Tomorrow I have the final slot at SEC-T. Still there are hypervisors do no not consider the threat of Spectre vulns worth mitigating. Let's see how they can be exploited end-to-end :)
Speaker spotlight -- johannes wikner.
They'll be presenting:
"Is Spectre Dead Yet? Eight Years In, Hypervisors Still Pwnable"
Day 2 | Main hall
See you in Stockholm.
#SECT #infosec #platformsecurity #exploitdev
johannes retweeted
Ever make a mistake when interrupted? So does your CPU! We identify Time-of-Neutralization-to-Time-of-Use (TONTOU) windows in Spectre mitigations, and introduce Interrupt Injection as a novel primitive to exploit these windows.
m.youtube.com/watch?v=L6yiLa…
johannes retweeted
Working on the new simulator. I just wanted to see what Atari2600 fetching data from ROM looks like at CMOS FET level
(@tinytapeout TT09 Atari circuit by @__ReJ__)
johannes retweeted
Me: Power corrupts
@wiknerj: Rowhammer is a good example of that
johannes retweeted
Our latest post details how we exploited Retbleed (a CPU vulnerability) to compromise a machine from a sandboxed process and VM!
Curious? 👇
bughunters.google.com/blog/6…
Great selection - in particular nr 6 😎
Excited for #blackhat2025. Hope to see many new and familiar faces in Vegas in the upcoming days :)
Blackhat USA 2025 will happen soon, this is my personal top 12 master selection:
1. HTTP/1.1 Must Die! The Desync Endgame
Speaker: James Kettle
Tracks: Application Security: Offense, Application Security: Defense
Format: 40-Minute Briefings
Location: Oceanside A, Level 2
2. Invitation Is All You Need! Invoking Gemini for Workspace Agents with a Simple Google Calendar Invite
Speaker: Ben Nassi, Speaker: Or Yair, Speaker: Stav Cohen
Track: AI, ML, & Data Science
Format: 40-Minute Briefings
Location: Oceanside A, Level 2
3. Detecting Taint-Style Vulnerabilities in Microservice-Structured Web Applications
Speaker: Fengyu Liu, Speaker: YouKun Shi, Contributor: Tian Chen, Contributor: Bocheng Xiang, Contributor: Junyao He, Contributor: Qi Li, Contributor: Guangliang Yang, Contributor: Yuan Zhang, Contributor: Min Yang
Tracks: Application Security: Offense, Exploit Development & Vulnerability Discovery
Format: 30-Minute Briefings
Location: Jasmine A & E, Level 3
4. Protecting Small Organizations in the Era of AI Bots
Speaker: Rama Hoetzlein
Tracks: Defense & Resilience, AI, ML, & Data Science
Format: 40-Minute Briefings
Location: Islander F & G, Level 0 - North Convention Center
5. Keynote: Chasing Shadows: Chronicles of Counter-Intelligence from the Citizen Lab
Speaker: Ron Deibert
Track: Keynote
Format: 40-Minute Keynote
Location: Oceanside A, Level 2
6. Racing for Privilege: Leaking Privileged Memory From Any Intel System Using a Microarchitectural Race Condition
Speaker: Sandro Rüegge, Speaker: Johannes Wikner
Tracks: Platform Security, Exploit Development & Vulnerability Discovery
Format: 30-Minute Briefings
Location: Mandalay Bay H, Level
7. Hackers Dropping Mid-Heist Selfies: LLM Identifies Information Stealer Infection Vector and Extracts IoCs
Estelle Ruellan | Threat Intelligence Researcher, Flare
Olivier Bilodeau | Principal Security Researcher, Flare
Date: Wednesday, August 6 | 3:20pm-4:00pm ( Oceanside C, Level 2 )
Format: 40-Minute Briefings
Tracks: Malware, AI, ML, & Data Science
8. Keynote: Three Decades in Cybersecurity: Lessons Learned and What Comes Next
Speaker: Mikko Hypponen
Track: Keynote
Format: 40-Minute Keynote
Location: Michelob ULTRA Arena, Concourse Level
9. Breaking Out of The AI Cage: Pwning AI Providers with NVIDIA Vulnerabilities
Andres Riancho | Security Researcher, Wiz
Hillai Ben-Sasson | Security Researcher, Wiz
Ronen Shustin | Security Researcher, Wiz
Date: Wednesday, August 6 | 11:20am-12:00pm ( Mandalay Bay H, Level 2 )
Format: 40-Minute Briefings
Tracks: Cloud Security, AI, ML, & Data Science
10. Booting into Breaches: Hunting Windows SecureBoot's Remote Attack Surfaces
Speaker: Jietao Yang
Tracks: Exploit Development & Vulnerability Discovery, Platform Security
Format: 40-Minute Briefings
Location: Islander E & I, Level 0 - North Convention Center
11. Burning, Trashing, Spacecraft Crashing: A Collection of Vulnerabilities That Will End Your Space Mission
Andrzej Olchawa | Offensive Security Researcher, VisionSpace Technologies GmbH
Milenko Starcik | Head of Cyber Security, VisionSpace Technologies GmbH
Ricardo Fradique | Cybersecurity Engineer, VisionSpace Technologies GmbH
Ayman Boulaich | Cybersecurity Intern, VisionSpace Technologies GmbH
Date: Wednesday, August 6 | 2:30pm-3:00pm ( Mandalay Bay H, Level 2 )
Format: 30-Minute Briefings
Tracks: Exploit Development & Vulnerability Discovery, Application Security: Offense
12. Dark Corners: How a Failed Patch Left VMware ESXi VM Escapes Open for Two Years
Speaker: Yuhao Jiang, Contributor: Xinlei Ying, Speaker: Ziming Zhang
Tracks: Exploit Development & Vulnerability Discovery, Cloud Security
Format: 40-Minute Briefings
Location: Jasmine A & E, Level 3
@BlackHatEvents
blackhat.com/us-25/briefings…
johannes retweeted
Huh, I didn't realize that the vibe-coded vulns inserted into 5 LTS kernels that still aren't fixed 22 days later haven't been fixed because the person who inserted them is busy telling everyone at a conference how great the AI he used to insert the vulns (that he didn't find) is
johannes retweeted
Happy to announce that the paper about IBPB problems that included the first real cross-process Spectre exploit just got a distinguished paper award at @IEEESSP! Dr. @wiknerj now has two of these awards in his thesis. What will he do next?!
HW defenses against Spectre are tricky: they need to be applied correctly by the SW, and we need to trust that the HW does what its supposed to. Our latest work "Breaking the Barrier" exploits loopholes in both of these issues on Intel and AMD parts.
comsec.ethz.ch/breaking-the-…
Branch Race Conditions Predictor causes recent predictions to be added after more recent privilege switches (→ wrong privilege, eIBRS💥) prediction flushes (→ retained valid, IBPB💥) finish.
@sparchatus eventually figured it out 🙌
Disclosing Branch Predictor Race Conditions (BPRC), a new class of vulnerabilities where asynchronous branch predictor operations violate hardware-enforced privilege and context separation in virtually all recent Intel CPUs. @wiknerj @kavehrazavi : comsec.ethz.ch/bprc
johannes retweeted
Spectre v2 is back again! Disclosing "Training Solo": 3 new self-training attack classes, 2 end-to-end exploits, and 2 new hardware issues that break domain isolation even when implemented perfectly. Joint work by @SanWieb @c_giuffrida: vusec.net/projects/training-…
johannes retweeted
🔨 Posthammer (USENIX Sec '25) brings Rowhammer back in the browser!
What if visiting a website was enough to trigger a Rowhammer attack? Posthammer shows how to bring non-uniform Rowhammer patterns into the browser.
More information: 📄comsec.ethz.ch/posthammer
johannes retweeted
The @phrack 72 CFP horny emojipasta has hit the chats
ALT Screenshot of a copypasta that is in the replies
We updated our CFP for Phrack 72! The deadline is now April 1st 2025. Check the site for specifics on how to contribute, as well as some inspiration! We also posted a link to purchase physical copies of Phrack 71, and a donation link too. Enjoy!
phrack.org/
ALT screenshot of the CFP on phrack.org
Thanks for the 21st @h2hconference! Always a joy to meet the mix of researchers, enthusiasts, academics, hackers. Special thanks to the organizers and yes the 🚌 trip to Rio went smoothly @bsdaemon @gabrielnb 😄 has a moment to enjoy this very special zine on the journey..
The first ever end-to-end cross-process Spectre exploit? I worked on this during an internship with @grsecurity! An in-depth write-up here:
grsecurity.net/cross_process…
HW defenses against Spectre are tricky: they need to be applied correctly by the SW, and we need to trust that the HW does what its supposed to. Our latest work "Breaking the Barrier" exploits loopholes in both of these issues on Intel and AMD parts.
comsec.ethz.ch/breaking-the-…
And of course we fix the problems we cause (unless they're in microcode..). github.com/torvalds/linux/co…