d0ntrash
@d0ntrash.bsky.social
Security Researcher @neodyme.io | CTF, Fuzzing, Embedded Security
Think your speech model is secure? It might be quietly leaking what it was trained on. In a new blog post, we explain membership inference attacks and why they matter for cyber security experts. 🔗 neodyme.io/en/blog/memb...
Did You Train on My Voice? Exploring Privacy Risks in ASR
This post explores a recent research paper on membership inference attacks targeting Automatic Speech Recognition (ASR) models. It breaks down how subtle signals like input perturbation and model loss...
neodyme.io
At #Pwn2Own Ireland 2024, we successfully targeted the SOHO Smashup category. 🖨️ Starting with a QNAP QHora-322 NAS, we pivoted to the Canon imageCLASS MF656Cdw - and ended up with shellcode execution. Read the full vulnerability deep dive here 👉 neodyme.io/en/blog/pwn2...
Pwn2Own Ireland 2024: Canon imageCLASS MF656Cdw
This blogpost starts a series about various exploits at Pwn2Own 2024 Ireland (Cork). This and the upcoming posts will detail our research methodology and journey in exploiting different devices. We st...
neodyme.io
From iframes and file reads to full RCE. 🔥 We found an HTML-to-PDF API allowing file reads and SSRF - then chained it into remote code execution via a Chromium 62 WebView exploit. 👉 Read the full write-up here: neodyme.io/en/blog/html...
HTML to PDF Renderer: A tale of local file access and shellcode execution
In a recent engagement, we found an HTML to PDF converter API endpoint that allowed us to list local directories and files on a remote server. One of the PDF files we created, revealed that the conver...
neodyme.io
Interested in learning about Windows exploitation? This August, join us in Las Vegas for an intensive, hands-on 4-day DEFCON training: Binary Exploitation on Windows, led by Felipe and Kolja! 🗓️ When: August 9–12, 2025 📍 Where: Las Vegas Convention Center
Wrapping up our COM hijacking series! 🎉 In the final part, we discuss a custom IPC protocol, use a registry write to gain SYSTEM privileges, and explore Denial of Service attacks on security products. 💥💻 Don't miss it! neodyme.io/en/blog/com_...
The Key to COMpromise - Writing to the Registry (again), Part 4
In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all r...
neodyme.io
🪝Introducing HyperHook! 🪝 A harnessing framework for snapshot-based #fuzzing using Nyx. ⚒️ HyperHook simplifies guest-to-host communication & automates repetitive tasks, making snapshot-fuzzing easier & more efficient! 🔗 Read more: neodyme.io/en/blog/hype...
Introducing HyperHook: A harnessing framework for Nyx
In this post, we introduce HyperHook, a harnessing framework for snapshot-based fuzzing for user-space applications using Nyx. HyperHook simplifies guest-to-host communication and automates repetitive...
neodyme.io
🔎Part 2 of our COM hijacking series is live! This time, we discuss a vulnerability in AVG Internet Security, where we bypass an allow-list, disable self-protection, and exploit an update mechanism to escalate privileges to SYSTEM 🚀💻 neodyme.io/en/blog/com_...
The Key to COMpromise - Abusing a TOCTOU race to gain SYSTEM, Part 2
In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all r...
neodyme.io
From startups to large companies, we've seen this setup used by many corporate clients in the wild. Here's why this is so difficult to fix and Microsoft has not changed the exploitable default settings yet: neodyme.io/blog/bitlock...
On Secure Boot, TPMs, SBAT, and downgrades -- Why Microsoft hasn't fixed BitLocker yet
On Secure Boot, TPMs, SBAT and Downgrades -- Why Microsoft hasn't fixed BitLocker yet
neodyme.io
If you are using BitLocker and hardware attacks were not enough to convince you to enable preboot authentication, check out my colleague's posts on a software-only attack to dump the encryption key from RAM.
Neodyme@neodyme.io · 2y agoYour laptop was stolen. It’s running Windows 11, fully up-to-date, device encryption (BitLocker) and Secure Boot enabled. Your data is safe, right? Think again! This software-only attack grabs your encryption key. Following up on our #38C3 talk: neodyme.io/blog/bitlock...
Following our #38c3 talk about exploiting security software for privilege escalation, we're excited to kick off a new blog series! 🎊 Check out our first blog post on our journey to 💥 exploit five reputable security products to gain privileges via COM hijacking: neodyme.io/blog/com_hij...
The Key to COMpromise - Pwning AVs and EDRs by Hijacking COM Interfaces, Part 1
In this series of blog posts, we cover how we could exploit five reputable security products to gain SYSTEM privileges with COM hijacking. If you've never heard of this, no worries. We introduce all r...
neodyme.io
Kids these days don't even know how much opportunity they have to learn hacking from actual pros. I know there is a lot of content out there, so it can be hard to find the good stuff. But 10 years ago you had to be lucky to find at least something. Anyway, watch this 👇
cts@gf256.bsky.social · 2y agoMy videos for Flare-On 2024 are live! Watch me reverse engineer all the challenges from start to end. 🎉🥳 + Commentary video featuring SuperFashi, where we review the chals together. * 45 hours of content * 400+ GB of raw footage Merry Christmas! Link: www.youtube.com/watch?v=vwW9...
Slides for our talk "The Key to COMpromise" (AV/EDR privilege escalation) are on GitHub. If you want to discuss this stuff, you can find @k0lj4.bsky.social or me at the CTF area of #38c3 github.com/0x4d5a-ctf/3...
GitHub - 0x4d5a-ctf/38c3_com_talk: Slides for COM Hijacking AV/EDR Talk on 38c3
Slides for COM Hijacking AV/EDR Talk on 38c3. Contribute to 0x4d5a-ctf/38c3_com_talk development by creating an account on GitHub.
github.com
To little surprise it seems that multiple #antivirus vendors have been ignoring COM hijacking as a self-defense bypass and LPE vector since at least 2018, when I first published about this technique (see my prev post). At #38c3 guys from Neodyme demonstrated some more elegant 1/2
ND people are @ #38C3 in Hamburg, Germany. Be sure to check out our two talks about LPEs in AV/EDR Products (Saturday, 4 PM YELL) and a not yet mitigated Bitlocker Flaw! (Saturday, 7:15 PM HUFF)
Watch the recording of my #ekoparty talk "Advanced #Fuzzing with #LibAFL" here: youtu.be/FI7C37lz4Rg?... Thanks @fede-k.bsky.social for this amazing event!
Advanced Fuzzing With LibAFL - Dominik Maier - Ekoparty 2024
YouTube video by Ekoparty Security Conference
youtu.be
dmnk@dmnk.bsky.social · 2y agoSlides for my @ekoparty talk "Advanced Fuzzing With LibAFL" - > docs.google.com/presentation...
Reversing C++ structures can be tricky. Binary Ninja makes it easier. I wrote up a walkthrough to clean up those pesky vtables. @binary.ninja www.seandeaton.com/gotta-re-em-... #binaryninja #reverseengineering #ghidra #ida
Gotta RE 'em All: Reversing C++ Virtual Function Tables with Binary Ninja
C++ can be frustrating to reverse engineer. Explore how to reverse engineer those with Binary Ninja.
seandeaton.com
💥When security software itself becomes a target! 💥 Learn how we've uncovered critical vulnerabilities in Wazuh, turning a powerful security tool into an unexpected attack vector. 👉 Read more about the findings: neodyme.io/en/blog/wazu...
From Guardian to Gateway: The Hidden Risks of EDR Vulnerabilities
Explore the hidden risks within security software as we dive into vulnerabilities of Wazuh, a popular EDR solution. This post reveals how even trusted tools can become targets, highlighting the import...
neodyme.io
I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...
Confirmed! Team Neodyme (@Neodyme) used a stack-based buffer overflow to exploit the HP Color LaserJet Pro MFP 3301fdw printer. The earn $20,000 and 2 Master of Pwn points. #Pwn2Own #P2OIreland
Don't really know the purpose of starter packs yet, but here's some people who fuzz(ed). Let me know who I forgot go.bsky.app/EhGFSVj
Slides for my @ekoparty talk "Advanced Fuzzing With LibAFL" - > docs.google.com/presentation...
Advanced Fuzzing With LibAFL @ Ekoparty 2024
Advanced Fuzzing With LibAFL Dominik Maier Ekoparty 2024-11-15 1
docs.google.com
Just published a blog post about some critical vulnerabilities I discovered in Wazuh last year! The post covers details on how I found these vulnerabilities and highlights why security tools like EDRs can themselves become valuable targets for attackers. #infosec neodyme.io/en/blog/wazu...
From Guardian to Gateway: The Hidden Risks of EDR Vulnerabilities
Explore the hidden risks within security software as we dive into vulnerabilities of Wazuh, a popular EDR solution. This post reveals how even trusted tools can become targets, highlighting the import...
neodyme.io