landr0id

You seem fixated on "downloading files over HTTP(S)" and are missing the point.

Nearly every videogame for instance use libcurl as their HTTP stack. You know why? Because it's the best HTTP library for C/C++.

If you have a C/C++ application doing HTTP traffic it's likely using cURL. Or, I dunno, you could look at this page to find out: https://curl.se/docs/companies.html

I asked the WSDOT the same question a while back: https://twitter.com/landaire/status/944698354742599681

"The dowel bars help extend the life of the pavement by about 10 years or so."

Fair point that their marketing explicitly says this stuff is end-to-end encrypted. Seems like an obvious gap in validation/coverage of their network comms.

This looks more like negligence than malice. In order to send the push notification you have to send the content to a server that then gets pushed down through say Apple's Push Notification Service. The doorbell cannot talk directly to your device. The notification contains the image and whatever other text and metadata shown.

I'd imagine that what they mean by "planning to encrypt" this content is to E2EE the content and register a notification extension (something like: https://developer.apple.com/documentation/usernotifications/...) that transforms the content once received by the client.

As most people probably know, E2EE isn't a simple problem to do in a user-friendly way. Perhaps when setting up the app/doorbell the doorbell could have some certificate that the app is aware of that's used for encrypting the data before it leaves the doorbell, and decrypted using the app's private key but this obviously isn't something provided out of the box.

Obviously a warrant could be served to Apple/Google/Eufy for notification content, but I don't take this as being particularly nefarious.

It genuinely wouldn't surprise me if other offline doorbells like Ubiquiti's UniFi line were also affected.

*I should probably mention I wrote this comment after reading a different article/video but didn't catch that their marketing mentioned that everything is E2EE. So yeah, seems like a pretty glaring lie in that regard.

Considering the state of the cameras I wouldn't be surprised if the film was at least partially exposed to light when they removed it from the ice.

Yes, they communicate with nearby Apple devices which have opted in to being part of the AirTag discovery network.

Mostly because PS4 didn't get hardware hacked. All of the hacks were software exploits that could be patched before folks were able to leverage them to bring their consoles online with cheats. iirc it did happen a couple of times though.

>PC players play on jailbroken (in a sense) machine.

PC games also ship with anti-cheat. Why ship anti-cheat to a console that's supposed to be secure?

There's some professionalism involved with not just dropping 0day against someone's consumer product when it enables piracy or bypasses security functions, especially when you're employed in industry. PlayStation also accepted these through their bounty program, so there's a monetary incentive as well.

>2. However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away.

afaik twitter will remove your verification status if you do this maliciously. Like trying to impersonate a famous person and make it look like they're saying something stupid.

Different. These are enhanced mitigations to detect when a program is calling into the kernel from a weird state that should never happen in a well-formed program. It basically prevents certain types of exploits from successfully calling into the kernel.

*the new mitigation just makes user-mode memory completely immutable. You can never "upgrade" a page's permissions or change its contents after it's been marked as immutable.

I mean, the video is on DJI's official YouTube channel. Definitely sponsored.

There are definitely many better ways of doing this, it’s more of a thought experiment.

TIL TPMS works over RF. The blog mentions that it's at a super low power, and not that I'd ever want this, but I can't help but wonder if it's possible to set up well-placed sensors at a fixed position on a road to capture IDs going by -- effectively tracking vehicles themselves.

If you accept the job pay attention to what the Hyper-V team does. They were the best kernel team that I personally worked with and were eager to do things the best way possible.

Super minor nitpick but ROP wasn’t used for the King Kong/SMC exploit. I would consider it a ROP exploit if multiple return-oriented gadgets were chained together to form a full exploit chain, but what happened here is the syscall handler was invoked with a malformed index causing a single jump to user-mode code with kernel-mode privileges. It’s not too dissimilar to calling an arbitrary function pointer.

Otherwise this is a great comprehensive rundown!

I was just recently talking to a coworker too about how I think the Xbox 360 was the first consumer device to have the following types of attacks done to it:

1. Hypervisor attack to then reboot the console into a newer system OS version to retain the vulnerable hypervisor but be able to play new games and get online. This required soldering a separate flash chip to hold the newer system files.

2. Fault injection (reset glitch hack) to attack the system's bootloader

As a teenager who learned programming/hacking by messing with the Xbox 360, I'm thankful that Nintendo is still keeping the dream alive for our next generation of hackers.

They require you to acknowledge some terms that grant you access to the Unreal Engine source code. They grant it by adding you to their GitHub org which has the engine source code as a private repo.

Excellent work! As I learned more about digital modes and packet radio I had similar thoughts! This is a really cool writeup and I'm stoked someone looked into this.

Good read, but man those gifs are distracting.

It's a JavaScript engine bug and JS is disabled by default. Still important, but I question whether anyone who enables JS in Tor is worth compromising.

When I was in university I was working on some biology homework and didn't have Excel, but I did have Numbers! I quickly became annoyed with how smart Numbers tried to be with formatting. It knew better than me what data type some cells were and iirc it was impossible to inform it otherwise. I bought Excel after losing an hour or so of my time.

>they also have bricked retail xbox360 consoles of nefarious (teenage) actors.

I was in the "xbox underground" group and later worked at Microsoft. they never bricked retails, lol.

This is sweet! This is actually a very similar approach to how I deobfuscate Python bytecode: https://github.com/landaire/unfuck/blob/bfa164b4e261deffeb37...

My code is pretty messy, but I take the same exact approach of taking known function parameters, interpreting the instructions, and removing any condition and the instructions which built its arguments if it evaluates to a constant value. Even called it partial execution as well :p

Fuck yes

I haven't heard of this tool before, but I don't think it would work for obfuscated code. Check out the graph image on my wiki [1]. While this image doesn't show the exact scenario, imagine that the first instruction is a `JUMP_ABSOLUTE 100` and the rest of the instructions between offset [3,100) are just garbage or invalid.

A naive disassembler (like the `dis` module in python) interprets the bytecode linearly -- i.e. one instruction after another. Rizin's diassembler [2] seems to take the same approach. The way I do disassembly is to only disassemble code paths that are potentially executed by queueing non-conditional jumps, both targets of a conditional jump, and the next instruction when the current instruction is non-jumping instruction.

[1] https://github.com/landaire/unfuck/wiki/Obfuscation-Tricks

[2] https://github.com/rizinorg/rizin/blob/e3d1b967854c33cf9dfbb...

Myself and other “enthusiasts” wanted to know how certain functionality was implemented in a commercial application, so I wrote this. I was taking about a month off from work for a winter break and spent 2 weeks deep diving and reverse engineering the initial PoC, and some time off and on over the next 2 months or so refining it. So far it’s been an invaluable tool for this enthusiast community.

I am the maintainer. I explained on reddit:

>Why the name?

>

>There were many times that I looked at a code graph and said “this is fucked”. Seemed like a good name.

it's just a fun side project. not that serious

While its goals are a bit different from confidential computing, people saying "no" here have apparently never heard of the Xbox One. More generally, securing a device against its physical owner is notoriously difficult. Tony Chen gave a talk about how the Xbox One was secured against physical attack: https://www.youtube.com/watch?v=U7VwtOrwceo

>In the case of the Switch, it's not necessary to emulate the whole device or even processor, especially if the intention is to run Switch games on a computer

Switch has an ARM processor so it's definitely a requirement to emulate that, which QEMU is well-suited for. But to your point, Windows has great graphics APIs that would make it easier to pipe the graphic stack from the Switch OS into rather than writing your own implementation. The processor can be taken care of via JIT as well, but it still needs to be lifted.

Yes. The problem though is as soon as the vulnerability used in the exploit becomes public Sony pushes out a patch.

Most fuzzers I think have a dictionary of special values they’ll occasionally use. I wrote a structure-aware fuzzer framework which uses random values for the initial generation, then on subsequent mutations will perform arithmetic/bit flips with a small chance to grab a special value from the dictionary.

Even without a dictionary if your input is reasonably small it should discover these special values given enough iterations.