Head of Solution Engineering @Binarly, IT-Consultant @ Niche Systems. Ex-CEO of @immune_gmbh. Founder of @9eSec, President of the @osfw_foundation.
Germany
Joined November 2011
- Tweets3.2K
- Following589
- Followers729
- Likes2.2K
Pinned Tweet
For eveyone wondering what's @IntelSoftware planning for the Firmware Support Package 3.0 #fsp and USF is basically going fully closed-source on the firmware side. This means Intel's #fsp decides to drop #OSF open-source firmware. It's really a shame... universalscalablefirmware.gi…
Zaolin retweeted
Our REsearch team is thrilled about the new IDA v9.0! #efiXplorer is fully compatible with v9.0 and still supports IDA v8.4🚀
🔬github.com/binarly-io/efiXpl…
We are thrilled to announce IDAlib — idiomatic Rust bindings for the IDA SDK 🎉 Kudos to @xorpse!
⚙️github.com/binarly-io/idalib
Zaolin retweeted
I chatted with @_zaolin_ from @binarly_io about firmware vulnerabilities, reverse engineering binaries, and the challenges in responsible disclosure.
Don't miss this deep dive into firmware security!
Listen here:
vpetersson.com/podcast/S01E2…
Zaolin retweeted
The @QubesOS Summit 2024 has officialy started! We’d like to extend our gratitude once more to our Platinum Sponsors, @FreedomofPress Foundation and @mullvadnet for their unwavering support!
Don't forget, you can still grab your virtual pass here: buff.ly/3MLiS3E
Zaolin retweeted
NEW! Repeatable Failures: Test Keys Used to Sign Production Software…Again?
🔥Full details: binarly.io/blog/repeatable-f…
🚨In just a few hours at #LABScon, we’ll be unveiling a high-impact vulnerability and a critical security discovery affecting platform trust on Supermicro servers. Stay tuned and watch our REsearch blog!
Zaolin retweeted
More updates will be coming tomorrow at the #LABScon stage. The problems related to the test and non-production keys are much bigger than we initially thought.
🚨NEW: "PKfail Two Months Later: Reflecting on the Impact." by @pagabuc
Based on pk.fail data 📈
🖥️10,095 unique firmware images uploaded
🔥791 of which contained an untrusted PK
🛟9304 is safe
💥8.5% vulnerable rate
🔬Full report: binarly.io/blog/pkfail-two-m…
Zaolin retweeted
Secure Boot-neutering PKfail debacle is more prevalent than anyone knew arstechnica.com/?p=2050182
Zaolin retweeted
🚀 Just one week until @LABScon_io , where @pagabuc and @matrosov unveil our latest research: “PKFAIL: Supply-Chain Failures in Secure Boot Key Management.”
🔬 This research dives into new data insights uncovered since the initial #PKFAIL disclosure, including a brand-new vulnerability affecting servers based on Supermicro hardware.
📻 Stay tuned — next week is packed with exciting announcements from our team!
Zaolin retweeted
🎤 Excited to announce @_zaolin_'s demo at Dasharo vPub: "@Binarly_io Risk Hunt: Finding Firmware Vulnerabilities in the Wild!"
#Dasharo #FirmwareSecurity #Binarly #RiskHunt #CyberSecurity #Firmware #VulnerabilityHunting
📄 More info: buff.ly/4dPT6af
Zaolin retweeted
Philipp will showcase the latest updates to Binarly's Risk Hunt platform and demonstrate its capabilities.
🗓️ Sep 12, 19:00 UTC
🎟️ Sign up: buff.ly/47dBUJk
Zaolin retweeted
We believe in giving back to the research community that drives progress! We are proud to support OpenSecurityTraining2 in advancing security education and knowledge sharing.
Thanks to @binarly_io for Sponsoring #OST2 at the Gold🥇 level!
Learn more about them here: binarly.io/
Zaolin retweeted
🎉 The all-new Binarly Transparency Platform v2.5 introduces Reachability Analysis to help security teams prioritize vulnerabilities by analyzing the potential reach and impact of exploitable code paths. A game-changer in software security!
binarly.io/blog/introducing-…
Zaolin retweeted
Wohoo! @binarly_io has just released 2.5 of their platform with some major new capabilities like reachability analysis, custom rules , secret discovery and cryptographic asset discovery, and container support. youtu.be/4TG6X1WjWH4?si=1Kia…
Zaolin retweeted
Most products that detect secrets do little more than a ‘strings’ looking for certificates and high entropy data. @binarly_io actually does reachability analysis which cuts down on the noise substantially enabling you to focus on what matters.
Wohoo! @binarly_io has just released 2.5 of their platform with some major new capabilities like reachability analysis, custom rules , secret discovery and cryptographic asset discovery, and container support. youtu.be/4TG6X1WjWH4?si=1Kia…
Zaolin retweeted
Thanks to @binarly_io for Sponsoring #OST2 at the Gold🥇 level!
Learn more about them here: binarly.io/
Zaolin retweeted
We are thrilled to make Chiba public, a centralized management system PoC for racks running OpenBMC. We believe this initiative will enhance transparency within the OEM supply chain. Patch are welcomed! github.com/hardenedlinux/chi… @R0yMu @osfc_io @osfw_foundation #chiba #openbmc
Zaolin retweeted
The question is whether this key is reused (like the Intel Boot Guard story) across the Intel ecosystem or rotates per CPU generation or product line🍿
Confidential computing? 🔥
Zaolin retweeted
Last week, @NIST rolled out new guidance on Post-Quantum Encryption. ⏳The clock is ticking ...
“Technology managers can inventory their systems for applications that use encryption, which must be replaced before cryptographically relevant quantum computers appear."
Zaolin retweeted
Returned to Cupertino and restarted my FWSEC job today.
Was a productive leave and I was able to resolve most of the issues that pushed me into it, but selling everything and moving over the Atlantic just to move back in 4 month is no fun, will try not to repeat this ever again.
Zaolin retweeted
Don't miss the rest of today's #DEFCON32 author signings! @mattburrough & @josweyers (Locksport) at 2:30pm. @sk3wl & Kara Nance (The Ghidra Book) at 3:30pm. @matrosov (Rootkits and Bootkits) at 4:30pm. Detailed schedule + map: nostarch.com/defcon