHUSA, I'll present “Born Corrupted: How We Backdoored Trusted Language Binaries”
We found ways to compromise Python, Go, Flutter & Julia at the supply-chain layer, turning trusted bins into whatever hackers want them to be!
Check out the abstract:
