Chinese robot maker Unitree has removed a problematic component from the firmware of its Go1 robot dog that could have allowed remote attackers to take over the robot www.scmp.com/tech/tech-tr...

the takeover has begun.. trainings start tomorrow morning!

Happy to share my slides from BOOTSTRAP25. Unfortunately the bug discussed is still not patched in Linux 6.14.0 despite it being reported explicitly. Slides are in markdown but there's a PDF in "releases" too github.com/jduck/bs25-s...

Delighted that our paper on "Grammar mutation for testing input parsers" - led by Bachir Bendrissou and joint with @ccadar.bsky.social - is now published in ACM TOSEM! This came from a registered report at FUZZING. Check it out! doc.ic.ac.uk/~afd/papers/...

Reminder that the Phrack 72 CFP closes APRIL 1ST 2025. Get your papers in and come be a part of our fabulous 40th anniversary issue! See phrack.org for more info

Would you look at that, it's tmp.0ut Volume 4! Happy Friday, hope you enjoy this latest issue! tmpout.sh/4/

Only a week and a half left for USENIX WOOT '25 conference submissions - deadline March 11 AoE. We’re looking forward to seeing even more of your amazing offensive security papers this year! And still a few days for up-and-coming track (March 4). CfP at www.usenix.org/conference/w...

We discover 119 vulnerabilities in LTE/5G core infrastructure, each of which can result in persistent denial of cell service to an entire metropolitan area or city and some of which can be used to remotely compromise and access the cellular core. https://cellularsecurity.org/ransacked

I watch and read and I’ve seen a manner research. But this research into visualising Wi-Fi signals using an array of ESP32 chips is something else. www.youtube.com/watch?v=sXwD... It is that good. That deep and frankly so out there and he calls himself a mediocre engineer too. WTF? Blown away.

Hackers rejoice! We are releasing the Phrack 71 PDF for you today! Don't forget this year is Phrack's 40th anniversary release! Send in your contribution and be part of this historical issue! The CFP is still open, you can find it and the PDF link at phrack.org

Update your AMD Zen processor's BIOS: www.amd.com/en/resources... Check with your OEM for BIOS updates with the new microcode patches, they have had some time to address this high importance item.

2024 was a significant year for decompilation, constituting a possible resurgence in the field. Major talks, the thirty-year anniversary of research, movements in AI, and an all-time high for top publications in decompilation. Join me for a retrospective: mahaloz.re/dec-progr...

Just unrestricted an issue that shows a fun new attack surface. Android RCS locally transcribes incoming media, making vulnerabilities audio codecs now fully-remote. This bug in an obscure Samsung S24 codec is 0-click project-zero.issues.chromium.org/issues/36869...

OMG, Orange Tsai released his latest new research 🤯 💣 blog.orange.tw/posts/2025-0...

Looking through the schedule of #38c3 which starts tomorrow. Some talks I’ll be watching the streams for this year: ACE up the sleeve: Hacking into Apple's new USB-C Controller fahrplan.events.ccc.de/congress/202... Liberating Wi-Fi on the ESP32 fahrplan.events.ccc.de/congress/202...

vacation reading material acquired!

Pretty interesting technique used by _mccaulay here to understand the heap better and aid exploitation of a TP-Link vulnerability! www.nccgroup.com/uk/research-...

We updated our CFP for Phrack 72! The deadline is now April 1st 2025. Check the site for specifics on how to contribute, as well as some inspiration! We also posted a link to purchase physical copies of Phrack 71, and a donation link too. Enjoy! phrack.org

Intel launched the Pentium processor in 1993. Unfortunately, dividing sometimes gave a slightly wrong answer, the famous FDIV bug. Replacing the faulty chips cost Intel $475 million. I reverse-engineered the circuitry and can explain the bug. 1/9

I wrote a fun, little blog post. Remote pre-auth file deletion in SolarWinds ARM allowed to achieve LPE on AD machines 🙃

A PoC for that Cleo zero-day is now live: labs.watchtowr.com/cleo-cve-202...

New DCOM lateral movement technique discovered that bypasses traditional defenses. Unlike previous attacks relying on IDispatch interfaces, this method exploits undocumented COM interfaces within MSI, specifically targeting IMsiServer and IMsiCustomAction interfaces. 1/7

Course materials for Modern Binary Exploitation by RPISEC github.com/RPISEC/MBE?s... via @alexplaskett.bsky.social

I recently saw an amazing Navajo rug at the National Gallery of Art. It looks abstract at first, but it is a detailed representation of the Intel Pentium processor. Called "Replica of a Chip", it was created in 1994 by Marilou Schultz, a Navajo/Diné weaver and math teacher. 1/n

If you're interested in the technical details, I wrote the blog post here: flatt.tech/research/pos... For the further details, please check out the announcement from the OpenWrt team: lists.openwrt.org/pipermail/op... (2/2)

Rapid7 has disclosed the vulns from our exploit chain targeting the Lorex 2K Indoor Wi-Fi Security Camera, which we entered at this year's Pwn2Own Ireland. A 2 phase exploit, built upon 5 vulns - phase 1 is an auth bypass, whilst phase 2 is RCE. Disclosure, analysis and exploit here: t.co/J9VDwMDRsI

Novel approach to exploit a limited OOB on Ubuntu at Pwn2Own Vancouver 2024 Slides from a talk by Pumpkin Chang about exploiting a stack out-of-bounds write bug in the traffic control subsystem. u1f383.github.io/slides/talks...

week 44, streaming kernel dev topic: userspace page fault handling prequel to week 43, worked on the kernel-mode syscall support behind userspace PF handling (incl. recursive page fault support) (pre-recorded since I'm away this week ✌️) https://www.youtube.com/watch?v=5fv6Pjx3in8

A port of DOOM for a quantum computer! github.com/Lumorti/Quan...

If you enjoy programming and lower levels of the stack, this is a talk you want to watch: www.youtube.com/watch?v=WDfr...

QwQ: Reflect Deeply on the Boundaries of the Unknown QwQ-32B-Preview is an experimental research model developed by the Qwen Team, focused on advancing AI reasoning capabilities. qwenlm.github.io/blog/qwq-32b...

This a really cool talk by DonjonLedger about using a laser fault injection attack to extract the second share of the seed from a Microchip ATECC secure element hardwear.io/netherlands-... www.youtube.com/embed/Hd_K2y...

Podcast: risky.biz/RBNEWS367/ Newsletter: news.risky.biz/risky-biz-ne... -Microsoft’s thanksgiving treat: an FTC investigation -Tor needs 200 new bridges to avoid Russian censorship -US court overturns Tornado Cash sanctions -ESET finds first Ubuntu UEFI bootkit -Unpatched Windows LPE

"The networks are still compromised, and booting the hackers out could involve physically replacing “literally thousands and thousands and thousands of pieces of equipment across the country,” specifically outdated routers and switches" 🕵️‍♂️

"SoK: Prudent Evaluation Practices for Fuzzing" paper link: arxiv.org/pdf/2405.10220

Finding Bugs in Chrome with CodeQL by Google bughunters.google.com/blog/5085111...

How to develop n-day chrome exploits for electron applications by p3rr0 github.com/p3rr0x/Blog/...

Firefox, Thunderbird, Tor Browser RCE: www.welivesecurity.c...

Earlier this year, I used a 1day to exploit the kernelCTF VRP LTS instance. I then used the same bug to write a universal exploit that worked against up-to-date mainstream distros for approximately 2 months. osec.io/blog/2024-11...

🔥 No fuzz drivers needed. Our paper on injecting greybox fuzzers into running systems at user-defined amplifier points (in-vivo fuzzing) was accepted at #ICSE25! 📝 mboehme.github.io/paper/ICSE25... 🧑‍💻 github.com/OctavioGalla... (subject to AE) //Lead by Octavio Galland (former #MPI_SP intern).

Linux Kernel 6.12 is here! 🐧 It includes mainline support for PREEMPT_RT, improving the performance of real-time apps by making kernel processes pre-emptible. ⏱️ Plus, enhanced hardware support for AMD, Intel, NVIDIA, new schedulers, file systems, and QR code kernel panics for easier debugging.

Exxon lobbyist investigated over hack-and-leak of environmentalist emails, sources say by Reuters www.reuters.com/business/ene...

Anyone experienced with fscrypt forensics/reversing ? I got a firmware with a kernel and UBIFS. Both are encrypted. Kernel self-decrypt just before self-decompression, I managed to recover the key and decrypt it. I see it mounts the UBIFS using fscrypt. It’s embedded so the key must be somewhere…

Do you brine your turkey for thanksgiving / Xmas?

Everyday Ghidra: Ghidra Data Types — Creating Custom GDTs From Windows Headers — Part 2 by clearbluejar medium.com/@clearblueja...

nginx 1.27.3 released yesterday disabled TLS 1.0 and TLS 1.1 protocols by default, nice nginx.org/en/CHANGES

Lights Out: Covertly turning off the ThinkPad webcam LED indicator by Andrey Konovalov powerofcommunity.net/poc2024/Andr...

Small QoL feature release to my Shellcoder @binary.ninja plugin. Now every time you run it the architecture is automatically set based on the currently selected binary/database github.com/0xricksanche...

Bypassing Luks full disk encryption by Remy remyhax.xyz/posts/luks-v...