@errno_fail

Computer forensics, computer forensics tool validation, etc. https://xitter.cf/t.co/vlNuwLiLI7 https://xitter.cf/t.co/vYcKnqlN8Z @errno_fail@infosec.exchange 🕊

 /
Joined November 2016
  • Tweets959
  • Following61
  • Followers1.5K
75Media
For some reason, Citrix removed my name from the acknowledgements section of their advisory: support.citrix.com/support-h… Original credits: > Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, and Maxim Suhanov Now: 1/3
3
1
4
623
Got this fixed... My name is listed again.
1
57
@Citrix, can you explain why?
124
> Michael Tucker and Chew Keong Tan of the JPMorgan Chase XOR Team I reported CVE-2026-88778, a vulnerability that (a) allows IP spoofing and (b) allows thousands of NetScaler hosts to participate in TCP/HTTP/TLS Amplification attacks (a small spoofed TLS Client Hello... 2/3
1
252
results in a huge reply being sent to a victim, its amplification factor starts from 40). 3/3
76
* My shell script to collect data from compromised NetScalers (timelines, core dumps, etc.): github.com/msuhanov/easy_tri… * My NSE script to fingerprint the NetScaler TCP stack: github.com/msuhanov/nse/blob…

easy_triage/easy_triage_fbsd.sh at main · msuhanov/easy_triage

Scripts to triage compromised systems (Linux, ESXi, FreeBSD/NetScaler) - msuhanov/easy_triage

github.com
1
19
68
5,583
I posted the slides from two talks here: dfir.ru/2026/09/09/two-confe… If you like BitLocker bypasses, here is my list: CVE-2024-43513 dubbed "bitlockpick", CVE-2025-21202 dubbed "bitlockpick 2", CVE-2026-20928 dubbed "cold boot attack without cold and boot"... 1/2
1
4
15
1,740
CVE-2025-21214 – a bug from the 90’s, CVE-2025-21215 – turning the Windows boot loader into the keylogger to capture the BitLocker’s PIN. But the talk wasn't limited to those! 2/2
363
In 2022, Microsoft decided to propagate Mark-of-the-Web into mounted containers. Here is how they did that and why third-party code (like WinRAR) still fails to correctly propagate the Zone.Identifier ADS. dfir.ru/2026/06/29/mark-of-t…
1
879
Most FDE vendors/projects don't consider vectors requiring repeated physical access as a vulnerability. But there is another side to this: an HDD/SSD firmware backdoor (or a network attacker injecting arbitrary data into a disk image booted over the network) has a way... 1/3
1
1
1,009
to inject attacker-controlled data into an encrypted volume despite code integrity controls like Secure Boot and TPM-based unlocks (the "Implementation and Implications of a Stealth Hard-Drive Backdoor" paper told us the opposite). 2/3
1
1
477
In one MSRC case, Microsoft agreed to treat the data-only attack against BitLocker from the storage path as a vulnerability. 3/3
1
169
CVE-2024-13745 in EDK II (likely, "WONTFIX"): "what you measure is not what you use". The story about firmware measuring bytes different from ones being used. It affects PCR[5], so the severity is low (nobody cares about PCR[5] by default). openwall.com/lists/oss-secur…
416
NotCVE-2026-0002: if you run two NetScalers in the high availability (HA/HA-INC) deployment, no SSH host key checks are performed between them, even when you followed every advice listed here: docs.netscaler.com/en-us/net… (see: Set up secure communication between peer appliances) 1/2

Home | NetScaler

docs.netscaler.com
1
1,255
The vendor reported that this issue has been fixed in 14.1-60.52. No security advisory, CVE ID, release notes entry was published. Although this is a minor vulnerability, it is a vulnerability. 2/2
1,024
My story of recovering cleared RDP logs from a completely unrelated EVTX file: dfir.ru/2026/01/26/windows-e… #DFIR
23
78
5,345
My long post about wide-block & AEAD modes in full-disk encryption: it cover threat models, vulnerabilities, and edge cases. Key points: - It's common for FDE implementations to fail outside of the encryption layer. dfir.ru/2025/05/08/disk-encr… 1/4
1
9
22
3,003
more replies
directory entries). - Defusing the Elephant diffuser: injecting a bunch of null bytes into the BitLocker-encrypted volume (AES-CBC with Elephant diffuser). An interesting but unexploitable bug present since Vista. 3/4
1
899
- BestCrypt Volume Encryption breaks many XTS mode guarantees (and the vendor doesn't care). 4/4
239
Load more