Posts
2313
Following
523
Followers
1241
A drunken debugger

Heretek of Silent Signal
Security Explorations - SIM / USIM cards

https://security-explorations.com/sim-usim-cards.html

"On this web page, we are to share some information based on the experiences gained in the SIM / USIM card security space, all in a hope this leads to the increase of public awareness on the topic, change perspective on the SIM / USIM card industry and potentially trigger some positive changes (such as introduce transparency in vulnerability handling processes in particular)."
0
1
1
repeated

Many congratulations to ESET researcher Marc-Etienne M.Léveillé (@marcetienne), winner of the 2024 Péter Szőr Award for Technical Security Research for his research "Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain"! https://www.virusbulletin.com/conference/peter-szor-award/

0
2
0
Somebody should tell C-levels in tech that there are ways other than advertising to make money
1
0
3
repeated

Just a few more days left to sign up for our Online GMT Novice to Ninja training! Join us on our path through disassembly, lifting, and decompilation to learn how small patterns can add up to a larger understanding: https://shop.binary.ninja/products/n2n-oct-2024

0
1
0
repeated

"Mozilla is going to be more active in digital advertising."

"we do this fully acknowledging our expanded focus on online advertising won’t be embraced by everyone in our community" - https://blog.mozilla.org/en/mozilla/improving-online-advertising/

I appreciate Mozilla laying their intent out explicitly with no room for interpretation or guesswork.

Personally, I think this is not just a huge misstep, but a deathknell.

32
18
0
repeated

Mozilla's CEO doubles down on them being an advertising company now.

tl;dr: "LOL get fucked"

They've decided who their customers are, and it's not you, it's people who build and invest in surveillance advertising networks. But in a "respectful" way....
https://jwz.org/b/ykaO

0
12
0
repeated

Mozilla bought the excellent Android email app K-9 (which didn’t include any trackers) and integrated trackers as part of ‘s rebranding under the name.

They even made it opt-out instead of opt-in. Their defense for breaking the law: ”we wouldn’t have enough data if we obeyed the law.“

It doesn’t matter whether you ”anonymized“ the data or not: If you want to extract data from someone’s device to yours, you may do so only if they knowingly consented.
https://social.tchncs.de/@kuketzblog/113244035577912640

2
14
0
repeated

Talos Vulnerability Reports

New vulnerability report from Talos:

Veertu Anka Build registry archive files directory traversal vulnerability

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2059

CVE-2024-41163
0
1
0
repeated

Talos Vulnerability Reports

New vulnerability report from Talos:

Veertu Anka Build node agent update privilege escalation vulnerability

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2060

CVE-2024-39755
0
1
0
repeated

Talos Vulnerability Reports

New vulnerability report from Talos:

Veertu Anka Build registry log files directory traversal vulnerability

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2061

CVE-2024-41922
0
1
0
repeated

Talos Vulnerability Reports

New vulnerability report from Talos:

GNOME Project G Structured File Library (libgsf) Compound Document Binary File Directory integer overflow vulnerability

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2068

CVE-2024-36474
0
1
0
repeated

Talos Vulnerability Reports

New vulnerability report from Talos:

GNOME Project G Structured File Library (libgsf) Compound Document Binary File Sector Allocation Table integer overflow vulnerability

https://talosintelligence.com/vulnerability_reports/TALOS-2024-2069

CVE-2024-42415
0
1
0
[RSS] Pwning LLaMA.cpp RPC Server with CVE-2024-42478 and CVE-2024-42479

https://pwner.gg/2024/10/03/llama-cpp-cves/
0
0
1
repeated

Just published a deep dive on how we have made it possible to debug the kernel with drgn, without installing any debuginfo packages, on Oracle Linux.

This is a really cool feature that we're in the middle of upstreaming, so it's not quite present in drgn's main branch. However the article has links to all the relevant code, PRs, and issues, so you can see the process in real time, and learn how to get it working on other kernels/distros.

https://blogs.oracle.com/linux/post/introducing-ctf-support-in-drgn-for-oracle-linux

1
3
0
[RSS] How can I detect whether the user is running as an elevated administrator (as opposed to a natural administrator)?

https://devblogs.microsoft.com/oldnewthing/20241003-00/?p=110336
0
0
0
repeated

is not just tooling and techniques. Modern are a fun target for and alike. A fundamental tool to properly hack mobile apps is @fridadotre by @oleavr.

We continue our tour of my @github projects with my humble contributions to this field:
https://github.com/0xdea/frida-scripts

For a well-maintained project that includes some of my scripts, check out by @apps3c and Piergiovanni Cipolloni:
https://github.com/federicodotta/Brida

And even after many years, if you search for well-crafted Frida scripts to bypass certificate pinning or root detection, there’s a very good chance that you’ll stumble upon the work of some of my colleagues… Very proud of my team at @hnsec!

0
3
0
repeated

Project Zero Bot

New Project Zero issue:

UAF race of global maps in fastrpc_mmap_create (and epilogue functions) cause memory corruption

https://project-zero.issues.chromium.org/issues/42451715

CVE-2024-33060
0
1
2
repeated

Project Zero Bot

New Project Zero issue:

Incorrect searching algorithm in fastrpc_mmap_find leads to kernel address space info leak

https://project-zero.issues.chromium.org/issues/42451713

CVE-2024-33060
0
1
2
repeated

Project Zero Bot

New Project Zero issue:

Double-free (or UAF) race in possibly unused qrtr_bpf_filter_detach

https://project-zero.issues.chromium.org/issues/42451712

CVE-2024-38401
0
1
2
repeated
Show older