Danny retweeted
Here are the slides from the "Attacking JavaScript Engines in 2022" talk by @itszn13 and myself @offensive_con. It's a high-level talk about JS, JIT, various bug classes, and typical exploitation flows but with lots of references for further digging! saelo.github.io/presentation…
Danny retweeted
Today we're publishing a detailed technical writeup of FORCEDENTRY, the zero-click iMessage exploit linked by Citizen Lab to the exploitation of journalists,
activists and dissidents around the world. googleprojectzero.blogspot.c…
Danny retweeted
The schedule for #Pwn2Own 2021 is live! Check out all of the attempts set for the next 3 days. We'll be updated the schedule with results as we get them. zerodayinitiative.com/blog/2…
Danny retweeted
It's been a while since I wrote anything so I wrote an article on how to discover the entire x86-64 instruction set in seconds including any hidden instructions and learn their basic properties while on it. There were some pretty interesting results!
blog.can.ac/2021/03/22/specu…
Danny retweeted
🐋 How Netflix secures their containers using User Namespaces ("rootless containers")
Great overview of the problem space + a discussion of how their architecture has changed over time
by @fabiokung @sargun @aspyker @heliousc6 @anwleung et al
netflixtechblog.com/evolving…
Thread-Per-Core Buffer Management for a modern Kafka-API storage system vectorized.io/tpc-buffers/
Amazon Announces the Preview of AWS Controllers for Kubernetes (ACK) infoq.com/news/2020/09/aws-c…
Danny retweeted
A nimble robot dog: Meet A1, a lifelike four-legged robot that can tumble and run as fast as a man. #tradefair
Danny retweeted
"Hacking Starbucks and Accessing Nearly 100 Million Customer Records" - write up on a recent directory traversal vulnerability found with @Rhynorater ☕️
samcurry.net/hacking-starbuc…
Danny retweeted
The smallest sandbox escape for AngularJS, by @PortSwiggerRes
{{{}.")));alert(1)//"}}
And the full (?) list in the cheat sheet: bit.ly/2ADZVhT
Danny retweeted
There’s a lot of buzz right now about a “massive DDoS attack” targeting the US, complete with scary-looking graphs (see Tweet below). While it makes for a good headline in these already dramatic times, it’s not accurate. The reality is far more boring. 1/X xitter.cf/JDaIey/status/12726439…
Danny retweeted
Just finished my first blog post on a AMSI bypass technique utilizing function hooking as well as dll injection x64sec.sh/understanding-and-…
Danny retweeted
This new Microsoft Terminal is very #mimikatz friendly ❤️🥝
Cool seeing the app sec world adopting tools like this. "This bot hunts software bugs for the Pentagon" arstechnica.com/?post_type=p…
Danny retweeted
Making an antivirus engine : the guidelines
adlice.com/making-an-antivir…
Very useful reference to understand basic AV internals!
Danny retweeted
In case you missed @natashenka's talk at @BlackHatEvents this week, here is a video showing a remote exploit for one of the iMessage bugs we found: youtu.be/E_9kBFKNx54 Be sure to read googleprojectzero.blogspot.c… if you are interested in these kinds of attacks!
Danny retweeted
Today, @5aelo and I unrestricted five bugs in iMessage! Here are some highlights: