Security researcher, team lead & speaker. Low-level design, firmware and system software. Fuzzing & testing automation for CI/CD pipelines.
Joined July 2017
- Tweets621
- Following130
- Followers1.3K
- Likes1.4K
Alexander Ermolov retweeted
Wrote a blog post (in Russian) about the current state of BootGuard and adjacent vendor continuations of it, typical configuration errors and how they look from UEFITool NE GUI.
Will write an English version later and put it on coderush.me.
habr.com/ru/articles/1070714…
Alexander Ermolov retweeted
New exploit: “xor dword [0xf80c2094], 1<<22”
Unlocks CPU microcode, the platform security processor, system management mode, and every internal processor register, all at once, on 100 million AMD CPUs. As far as I can tell can’t be fixed.
github.com/xoreaxeaxeax/skit…
Alexander Ermolov retweeted
#ESETresearch discovered and reported to @certcc 11 old Microsoft-signed UEFI shim bootloaders that allow bypassing UEFI Secure Boot on most UEFI systems. Read about it at welivesecurity.com/en/eset-r… @smolar_m 1/5
Alexander Ermolov retweeted
🚨 We broke U-Boot's FIT Signature Verification.
The Binarly REsearch team uncovered 6 previously unknown vulnerabilities affecting one of the world's most widely used bootloaders—including two that can potentially lead to arbitrary code execution while parsing an untrusted boot image.
Technical deep dive:
hubs.ly/Q04p1yW_0
#FirmwareSecurity #UBoot #EmbeddedSystems #CyberSecurity
Alexander Ermolov retweeted
Bug count != exploitable bug. Finding != chaining.
LLMs are exceptional at pattern recognition on known bug classes. They are not reasoning about novel failure modes in complex multi-component systems.
The hard bugs still require humans. voidsec.com/ai-vulnerability…
Alexander Ermolov retweeted
New blog post: exploring NVIDIA’s open-source GPU drivers.
Kernel modules, IOCTL attack surface, mmap primitives, UVM internals, and CPU↔GPU interactions (pushbuffers → firmware).
Not just graphics: a large, exposed kernel surface.
fuzzinglabs.com/exploring-nv…
Alexander Ermolov retweeted
Don't want to cry wolf just yet, but this magenta-boxed part of LOTS of Insyde H2O-based UEFI FWs is highly suspicious, even if they are currently empty.
Neither BootGuard nor FlashDeviceMap covers those volumes, and presence of PEI deps section suggests they are processed.
Alexander Ermolov retweeted
Intel SGX has fallen! Its most important key is in our hands: we extracted the Global Wrapping Key from an instance of the Intel Gemini Lake platform
Alexander Ermolov retweeted
Slides and demos for our @REverseConf talk by @francesco_ev and @xorpse are up! If you missed the conference, now's you're opportunity to take a look at the talk content and demos.
Slides & demos: github.com/binarly-io/Resear…
VulHunt framework: vulhunt.re
Alexander Ermolov retweeted
Vulhunt is now open-source, this is a game changer: github.com/vulhunt-re/vulhun… @binarly_io @vulhuntdev
Alexander Ermolov retweeted
We @binarly_io just open-sourced our VulHunt framework at @REverseConf!
GitHub: github.com/vulhunt-re/vulhun…
Documentation: vulhunt.re/docs
Slack: join.slack.com/t/vulhunt/sha…
vulhunt.re
Alexander Ermolov retweeted
I'm pleased to announce a new release of the Rust bindings for @HexRaysSA IDA SDK! This release includes v9.3 compatibility.
Code: git.idalib.rs
Docs: docs.idalib.rs
Thank you to @yeggorv who contributed to this release, and to @HexRaysSA for their support.
Alexander Ermolov retweeted
Published my OFFZONE 2025 presentation slides (in Russian) on GitHub: github.com/NikolajSchlej/Off…
Had a great time at the conf, kudos to Bi.Zone and other sponsors and crew members for organizing and running it.
Alexander Ermolov retweeted
🔍 Full paper:
📄 syssec.kaist.ac.kr/pub/2025/…
💻 github.com/SysSec-KAIST/LLFu… (coming soon)
📢 USENIX Security 2025
Authors: @hdtuanss , @ohtaekk_ , @cheoljun_p, @insu_yun , @yongdaek
#LLFuzz #BasebandSecurity #Fuzzing #CyberSecurity #USENIXSecurity
Alexander Ermolov retweeted
ZeroNights CFP is open 🔥
Long time no see. ZN will take place on Nov 26, 2025 zeronights.ru/
The program committee is accepting talks in Offensive and SecOps tracks, rewarding exclusive in-person presentations
Submit cfp.zeronights.ru/zeronights…
@cfptime
Alexander Ermolov retweeted
Published the third part of my blog series about Hydroph0bia (CVE-2025-4275) vulnerability, this one is about the fix as Insyde applied it, and my thoughts on improvements for it.
coderush.me/hydroph0bia-part…
Alexander Ermolov retweeted
Preliminary analysis shows that Insyde fixed Hydroph0bia (CVE-2025-4275) by forcefully removing the NVRAM vars that lead to exploitation during SecureFlashDxe driver startup, and setting a restrictive variable policy for them, so such vars can't be set from the OS anymore.
Alexander Ermolov retweeted
Published, go check it out, it is a fun ride indeed:
coderush.me/hydroph0bia-part…
Part 3 will be done when I see how Insyde fixed the vulnerability and if we could do something about that fix.
There will soon be a part two of the writeup, where we'll use Hydroph0bia for getting arbitrary code execution during FW update and obtain full control over the DXE volume (and all other parts that happen to not be covered by BG/FDM hashing).
youtube.com/watch?v=1uJF44S0…
Alexander Ermolov retweeted
🚨Binarly is documenting the discovery of CVE-2025-3052, a memory-corruption flaw in a Microsoft-signed UEFI module that lets attackers bypass Secure Boot and run unsigned code before the OS starts.
🔗 Full details: binarly.io/blog/another-crac…
🛡️ Advisory: binarly.io/advisories/brly-d…
Alexander Ermolov retweeted
The embargo (12:00 UTC 2025-06-10) is over, let's start a thread on Hydroph0bia (CVE-2025-4275), a trivial SecureBoot and FW updater signature bypass in almost any Insyde H2O-based UEFI firmware used since 2012 and still in use today.
English writeup: coderush.me/hydroph0bia-part…