[RSS] The benchmarkpocalypse

https://danluu.com/benchpocalypse/

Microsoft killed my exploit 😢
This Friday on @offby1security I'll talk to @steph3nsims about what why, how and if this is the end for this class of exploit techniques

One day I'll sit around the camp fire and be like "You know grandpa Bas used to this stuff by hand before the em-dashes took over" ... Things like https://github.blog/security/vulnerability-research/now-you-c-me-now-you-dont-part-two-exploiting-the-in-between/ were always less about the bugs themselves and more about how to approach attack surfaces and exploit development as an adventure in creative debugging and ultimately just fun puzzling. Of course, that very same kind of iterative text based feedback loop is perfect for the current fancy text completion revolution. It's just a bit of a shame that the landscape seems to be shifting from "that was so much fun to figure out!" towards "oh wow it was able to figure it out".

I escaped the WebAssembly's sandbox and got arbitrary shell execution on the host. https://trustsig.eu/blog/wasm2c-tableflip-unchecked-calloc/

No perfect 10s this time, but that's a lot of AIX vulns from the other day:

https://www.ibm.com/support/pages/node/7283858

@unchartedworlds Of course. Our disagreements root in the fact that you find a street a good analogy for the Internet (in fact, I should've written Fedi/social media), while I don't.

@unchartedworlds The Internet is not the street though, and there seems to be a divide about how different groups of people see the Internet.

Case in point: When I posted first on Fedi I expected my post to be shared, digested, etc. far and wide. Some people clearly expected the opposite.

Norms may have changed, they sometimes do. Still my best bet is that content both of us post on Fedi is shared, digested, etc. far and wide.

@jik "I'm not going to call you names" - I didn't mean you either, sorry for the confusion!

The funny thing is that I don't even think our stances are too far apart, but this topic somehow still triggers flames after all this time.

I expressed my opinion, you expressed yours. I'm OK with not taking this further.

@jik Thanks for the reasonable reaction! I'm thinking about said controls as a band-aid for an already messed up situation (see the first part of my post). E.g. an opt-in system could make all historic posts followers-only by default. This wouldn't affect existing archives ofc. (which do exist whether we like it or not) and may be too much headache for users. We'd need arguments and compromises.

Calling each other names only conserves the current situation where one chunk of users is missing key features while an other is living in a false sense of privacy.

Just published “Vulnerability Analysis of CVE 2025 22226 Information Disclosure Due to OOB Read in VMwares HGFS” by Alex Zaviyalov the first vulnerability in an ITW VMWare guest to host escape chain 👇

https://www.nccgroup.com/media/1mzfvyzl/nccgroup_cve-2025-22226.pdf

We have achieved kernel code execution via the IDT under Windows 11 with VBS/HVCI/kCET enabled.

Read the technical write-up here: https://exploitpack.com/blogs/news/idt-table-hijacking-under-vbs-hvci-kcet-in-windows-11

#Windows11 #KernelExploit #IDT #VBS #HVCI #kCET #DataOnly #RedTeam #ExploitResearch #WindowsSecurity #infosec #pentest

@dsalo See, "we can't even seem to have a proper discussion about the possible solutions". Bye!

@dsalo I think the root of this problem is that people who want to be forgotten historically chose the absolute worst platform for their communication: a public[1] microblogging platform.

I strongly believe a searchable, archived Fedi would be immensely useful and necessary so please don't suggest that everyone in the Fedi are on the same page about this. I'm not against having controls (either opt-in or opt-out) to control indexing on a per-account basis, but unfortunately we can't even seem to have a proper discussion about the possible solutions.

[1] The consent so many people seem to miss is in the act of pressing the button to *publish content on the open Internet*.

TIL when the Windows `copy` command is called with one directory argument it copies all files from that directory to CWD.

This was unexpected.

I'm inclined to draw a Petri net, please send help!

If I gambled on both NFTs and the metaverse to the tune of millions and millions of dollars and even renamed my company accordingly I would be so canceled I’d be farming potatoes, but people are still quoting Zuck AI predictions on my daily news feed.

Doing a presentation tomorrow on our utter dependence on US technology and specifically how we 100% picked US tools/support for cybersecurity as well. We are SO fucking fucked. #sentinel

Can someone explain to me why AI companies are not being investigated for hacking other companies?

In the country I am living in, authorities HAVE TO investigate when they get to know about a crime - even without a criminal complaint (because generally people who were e.g. murdered cannot complain any more...).

Is the US justice system already so broken that this doesn't work any more?

@timb_machine Clear sign of ancient use of antigravity!