I’m thrilled to share my latest blog post! This one focuses on the bug hunting process: inspiration, approach, and execution. I also provide a retrospective on how the bug was introduced and analyze the insufficient “patch”. Check it out: securityintelligence.com/x-force/little…
My take on this: “… appears to be starting a conversation about…” is corporate speak for “there’s nothing we can do about this and we’re waiting this out”.
There’s currently no alternative to running Windows EDRs in kernel mode and there’s not going to be one any time soon.
via @verge – due to the recent CrowdStrike incident Microsoft is discussing migrating security products away from the Windows kernel and into other spaces such as VBS Enclaves or Microsoft Azure Attestation
CrowdStrike accidentally leveled the playing field for Threat Actors
After over a decade in cybersecurity I sometimes forget that a lot of tech probably has never heard of Crowdstrike (as is now apparent by all the posts)
You’ve probably also not heard of @fieldeffectsoft so here is your chance (no I don’t work for them)
fieldeffect.com/blog/recoverin…
Thanks to everyone who attended my @reconmtl and @BlueHatIL talks! The exploit and slides are here: github.com/gabriellandau/…
If you took any photos during either of the talks, please share them here. Also, please don't hesitate to stop me to say hi!
When embarking on a new vulnerability research project it is important to perform extensive background research into the area to gather as much info as possible to supplement and guide
@j00ru describes these learning resources for the Windows Registry:
googleprojectzero.blogspot.com/2024/06/the-wi…
Very happy to share some thoughts and an inside look at the Field Effect experience of our first participation in a MITRE Engenuity ATT&CK Managed Services Evaluation. So proud of the team, details here:
fieldeffect.com/blog/recoverin…
The cynic in me is saying that if you are a secret agent on a counterterrorism mission, it's kinda your job not to have your secret equipment confiscated by the mall cop on the segway, so I think the lady doth protest too much.
(Random subtweet)
New blog post "Google: Stop Burning Counterterrorism Operations"
My reflection on an incident where Project Zero and TAG knowingly shut down an active Western counterterrorism cyber operation, and the real-world harm that could have resulted from it.
poppopret.org/2024/06/24/goo…
New Project Zero blog post by Sergei Glazunov and Mark Brand: Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models googleprojectzero.blogspot.com/2024/06/projec…
Attacking Android Binder: Analysis and Exploitation of CVE-2023-20938
An article by @abc_sup, Gulshan Singh, and @vxradius about exploiting a vulnerability in the Android Binder device driver that leads to a slab use-after-free.
androidoffsec.withgoogle.com/posts/attackin…
@guhe120 This happened. It turns out maintaining consistency at 4x-6x the previous volume is a really hard problem. Honestly, a misc CVE field is the least of my worries- inconsistencies in what's considered an "Important" vulnerability is what keeps me up at night 🥲
2K Followers 144 FollowingFounder and CEO of @fieldeffectsoft - Co-Founder of Linchpin Labs (now @TrenchantARC) - opinions are my own, and likely wrong
123K Followers 8K FollowingDepartment of Cyber WAR.
Member of the Counter Spider Collective.
Wielder of AI to defend in Cyber Space.
Ralph Vibe Specialist.
VibeOps Operator!
13K Followers 4K FollowingChief Architect, Security Research of BigTech
Advisor of Grsecurity. BYOS
Commitee Member of OffensiveCon, Langsec, DistrictCon, Secdev
27K Followers 1K FollowingI play with vulnerabilities and exploits. I used to be here on Twitter but now I'm here:
@[email protected]
https://t.co/hXggdAVkSQ