All current VoDs from the printer hacking are up youtube.com/playlist?list=… ! All the fun from picking a printer, desoldering and dumping flash, reversing the decompression, implanting with a backdoor, and shipping up Rust shellcode which forms a GDB stub! All in 5 easy days!
Generating insightful questions is a massively undervalued skill. To acquire it, make a habit of thinking of a question after every talk you watch. Same for books, articles & podcasts.
If you want to connect with powerful people, the best way is to ask an amazing question.
To elaborate on the format, a Bugbounty CTF would be to break into teams and collectively target a single mobile application that has a public bug bounty program. We would be looking to work with the target company in question and provide additional secureReturn rewards.
We're preparing to organize our next event and grow our community even more! But as a community we'd like to hear from all of you about what you would like to see / participate in. RT for reach and join our slack if you haven't already! #FRIDAWARS#CTF
If you are looking for technical mobile security live stream content, you won't get much better than @gamozolabs latest streams. All of his security research live streams are top tier and worth following if you don't already.
We did it, we used our exploit to snapshot a running Android device, and then brought it into QEMU where we can single step it, apply full symbols (since we build a binary identical to the release build), and of course... fuzz it in the future :)
What's up guys? Are you ready for tomorrow? The live of the m0leCon Conference will be broadcasted live at the link youtu.be/ae0Ie1G3Nqw, don't miss it!
If you are into CFI, CFG and XFG, you may like this:
I wrote a blog post about how the MSVC compiler generates XFG function prototype hashes
blog.quarkslab.com/how-the-mvsc-c…
@satnam6502@alastair_d_reid There is this interesting tension between writing code for yourself/other ppl and writing code for automated tests. One reason fuzzing and static verification don't get more adoption is bc the barrier to entry is often high. I wonder what we can do to reduce the tension.
I've released NAT Slipstreaming, a spooky new technique that allows an attacker to remotely access any TCP/UDP service bound to a victim machine, bypassing the victim’s NAT/firewall, just by the victim visiting a website. samy.pl/slipstream/ Happy Halloween!
Finally wrote up the process I took for experimenting with snapshot fuzzing. It's a long read, but I hope useful for those wanting to dabble in this tech.
Check out this in-depth walkthrough of the development of a new tool we're releasing called Barbervisor, which makes fuzzing easier for researchers cs.co/6019G9mXL
498 Followers 853 FollowingOpen-source reverse engineering platform and company. We design offensive tools for experts. #Dexcalibur. @FrenchYeti, France.
522 Followers 5K FollowingData Analysis/Mathematics/Data Management.
Technical thinker - a restless mind in restless world ! No law is needed where common sense can do the job!
2K Followers 1K FollowingSecurity engineer. Embedded systems and hardware security, reverse engineer @ Google. 🇨🇭 (Any opinion stated here is my own and not endorsed by my employer)
7K Followers 2K Followingtrying hard. streaming kernel dev - https://t.co/aO5X4jXGQD
blogging about life, art & systems programming. non-expert
work: @ableton, ex @trailofbits