Lightnews — Scholar-powered news

Reposted by dmnk

buherator @buherator.bsky.social · 13h

[RSS] Lucid Dreams II: Harness Development

h0mbre.github.io ->

#fuzzing

Original->

Reposted by dmnk

Tim Blazytko @mrphrazer.bsky.social · 6h

The recording of our (CC @nicolo.dev ) talk "Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications" at @reconmtl.bsky.social is now online!

Recording: www.youtube.com/watch?v=QxSG...

Slides: synthesis.to/presentation...

#BinaryNinja Plugin: github.com/mrphrazer/ob...

Recon 2025 - Breaking Mixed Boolean-Arithmetic Obfuscation in Real-World Applications

YouTube video by Recon Conference

www.youtube.com

4 3

Reposted by dmnk

Catalin Cimpanu @campuscodi.risky.biz · 5h

Talks from the REcon 2025 security conference, which took place in June, are available on YouTube

www.youtube.com/@reconmtl/vi...

4 9

dmnk @dmnk.bsky.social · 16h

Just use the 24 summary slides and freestyle the rest on stage, talk done 😬

Reposted by dmnk

Robin Bradshaw @en4rab.bsky.social · 1d

In retrospect looking for command injection on a zte MF971V by putting ;reboot; on the end of values might not have been the best idea as its now reboting every 40 seconds or so and i cant connect to the wifi.
Have ordered another to try ;telnetd; instead

1 6

Reposted by dmnk

buherator @buherator.bsky.social · 1d

[RSS] Oops! It's a kernel stack use-after-free: Exploiting NVIDIA's GPU Linux drivers

blog.quarkslab.com ->

Original->

2 3

Reposted by dmnk

Gabriel Geiger @gabrielgeiger.bsky.social · 1d

At the center of it all, the company First Wap. Hidden behind hideous 2000s web design is a ruthless surveillance pioneer that has operated in the shadows for more than two decades.

1 7 41

Reposted by dmnk

0xor0ne @0xor0ne.bsky.social · 2d

Short introduction to Windows heap exploitation

mrt4ntr4.github.io/Windows-Heap...

#infosec

Windows Heap Exploitation - From Heap Overflow to Arbitrary R/W

TLDR I was unable to find some good writeups/blogposts on Windows user mode heap exploitation which inspired me to write an introductory but practical post on Windows heap internals and exploitati

mrt4ntr4.github.io

5 12

dmnk @dmnk.bsky.social · 4d

That's a lot of 🤑

Dan Underwood @underwood.digital · 5d

We're updating our bounty program with the top award now set at $2 million for zero-click remote exploit chains. In addition - there are increased awards for proximate wireless attacks, WebKit, and Gatekeeper

security.apple.com/blog/apple...

A major evolution of Apple Security Bounty, with the industry's top awards for the most advanced research - Apple Security Research

Today we’re announcing the next major chapter for Apple Security Bounty, featuring the industry’s highest rewards — up to $2 million and a maximum payout in excess of $5 million — expanded research categories, and a flag system for researchers to objectively demonstrate vulnerabilities and obtain accelerated awards.

security.apple.com

3

Reposted by dmnk

Matthew Garrett @mjg59.eicar-test-file.zip · 4d

Current status: oh god why am I in the BRCM2837 interrupt controller docs all I wanted was a higher degree of graphical fidelity in Doom

1 3 58

Reposted by dmnk

Marcel Böhme @mboehme.bsky.social · 7d

After 5 years, we are back at NDSS in San Diego!

Looking forward to submissions from the Security and the Software Engineering community!

Yannic Noller @yannicnoller.bsky.social · 7d

#FUZZING'26 CALL FOR PAPERS
──────
✨ After 5 years, we will be again co-located with NDSS!

🔗 fuzzing-workshop.github.io
📅 11. Dec (Submission)

//cc @mboehme.bsky.social (MPI-SP), @ruijiemeng.bsky.social (CISPA), @rohan.padhye.org (CMU), László Szekeres (Google)

2 4

Reposted by dmnk

Mark Dowd @mdowd.bsky.social · 7d

I have a spare hexacon ticket if anyone wants it

2 2

Reposted by dmnk

Suzanne Smalley @suzannesmalley.bsky.social · 9d

Signal to leave EU rather than comply w/ Chat Control, which would scan all messages sent over end-to-end encrypted platforms. Vote on Chat Control's future Oct 14. Germany is the swing vote. Officials there opposed the measure in past but new govt silent re position
therecord.media/signal-calls...

Signal calls on Germany to vote against ‘Chat Control,’ saying it would leave EU market

The head of the Signal Foundation raised concerns around Germany now refusing to say whether it will support Chat Control in an upcoming vote.

therecord.media

13 21

dmnk @dmnk.bsky.social · 11d

We ported Rust to the Sega Megadrive for the finals 🦀🦀🦀
(Times are off by one)

dmnk @dmnk.bsky.social · 11d

Hackceler8 live stream will start on 2025-10-04 21:15 UTC / 14:15 PST

Schedule (PST)
14:15 - Live stream start
14:30 - Semifinals #1
16:30 - Semifinals #2
18:30 - Finals

www.youtube.com/watch?v=xN1W...

Hackceler8 2025

YouTube video by Hackceler8

www.youtube.com

7

dmnk @dmnk.bsky.social · 11d

Ah times are in Mexican time, do off by one

dmnk @dmnk.bsky.social · 11d

My "friend"/coworker

1

dmnk @dmnk.bsky.social · 11d

I got volunteered to be a commentator on semifinal 1 and the final 😅

1 1

dmnk @dmnk.bsky.social · 11d

Hackceler8 live stream will start on 2025-10-04 21:15 UTC / 14:15 PST

Schedule (PST)
14:15 - Live stream start
14:30 - Semifinals #1
16:30 - Semifinals #2
18:30 - Finals

www.youtube.com/watch?v=xN1W...

Hackceler8 2025

YouTube video by Hackceler8

www.youtube.com

2 1 2

dmnk @dmnk.bsky.social · 15d

A beer leak?

Lorenzo Franceschi-Bicchierai @lorenzofb.bsky.social · 15d

NEW: A cyberattack has forced Japan's beer maker Asahi to suspend operations at its plants in the country since Monday.

For now, the company said it's experiencing a "system failure" but did not confirm "leakage of personal information or customer data to external parties."

Japan's beer-making giant Asahi stops production after cyberattack | TechCrunch

A day after one of Japan's biggest brewers, Asahi Group, announced it suspended production due to a cyberattack, the company said it has no timeline for its recovery.

techcrunch.com

Reposted by dmnk

Lorenzo Franceschi-Bicchierai @lorenzofb.bsky.social · 15d

NEW: A cyberattack has forced Japan's beer maker Asahi to suspend operations at its plants in the country since Monday.

For now, the company said it's experiencing a "system failure" but did not confirm "leakage of personal information or customer data to external parties."

Japan's beer-making giant Asahi stops production after cyberattack | TechCrunch

A day after one of Japan's biggest brewers, Asahi Group, announced it suspended production due to a cyberattack, the company said it has no timeline for its recovery.

techcrunch.com

1 9 13

Reposted by dmnk

Michael A. Specter 👻 @mikespecter.com · 16d

Today, my research group @ Georgia Tech released a paper on vulnerabilities in Tile --- the second largest device finding network after Apple's AirTags.

You can read about it in Wired, reporting by @kimzetter.bsky.social!
www.wired.com/story/tile-t...

1 34 61

dmnk @dmnk.bsky.social · 17d

We still have strong guardrails for the model (i.e., the agent has to prove it found a valid bug, it's not allowed to change the harness (yet), ...) else we had to deal with false positives left and right.
However, it finds complex bugs that a fuzzer would never find, so I would say it's a net win..

2

Reposted by dmnk

Natalie Silvanovich @natashenka.bsky.social · 19d

Super cool potential ASLR leak involving dictionary hashes! googleprojectzero.blogspot.com/2025/09/poin...

Pointer leaks through pointer-keyed data structures

Posted by Jann Horn, Google Project Zero Introduction Some time in 2024, during a Project Zero team discussion, we were talking about how...

googleprojectzero.blogspot.com

6 10

Reposted by dmnk

Tanner Rowlett @trowlett0.bsky.social · 21d

GUIFuzz++ is the first general-purpose fuzzer for desktop GUI software! Fuzzing by translating AFL++ random input into user interaction with GUIs, leading to the discovery of 23 new bugs!

Paper: futures.cs.utah.edu/papers/25ASE.pdf
Source: github.com/FuturesLab/GUIFuzzPlusPlus

Go test some GUIs!

1 11 17

dmnk @dmnk.bsky.social · Sep 13

Adobe premiere - davinci resolve, it's what professionals use, contains features Adobe holds back for after effects, and for everyday tasks the **free** version is enough!

Photoshop, I've been using affinity photo and it gets the job done

Light room: capture one