Similar experience with responsible disclosure for #ArgoCD.
Reported a blind SSRF vulnerability back in January (clearly less critical than Synacktiv's findings), but so far the only visible action has been assigning the GitHub Advisory a "Triage" label.
CI/CD pwnage with a pre-auth RCE in #ArgoCD by @hugow_vincent 💥
Discover how a single misconfiguration in a Helm chart can lead to a full cluster compromise sprinkled with some CodeQL shenanigans! 🥷
synacktiv.com/en/publication…
We analyzed how different LLMs and prompt strategies impact bug triage performance in our #BinaryNinja plugin #Mole. TL;DR: Real-world code is far harder than synthetic benchmarks, false positives dominate, stability varies by model, and prompt tuning is strongly model-dependent.
ALT Mole Logo
Full report:
raw.githubusercontent.com/cy…
Tool:
github.com/cyber-defence-cam…
First two unauthenticated RCE CVEs published - Discovered with the help of our #Binja plugin #Mole!
🔗 Advisory: certvde.com/en/advisories/VD…
🔗 Mole: github.com/cyber-defence-cam…
More vulnerabilities have been reported - stay tuned for upcoming advisories.
Static pointer tracking is tricky.
Just shipped some improvements to my #BinaryNinja plugin #Mole: it now tracks array and struct members more precisely.
An example on how Mole does this: github.com/cyber-defence-cam…
Binja's multiple ILs make precise analysis so much more powerful!
ALT Logo of Binary Ninja Plugin Mole
A while back, I wanted to learn about @qb_triton and symbolic execution in general, and to research its challenges when it comes to real-world binaries. What began with a few simple scripts evolved into PoC tool called Morion, which I've just released.
#symbex #libtriton #morion
I've written a detailed showcase to highlight some of the tool's features (and current limitations). The showcase illustrates how the tool can, for example, help assess if a bug is exploitable and if so, assist in crafting a functional exploit:
github.com/cyber-defence-cam…
#Morion has been accepted for @BlackHatEvents #BHEU and will be presented at #BlackHatArsenal this December in London!
blackhat.com/eu-24/arsenal/s…
If you are attending #EuroSP22 and are interrested in our work or the @cydcampus in general, let us know. We are happy to discuss!
This Post is from an account that no longer exists. Learn more
Damian Pfammatter retweeted
How to setup network monitoring for your home IP in 4 easy steps using the Shodan CLI: asciinema.org/a/231048
Great audience at my talk and a nice @swisscyberstorm coference in general. Leaving with plenty of new ideas to extend my research...
You missed the interesting @swisscyberstorm talk "Hidden Inbox Rules in Microsoft Exchange" by @dp__pd? All infos about his research and the attack can be found here: blog.compass-security.com/20… #SCS18
Damian Pfammatter retweeted
Compass Security Blog: Hidden inbox rules in Microsoft Exchange… or how to secretly steal your messages. Topic presented at this year’s @swisscyberstorm. #DFIR
blog.compass-security.com/20…
