URB Excalibur: The New VMware All-Platform VM Escapes [pdf]

https://static1.squarespace.com/static/5f3c7479f4b3c702571a047d/t/66254fd51f55767c1f60612a/1713721307086/CSW24--URB-Excalibur-The-New-VMware-All-Platform-VM-Escapes.pdf?s=09

Hexacon agenda is up!

https://www.hexacon.fr/conference/agenda/?s=09

Windows DWM Core Library Elevation of Privilege Vulnerability (CVE-2024-30051)

https://www.coresecurity.com/core-labs/articles/windows-dwm-core-library-elevation-privilege-vulnerability-cve-2024-30051?s=09

Deploying Rust in Existing Firmware Codebases by @dmnk et al.

https://security.googleblog.com/2024/09/deploying-rust-in-existing-firmware.html

@wirepair yeah it's tricky, you have to gain some circular momentum below and bend over the bar a bit

‘Everything happens for a reason’ sounds less comforting when the reason is very fucking poor planning

We want your old GPUs that were destined to become e-waste.
We're repurposing outdated GPUs to tackle challenging computer security and program analysis problems. https://buff.ly/3XsbdgJ

In light of the Internet Archive losing its appeal to hachette, I just wanted to point out some websites you should avoid:

* https://annas-archive.li/
* https://downmagaz.net/
* https://ebook-hunter.org/
* https://forcoder.net/
* https://freemagazines.top/
* https://liber3.eth.limo/

If you were to download books from these websites, you might cut into hachette's more than three billion dollars of annual revenue. So make sure to avoid those websites and the following:

* https://libgen.is/
* https://oceanofpdf.com/
* https://pdfroom.com/
* https://pdfstop.com/
* https://pdfdrive.to/
* https://pdfmagazines.club/
* https://sci-hub.se/
* https://singlelogin.re/
* ... or any of the other sites listed at https://rentry.co/megathread-books

#internetarchive

Fucking @buherator trying to kill me with this home made Palinka

#JeSuisLampshade #AlligatorCon

Security mitigation for the Common Log Filesystem (CLFS)

https://techcommunity.microsoft.com/t5/security-compliance-and-identity/security-mitigation-for-the-common-log-filesystem-clfs/ba-p/4224041?s=09

#windows

"Today, the White House Office of the National Cyber Director (ONCD) released a Roadmap to Enhancing Internet Routing Security, which aims to address a key security vulnerability associated with the Border Gateway Protocol (#BGP) "

https://www.whitehouse.gov/oncd/briefing-room/2024/09/03/press-release-white-house-office-of-the-national-cyber-director-releases-roadmap-to-enhance-internet-routing-security/?s=09

@bagder To put in perspective:
- JPEG: libjpeg 6b encoder+decoder: 24,200 lines of C
- JPEG: libjpeg-turbo encoder+decoder: 127,000 of C and ASM (multi architectures)
- JPEG2000: openjpeg encoder+decoder: 50,000 lines of .C
- JPEG2000: Kakadu commercial encoder+decoder: 214,000 lines of C++ (only coresys component)
- libjxl: 150,000 lines for the core library, encoder+decoder (deps excluded)
(All above includes blank lines + inline doc)
So this is pretty much standard for a modern codec

⚡ Operator Fabric is an open source platform built by the LF Energy Foundation (https://lfenergy.org/) for use in electricity, water and other utility operations.

Last May we did a security audit sponsored by the Open Source Technology Improvement Fund (https://ostif.org) 🙏

Read a summary of our findings and find the full report here:

https://blog.quarkslab.com/audit-of-operator-fabric.html

Ongoing slab hardening efforts

Recently, there have been multiple efforts to make the exploitation of slab memory corruptions harder.

🧵[1/5]

I started a couple of forest fires to heat my burrito and I'm surprised by the results! It was still frozen in the middle by the end of the experiment, so it's far from perfect, but I think forest fires have a lot of potential and will revolutionize the burrito heating industry!

If you plan to meet some hackers in Krakow this week check your e-mail, esp. your spam folder!

#AlligatorCon

@cynicalsecurity

IMO a major difference here is that TLS auth never meant to guarantee anything about the intentions of the other party, so crooks obtaining certs (for money or free) is not something to be fixed. This means, that communicating that lock==trust has been plain wrong (see also signed .exe==goodware).

In case of security keys attacks like the current one aren't supposed to happen and there is an incentive to fix/prevent such issues. This of course should not mean that we should blindly trust these devices (as you pointed out) but I'd argue that the concepts the industry communicates (separate your keys from your computer; prevent duplication...) are mostly right in this case ("save your keys in the cloud" is an obvious counter example).

@bgergely0 @dotstdy @whitequark

[RSS] Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)

https://blog.theori.io/deep-dive-into-rcu-race-condition-analysis-of-tcp-ao-uaf-cve-2024-27394-f40508b84c42?source=rss-4b564abdafa3------2

#linux

@whitequark incidentally, there is a beautiful parallel which I always make when discussing security and "1st papers about an attack": the so-called "nth country problem".

This is an issue in nuclear proliferation which, in a few words, says that the nth country to become a nuclear power has the benefit of knowing that it works, and what works (unlike the Manhattan Project which started on the basis of pure theory).

The "nth country problem" was actually tested by the USA by giving three Physics PhD students access to all open literature on nuclear weapons and asking them to design a weapon. They did and analysis by LANL weapons designers actually showed that it would go b00m.

Hence, even if the 1st paper is extremely unlikely (compare to the Trinity test of the Pu implosion device - there was quite a bit of uncertainty that it would work) it does not mean that it cannot be done.