landr0id

HardenedBSD got the userland running fine. It was iirc mostly irrational fear by the FreeBSD team that someone's bad application would break.

HardenedBSD (FreeBSD fork) has had ASLR and other mitigations since forever. Shawn submitted a patch that was never merged because of mailing list politics or something of that sort + people afraid it was going to break the world.

https://reviews.freebsd.org/D473

Yep, they're also pretty popular with people who cheat in ESEA/FaceIT third-party ladders. One of the guys, ra1f, eventually outed himself [1]. The software-based anticheat is fairly decent, pushing people to hardware-based cheats built off of PCILeech to avoid detection.

[1]: https://twitter.com/rra1f/status/1067518342595006466

>Is Qualys getting paid for this excellent work, and if so, by who?

I can't say I have any info on this subject, but having a group of people do stellar newsworthy offensive security research around widely used products is a good way to market your company for free and help drive sales for your security products.

Check out winocm's view of a 112-core server: https://twitter.com/winocm/status/1183533208605990913

Does this apply to the internal build system as well? As far as I know this issue still has not been addressed in recent Android system images for Pixel devices: https://twitter.com/landaire/status/1152739987869167616

Pretty sure at this point they’re just focused on getting feedback on the design before actually doing work on creating the tool. See this thread: https://twitter.com/filosottile/status/1180861642546073600?s...

>it appears that the payload is relatively large

Not knowing much about Blazor, what are you referring to here? The size of the WASM blob for your own code, or does Blazor have an associated runtime that's large? And what is considered "large"?

Anyone can (and people are) just scan the internet for hosts on port 80/443 and unless your site uses virtual hosts and has no HTTPS certificates issued to one of your domains, it's going to be discovered and probed exactly like this site does anyways. The difference is real adversaries are doing it without you knowing.

Why not run in release mode then to really show capabilities? Poor choice.

All of the CVEs give credit to "Chris Coulson of Canonical Ltd.". Nice job Chris. Looks like they've probably developed a fuzzer targeting client packet handling. I wouldn't be surprised if we see more bugs pop up as a result of this attention.

It's been used consistently to get initial code execution on the PlayStation 4, iOS (for attacks involving just following a web link), and probably used pretty consistently other nation-state attacks but I have no real data to back this up.

The Pegasus spyware for instance utilized a JIT attack in JavaScriptCore in Safari for the initial stage.

Even with this, people are dumb. It's probably not a case of "we didn't realize we were publishing to" and instead a case of "some dev didn't realize this was a bad idea".

Yesterday my teammate published a blog post on getting started with fuzzing para-virtualized devices in Hyper-V as well: https://blogs.technet.microsoft.com/srd/2019/01/28/fuzzing-p...

Alex's blog post compliments it very well and both are great reads to get a better understanding for how Hyper-V works.

Pretty short page but solid background.

ssdeep is also used https://www.forensicswiki.org/wiki/Ssdeep

If they got information from an insider, it could potentially be insider trading. Something somewhat similar happened when MedSec shorted St. Jude before publishing some security research about some hardware: https://arstechnica.com/information-technology/2016/08/tradi...

I don't believe that case was considered insider trading but I may be mistaken.

You're correct -- I was referring to the table that was easiest to quickly reference which is the changelog, not ALL current prices. The periodic table is more accurate. I'll update my post.

Exploit prices and complexity usually accurately reflect the security of a product when compared to their competitors. Take a look at how much Zerodium pays for full-chain exploits here: https://zerodium.com/program.html

  $250,000 - Chrome RCE + SBX (Windows) including a sandbox escape (previously: $150,000)

Whereas it's up to $100k for Edge RCE+SBX, $80k for Firefox RCE+SBX

You obviously need to factor in other things such as how popular the product is compared to competitors, etc., but such a drastic price difference such as this is quite telling.

Serving large amounts of content over HTTPS is expensive. When the data is signed anyways you gain nothing by using TLS other than privacy.

I'm going to go ahead and plug a script I made to do something similar (if you were to put it on a cron job I suppose): https://github.com/landaire/detweet

I use virtualenv so I can just easily `pip freeze > requirements.txt` for individual projects.

This is the first I've read of the JSON Lines format. What problem does this solve?

*answered my question shortly after posting by re-reading the blog post: "enables incremental writing and reading of the recording."

So it makes streaming data a lot easier.

So what's this API do? Allow you to ditch vimscript for lua or something else?

The last time I ordered from Postmates I got $75 worth of Chinese food for a big group (5 entrees, 2 sides of rice). When the food arrived I got 3 entrees, one of which was sweet and sour chicken without the sauce, and no sides.

I contacted Postmates about it and they refunded me $17. Huge inconvenience since the food took forever to get to me and I was missing over half of the order and had 4 other hungry people. Never ordering from Postmates again.

Well in fairness, the link points to the Windows blog. The actual marketing page should probably be the link: https://www.microsoft.com/en-us/surface/devices/surface-book...

Snipping tool doesn't exist on hospital PCs?

Looks like they check to see if the cert issuer is a trusted root CA and then they check that the subject name is "Notepad++"

https://github.com/notepad-plus-plus/notepad-plus-plus/commi...

I work in security and yes, it definitely helps in some cases with preventing lateral movement. Since servers aren't rebooted often, if I choose to run mimikatz to dump creds off of the server and steal a user's password, that password may as well be useless if the user logged in long enough for a password reset to have been enforced in that time.

IDA is the de facto standard tool for reverse engineering. It supports a wide array of processors and executable formats, but the hex-rays decompiler (what generated the code in this screenshot on the page you linked: http://www.welivesecurity.com/wp-content/uploads/2016/12/10-...) brings a lot of the magic.

It takes some learning, but yes it's as cool as it looks.