April 30, 2022

Gabriel Noronha @GLNoronha

I don’t normally tweet Iranian propaganda videos, but there’s an exception to every rule…

---

Long “known,” but now an established fact.

Seth Hettena @seth_hettena

It’s taken 20 years to confirm what everyone suspected: the man who met two 9/11 hijackers, brought them to San Diego, filmed them, and co-signed their lease was a Saudi spy

Seth Hettena @seth_hettena

A newly declassified FBI report from 2017 reveals that Omar al-Bayoumi was a "cooptee" of Saudi intelligence and was paid monthly by then Saudi Ambassador Prince Bandar. Al-Bayoumi spied on persons of interest in the Saudi community in LA and SD. https://t.co/001C6VSatr https://t.co/BzZHd0ZfVO

---

Just something to think about. Words matter.

https://angrystaffofficer.com/2022/04/11/whats-in-a-name-the-problem-with-warfighter/

---

The Glasshouse Session of April 29, 2022 with special guest Kim Zetter is now available on YouTube.

---

---

More vulns.

1ce0ear @1ce0ear

More PowerVR GPU vulnerabilities disclosed: kernel arbitrary stack overflow bugs.chromium.org/p/apvi/issues/…, Reference counter overflow bugs.chromium.org/p/apvi/issues/…, Unlink race bugs.chromium.org/p/apvi/issues/… and reference counter race bugs.chromium.org/p/apvi/issues/…. Stay tuned for more vulnerabilities :-P

bugs.chromium.org83 - apvi - Android Partner Vulnerability Initiative - Monorail

---

A write up on defeating blurred image censorship with AI (first mentioned in the April 26, 2022 newsletter)

William Fleshman @willcfleshman

Here's the story of how @notdan's Pixel Challenge was approached and solved! It's more of a narrative than a code walkthrough because I want to include a challenge like this in a ML CTF I'm putting together. Definitely still enough detail to reproduce!

link.medium.comPixel Challenge 2022The story of how the InfoSec style Pixel Challenge was solved with Machine Learning and Super-Resolution Neural Networks.

---

Awesome hackery on Apple silicon. Which is cool.

David Kohlbrenner @dkohlbre

We found a way to leak data on Apple Silicon processors that is "at rest": that is, data the core never reads speculatively or non-speculatively. This will be an odd one, so stick around for the 🧵 and see prefetchers.info

prefetchers.infoAuguryUsing Data Memory-Dependent Prefetchers to Leak Data at Rest

---

Crypto. Exploit. Millions lost. etc etc

Hacxyk. @Hacxyk

1/n We have finished a preliminary analysis of a recently $80M exploit from @RariCapital. Here's we think how the attack was pulled off. 👇Here's the one sample exploit TXs etherscan.io/tx/0x0742b138a…

---

Paper on some research of interest

_S0nn1_ @_S0nn1_

I'm very happy to share that our paper on "How Machine Learning Is Solving the Binary Function Similarity Problem" has been accepted at USENIX Security '22. 🎉🎉 usenix.org/conference/use… /cc @emd3l, @xabiugarte, @reyammer, @balzarot, @mmrota777

usenix.orgHow Machine Learning Is Solving the Binary Function Similarity Problem | USENIX

---

This is an excellent story.

jonwu.eth @jonwu_

No bullshit I think I just interviewed a North Korean hacker. Terrifying, hilarious, and a reminder to be paranoid and triple-check your OpSec practices. Here's how it went: 🇰🇵

---

No Context Brits @NoContextBrits

“Microsoft Word? I haven’t heard that name in years…”

---

Nice work

kylebot @ky1ebot

I just pwned Google's Container-Optimized OS with a 0day, *again*! The vulnerability lies in a hot cache in Linux kernel thus extremely hard to exploit in the remote server. Thanks to @sirdarckcat 's help in resetting the servers, I was finally able to make it work!

---

Slides for the keynote from that fuzzing conference.

Abhishek Arya @infernosec

Slides from my keynote at the NDSS Fuzzing workshop is now posted -

---

Great to have someone explore the limitations of DALL-E

Benjamin Hilton @benjamin_hilton

DALL-E is crazy impressive. But I’m getting a feel for what it can and can’t do, and there are some quite noticeable limitations you won’t see on the curated publicised examples (including my own). So, 8 limitations of DALL-E, a thread: (also, have a #dalle koala doing magic)

---

More info on the dolphins deployed in the Ukraine war.

---

The Australia Electoral Commission talks about blockchain and elections

AEC ✏️ @AusElectoralCom

@NewtonMark @XRPBACKED @AltMediaWatch @PaulineHansonOz Our perspective as non-ICT experts on social media is that it appears to be a technology designed to facilitate the theft of pictures of monkeys. Not sure how it would be relevant from an electoral standpoint.

---

No Context Brits @NoContextBrits

Throwback to the time the BBC asked Rage Against The Machine not to swear during a live broadcast.

---

Amateurs practice until they get it right. Professionals practice until they can’t get it wrong.

"Agile Otter" Tim Ottinger @tottinge

@PragmaticAndy "Practice doesn't make perfect. Practice makes permanent. Guided practice makes perfect."

---

✨🌸 Infosecsie 🌸✨ @myraccoonhands

I’ve been in infosec for a few years now and I can confidently say that most companies older than 10 years old usually have severe technological debt and an illustrious, mysterious black box computer or server everyone is afraid of touching. (Probably because it’s haunted 👻)

Jon Turner @jjturner

@myraccoonhands @GossiTheDog I'm now in my 3rd company that is 120+ years old. Oh, the things you find. One guy had a VAX in the corner of his office (non working). He had been there for 20 years but never moved it because he thought it was part of the air conditioning.