I have now been a year in the UK. It's been pretty cool so far. Let's see what the next one holds in store.

Finally managed to sit down this weekend and finish #flareon12. The last one was a bit of a struggle and I made a lot of mistakes but got there in the end. Thanks a lot Nick Harbour and team for another successful edition. Looking forward to write-ups.

I needed a bit more oomph for #flareon12 challenge 9.

Mark published some really nice analysis of the @livectf.bsky.social AI solves, check it out!

In case you haven't tried it yet: Time-Travel Debugging + @binary.ninja Binary Ninja integration is such a ridiculously powerful reverse engineering method.

Come check out the latest issue containing my article on crypto code obfuscation and lots of other great entries!

We're hiring! Specifically we're looking for a software engineer for our finance technology team for our office in London. Read more: www.xtxmarkets.com/job/?role=So... AMA about the company, living in London, etc.

Fantastic article! Just a few months ago, I actually asked a large group of security professionals what the current up-to-date recommendation for this what. Sadly their responses varied mostly from "uh, idk" to "I still recommend CSRF tokens". Very nice to have a clear, well reasoned reference.

I'm kinda tired of restaurants having 100 options and customisations, etc. I want to go to a 0 choice restaurant. I tell them that I'm allergic to peanuts and don't drink alcohol and then I just get served something. Would be amazing.

Haven't listened to Yungblud before but got introduced to Zombie (via Anthony Vincent) and OMG, listening to that song is like being transported back to being 17. Absolutely beautiful video as well.

After 1400 days I'm dropping my German Duolingo streak. It definitely helped me with the basics while I lived in Switzerland but that motivation is now gone. On to learning other things instead.

Had a great time talking with @zardus.bsky.social about getting started in cybersecurity: www.youtube.com/watch?v=n9QW... Primary thrust: Try something that interests you, then keep trying things. Every time, you'll either succeed, learn something, or meet new people, and this builds over time.

Come join me in the infosec team at XTX Markets! We're hiring for a Security Analyst with focus on compliance to our office in Singapore: www.xtxmarkets.com/job/?id=6616...

Does anyone have recommendations for any high quality discussion groups or communities for defensive security? Security engineering, detection engineering, DFIR, etc? Feels like there's an abundance of offense but not so much other stuff.

Saw @gianmarcosoresi.bsky.social (and Liam Nelson) tonight and now like half the muscles in my body hurt from laughing. Thanks for a fantastic performance!

Stop Saying "Responsible Disclosure" www.da.vidbuchanan.co.uk/blog/respons...

After thinking about it for like five years I finally got around to starting learning to draw. Unsurprisingly it's very challenging but I enjoy it.

As it turns out, the C compiler orphan-crushing machine offers no benefit: web.ist.utl.pt/nuno.lopes/p...

@livectf.bsky.social just posted their challenges and the solutions from the DEF CON quals: github.com/Live-CTF/Liv... This means 6⃣ challenges to replay, with solutions from some of the best CTF teams in the world. Challenge-4 (sokobin) lets you push bits around on the stack to get the flag 🤯

*tap*, *tap* This thing on? It's that time again! Prepare yourself for another DEF CON CTF qualifiers with a LiveCTF component this weekend! Thanks to @Nautilus_CTF for having us back and running another year! Keep an eye out here and at livectf.com for more details.

So, anyone putting together a Switch 2 hacking team and need a competent reverse engineer?

Finally caught up a bit and got around to watching this. I think Freya is spot on and articulates very well the concerns a lot of us have. Well worth a listen! Thanks for making this!

Check out my article on memory tracing in the latest issue of PagedOut, and all the other cool articles while you are at it.

Really interesting and inspirational presentation by Markus. Can strongly recommend checking it out. Also I really need to figure out how to get to next year's RE//verse.

I'm a Linux kernel noob. I'm creating a very simple CTF challenge and I wanted to allocate some executable memory from a kernel module. This does not seem to be straightforward anymore (reasonable). Is there any somewhat simple workaround?

Good morning, Zürich!

Things you don't want to hear from your doctor: "Ah, yes, I think this might be a rare variant of..."

Anyone want to provide some feedback on a reverse engineering article I wrote?

Man-in-the-middle attacks on Public WiFi networks haven't been a realistic threat in a decade. Almost all websites use encryption by default, and anything of value uses HSTS to prevent attackers from downgrading / disabling encryption. It's a non issue.

I'll be at #BSidesLDN2024 tomorrow. As someone new to London I'm looking forward to meeting the UK security community. Hit me up!

Some of my all time favourites with the Hazbin Hotel soundtrack as a newcomer.

Where in the UK do I buy replacement power plugs for small DC plugs (routers, etc.) which won't burn down my apartment? I.e. are CE marked or equivalent.

Want to learn how to make IDA and Ghidra produce incorrect decompilation and learn a little bit about ELF files? Check out my article in the latest issue of PagedOut! I'm gonna check out the other cool articles.

Well, I guess it's time to try this thing out.

Need build system recommendation. I'm looking to orchestrate building a large number (50+) of docker containers and run some tests on them through some python scripts. I like things like Bazel where you explicitly specify the graph but the full hermicity gets in the way here.

Ironically, my first PR after leaving Google is to a Google repo. Made the nsjail docker image about 75% smaller and a bit more modern: https://github.com/google/nsjail/pull/239

Learned another absolutely nasty Python trick today and I'm giddy over how beautiful it is.

If anyone knows someone who is looking for an apartment in central Zürich, please send them my listing: https://www.homegate.ch/rent/4001486594 I'm getting pretty stressed out about this since I'm leaving the country in about a week and haven't found a new tenant.

Got a bit carried away with the malware analysis and created a second version of the GorillaBot extractor: https://github.com/ZetaTwo/binja-experiments/tree/master/script_gorillabot_config_v2. This variant combines @vector35 Binary Ninja with @qiling_io for a more robust...

I used @vector35 Binary Ninja to write a tool which automatically extracts the C2 configuration (servers, port, key) from GorillaBot samples: https://github.com/ZetaTwo/binja-experiments/tree/master/script_gorillabot_config. Could be useful for its functionality or as an example of...

Thanks a lot to @nickharbour and team for this year's #FlareOn11. Solid challenges overall. I especially enjoyed 5, 7 & 9. Looking forward to seeing solutions for 9. I feel like there are multiple things I could have done better but overall I learned a lot this year.

Challenge 9 of #FlareOn11 is nasty and I'm all here for it. :)

Had an unusually fast start in #FlareOn11 with five challenges already down so I guess karma will bite me hard in the later ones but first it's time to go touch some grass.

After a bit more than four amazing years in the Google red team, and almost three years in Switzerland, the time has come to move on to the next thing. At the end of October, with a mix of fear and excitement I'll move to London. But first I'll help org Hackceler8 one last time!

This year I've organised more #CTF than I've played but I got in the mood this weekend and played snakeCTF with @royal_roppers. We managed to secure first place and a finals spot! Thanks to MadrHacks for hosting.

I'm writing an article for @pagedout_zine and I'm looking for someone with a strong understanding of ELF files and reverse engineering to fact check me (and keep a secret until the issue is released).

Remember people, clean your keyboards

APB: I seem to have lost my Dr. Carol pin somewhere on the DEFCON floor. If you find it I would be immensely grateful to have it back. :)

Wow! 11 years later I have now received money back from the MtGox hack. :D

Why the hell did it take me all until now to watch @HazbinHotel?!? 🎶 'Cause Hell is forever Whether you like it or not 🎶