tukan (@_2can) profile picture

tukan

@_2can

https://xitter.gq/t.co/4wDlqqQzTa

linktr.ee/_2can
Joined October 2012
  • Tweets189
  • Following682
  • Followers820
1Media
Photo by tukan (@_2can)
Save the date. #Offensivecon25
Image from offensivecon (@offensive_con)
4
54
2
206
30,069
Check out our latest post about a vulnerability we disclosed to the Kernel Security Team - “Race conditions in Linux Kernel perf events” binarygecko.com/race-conditi…
2
33
1
89
29,450
Check out our latest blog post “Sky’s the Limit – Quick Analysis and Exploitation of a Chrome ipcz TOCTOU Vulnerability” binarygecko.com/skys-the-lim…
34
88
14,209
What is the limit of an employer owning your results? When I left TASZK I expected to not receive credit for my unpublished work. It was surprising to see my name erased from old articles.The reason why I write this post is my exemployer personally taking credit for my research/4
Daniel Komaromy (@kutyacica) profile pictureDaniel Komaromy@kutyacica25 Jan 2024
Looks like Samsung Mobile Security selected me as the #1 researcher for their 2023 Rewards Program Hall of Fame. Appreciate that, thank you! security.samsungmobile.com/h…
2
6
1
29
16,943
If the discussion about the future of humanity is Eliezer Yudkowski on one side and Marc Andreessen‘s manifesto on the other, we should without hesitation choose extinction.
2
6
45
5,556
Slides and PoC for our Ekoparty presentation "I'm High" by @NicoEconomou: labs.bluefrostsecurity.de/wi…
44
78
14,763
CVE-2023-2008 - Analyzing and exploiting a bug in the udmabuf driver by @dialluvioso_ and @esanfelix labs.bluefrostsecurity.de/bl…
50
1
127
22,636
We've been asked to share the kernel challenge we had at OffensiveCon. You can download it at static.bluefrostsecurity.de/… and give it a try. It was meant to be solved live at the conference, but apparently the noisy environment and german keyboard layout made it too hard :').
3
35
4
118
22,698
Revisiting CVE-2017-11176: Introduction to Android/Linux kernel exploitation by @Firzen14 labs.bluefrostsecurity.de/re…
1
39
4
111
26,687
We are growing our browser vulnerability research team! Full time Chrome research, flexible hours, huge bonuses and fun retreats. Contact us at: careers(at)bluefrostsecurity(dot)de
1
11
1
44
23,293
#OffensiveCon23 CFP is now officially open! cfp.offensivecon.org/ Don't wait until the last minute to submit!
OffensiveCon27

OffensiveCon27

Schedule, talks and talk submissions for OffensiveCon27

cfp.offensivecon.org
46
1
71
We've disclosed two remotely exploitable Linux kernel bugs in the Bluetooth stack: one infoleak and one UAF. More information here: github.com/google/security-r… and here: github.com/google/security-r… (cc @theflow0)
Linux Kernel: Infoleak in Bluetooth L2CAP Handling

Linux Kernel: Infoleak in Bluetooth L2CAP Handling

### Summary There is an infoleak vulnerability in the Linux kernel's `net/bluetooth/l2cap_core.c`'s `l2cap_parse_conf_req` function which can be used to leak kernel pointers remotely. T...

github.com
6
186
2
565
New blog post released! Windows Segment Heap: Attacking the VS Allocator by @_vepe labs.bluefrostsecurity.de/bl…
83
3
234
Video and slides for “UnZiploc”: labs.taszk.io/articles/post/… In our new OTA exploitation research on Huawei phones we explored remote interfaces to get RCE and escalate to TrustZone using logic bugs only.
[BugTales] UnZiploc: From 0-click To Platform Compromise

[BugTales] UnZiploc: From 0-click To Platform Compromise

Exploring remote OTA interfaces on HarmonyOS/Android to get RCE using logic bugs

labs.taszk.io
70
3
163
Please RT - I have no job next: I was told that my request was likely to succeed, and I have custody of my kids, so I can't "return to the office" as I'm expected.
Ange (@angealbertini) profile pictureAnge@angealbertini1 Apr 2022
It's a great date to have your request to work remotely rejected because it's "not aligned with your team or organisation" even if the whole team and hierarchy is working in different locations or countries. I'm looking for a WFH position, starting June: file formats, RE, fuzzing
3
59
2
41
Want a chance to join BFS as a vulnerability researcher and enjoy a full time remote position, with a competitive base salary, cash bonuses and amazing fun retreats? Try out a light challenge to begin your journey! labs.bluefrostsecurity.de/bl…
1
20
1
66
#Offensivecon22 registration is OPEN! Remember tickets are limited. offensivecon.org/register.ht…
29
11
46
New Advisory: Use-After-Free in the Android ION Allocator - with commentary by @gymiru on why we are publishing a 0-day (hint: Google's own advertised disclosure policy goals) labs.taszk.io/blog/post/61_a…

Kernel Vmalloc Use-After-Free in the ION Allocator

Vmalloc Use-After-Free in the ION/DMA-Buff subsystems

labs.taszk.io
2
60
137
Patching bootroms? It’s a thing! In a follow-up to our Black Hat USA talk, @szabolor investigates how Huawei’s OTA update addressed our bootrom vulnerabilities labs.taszk.io/articles/post/…
Test Point Break: Analysis of Huawei’s OTA Fix For BootROM Vulnerabilities

Test Point Break: Analysis of Huawei’s OTA Fix For BootROM Vulnerabilities

Reverse engineering the OTA that broke the bootrom exploits

labs.taszk.io
2
59
1
142
Achievement unlocked: write a Linux kernel exploitation post in which a bootrom exploit is the throwaway sidebar. After his recent entry on exploiting Samsung's NPU, this follow-up from @gymiru targets Huawei's own NPU driver instead to exploit a P40 Pro labs.taszk.io/articles/post/…
[BugTales] Da Vinci Hits a Nerve: Exploiting Huawei’s NPU Driver

[BugTales] Da Vinci Hits a Nerve: Exploiting Huawei’s NPU Driver

A deep dive into the exploitation of Huawei's NPU kernel driver

labs.taszk.io
1
83
4
143
Load more