Chinese robot maker Unitree has removed a problematic component from the firmware of its Go1 robot dog that could have allowed remote attackers to take over the robot www.scmp.com/tech/tech-tr...

China’s Unitree fixes flaw that gives hackers remote control of robots

The start-up has downplayed the impact of the vulnerability, noting that the affected model has been discontinued.

scmp.com

the takeover has begun.. trainings start tomorrow morning!

Happy to share my slides from BOOTSTRAP25. Unfortunately the bug discussed is still not patched in Linux 6.14.0 despite it being reported explicitly. Slides are in markdown but there's a PDF in "releases" too github.com/jduck/bs25-s...

GitHub - jduck/bs25-slides: Slides from "Musing from Decades of Linux Kernel Security Research" at BOOTSTRAP25

Slides from "Musing from Decades of Linux Kernel Security Research" at BOOTSTRAP25 - jduck/bs25-slides

github.com

Delighted that our paper on "Grammar mutation for testing input parsers" - led by Bachir Bendrissou and joint with @ccadar.bsky.social - is now published in ACM TOSEM! This came from a registered report at FUZZING. Check it out! doc.ic.ac.uk/~afd/papers/...

Reminder that the Phrack 72 CFP closes APRIL 1ST 2025. Get your papers in and come be a part of our fabulous 40th anniversary issue! See phrack.org for more info

Would you look at that, it's tmp.0ut Volume 4! Happy Friday, hope you enjoy this latest issue! tmpout.sh/4/

Only a week and a half left for USENIX WOOT '25 conference submissions - deadline March 11 AoE. We’re looking forward to seeing even more of your amazing offensive security papers this year! And still a few days for up-and-coming track (March 4). CfP at www.usenix.org/conference/w...

We discover 119 vulnerabilities in LTE/5G core infrastructure, each of which can result in persistent denial of cell service to an entire metropolitan area or city and some of which can be used to remotely compromise and access the cellular core. https://cellularsecurity.org/ransacked

I watch and read and I’ve seen a manner research. But this research into visualising Wi-Fi signals using an array of ESP32 chips is something else. www.youtube.com/watch?v=sXwD... It is that good. That deep and frankly so out there and he calls himself a mediocre engineer too. WTF? Blown away.

This ESP32 Antenna Array Can See WiFi

YouTube video by Jeija

youtube.com

Hackers rejoice! We are releasing the Phrack 71 PDF for you today! Don't forget this year is Phrack's 40th anniversary release! Send in your contribution and be part of this historical issue! The CFP is still open, you can find it and the PDF link at phrack.org

Update your AMD Zen processor's BIOS: www.amd.com/en/resources... Check with your OEM for BIOS updates with the new microcode patches, they have had some time to address this high importance item.

2024 was a significant year for decompilation, constituting a possible resurgence in the field. Major talks, the thirty-year anniversary of research, movements in AI, and an all-time high for top publications in decompilation. Join me for a retrospective: mahaloz.re/dec-progr...

Decompiling 2024: A Year of Resurgance in Decompilation Research

The year 2024 was a resurgant year for decompilation. Academic publications from that year made up nearly 30% of all top publications ever made in decompilat...

mahaloz.re

Just unrestricted an issue that shows a fun new attack surface. Android RCS locally transcribes incoming media, making vulnerabilities audio codecs now fully-remote. This bug in an obscure Samsung S24 codec is 0-click project-zero.issues.chromium.org/issues/36869...

OMG, Orange Tsai released his latest new research 🤯 💣 blog.orange.tw/posts/2025-0...

WorstFit: Unveiling Hidden Transformers in Windows ANSI!

📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help

blog.orange.tw

Looking through the schedule of #38c3 which starts tomorrow. Some talks I’ll be watching the streams for this year: ACE up the sleeve: Hacking into Apple's new USB-C Controller fahrplan.events.ccc.de/congress/202... Liberating Wi-Fi on the ESP32 fahrplan.events.ccc.de/congress/202...

vacation reading material acquired!

Pretty interesting technique used by _mccaulay here to understand the heap better and aid exploitation of a TP-Link vulnerability! www.nccgroup.com/uk/research-...

We updated our CFP for Phrack 72! The deadline is now April 1st 2025. Check the site for specifics on how to contribute, as well as some inspiration! We also posted a link to purchase physical copies of Phrack 71, and a donation link too. Enjoy! phrack.org

Intel launched the Pentium processor in 1993. Unfortunately, dividing sometimes gave a slightly wrong answer, the famous FDIV bug. Replacing the faulty chips cost Intel $475 million. I reverse-engineered the circuitry and can explain the bug. 1/9

I wrote a fun, little blog post. Remote pre-auth file deletion in SolarWinds ARM allowed to achieve LPE on AD machines 🙃

TrendAI Zero Day Initiative@thezdi.bsky.social · 2y ago

In his latest blog, @chudypb.bsky.social covers a pre-auth Arbitrary File Deletion bug he discovered in the SolarWinds Access Rights Manager (ARM). It may not sound exciting, but it can lead to an LPE on domain-joined Windows machines. Read the details at www.zerodayinitiative.com/blog/2024/12...

A PoC for that Cleo zero-day is now live: labs.watchtowr.com/cleo-cve-202...

Cleo Harmony, VLTrader, and LexiCom - RCE via Arbitrary File Write (CVE-2024-50623)

Note: this is a rapidly-drafted post on an evolving topic - we'll update the post with more details as we discover more about the situation. Hit that F5 key regularly for updates! We were having a ...

labs.watchtowr.com

New DCOM lateral movement technique discovered that bypasses traditional defenses. Unlike previous attacks relying on IDispatch interfaces, this method exploits undocumented COM interfaces within MSI, specifically targeting IMsiServer and IMsiCustomAction interfaces. 1/7

Forget PSEXEC: DCOM Upload & Execute Backdoor

Join Deep Instinct Security Researcher Eliran Nissan as he exposes a powerful new DCOM lateral movement attack that remotely writes custom payloads to create an embedded backdoor.

deepinstinct.com

Course materials for Modern Binary Exploitation by RPISEC github.com/RPISEC/MBE?s... via @alexplaskett.bsky.social

GitHub - RPISEC/MBE: Course materials for Modern Binary Exploitation by RPISEC

Course materials for Modern Binary Exploitation by RPISEC - RPISEC/MBE

github.com

I recently saw an amazing Navajo rug at the National Gallery of Art. It looks abstract at first, but it is a detailed representation of the Intel Pentium processor. Called "Replica of a Chip", it was created in 1994 by Marilou Schultz, a Navajo/Diné weaver and math teacher. 1/n

If you're interested in the technical details, I wrote the blog post here: flatt.tech/research/pos... For the further details, please check out the announcement from the OpenWrt team: lists.openwrt.org/pipermail/op... (2/2)

Compromising OpenWrt Supply Chain via Truncated SHA-256 Collision and Command Injection

Introduction Hello, I’m RyotaK (@ryotkak ), a security engineer at Flatt Security Inc. A few days ago, I was upgrading my home lab network, and I decided to upgrade the OpenWrt on my router.1 After ac...

flatt.tech

Rapid7 has disclosed the vulns from our exploit chain targeting the Lorex 2K Indoor Wi-Fi Security Camera, which we entered at this year's Pwn2Own Ireland. A 2 phase exploit, built upon 5 vulns - phase 1 is an auth bypass, whilst phase 2 is RCE. Disclosure, analysis and exploit here: t.co/J9VDwMDRsI

Novel approach to exploit a limited OOB on Ubuntu at Pwn2Own Vancouver 2024 Slides from a talk by Pumpkin Chang about exploiting a stack out-of-bounds write bug in the traffic control subsystem. u1f383.github.io/slides/talks...

week 44, streaming kernel dev topic: userspace page fault handling prequel to week 43, worked on the kernel-mode syscall support behind userspace PF handling (incl. recursive page fault support) (pre-recorded since I'm away this week ✌️) https://www.youtube.com/watch?v=5fv6Pjx3in8

chill kernel hacking for fun (week 44, user page fault + assembly)

(detailed timestamps in comments)#livecoding #softwareengineering #operatingsystem discord: https://discord.gg/XsgpqpVxNuWelcome! This is my chill Operating ...

youtube.com

A port of DOOM for a quantum computer! github.com/Lumorti/Quan...