Discover and read the best of Twitter Threads about #BHUSA
Most recents (9)
I'm super happy to share that our work "CustomProcessingUnit: Reverse Engineering and Customization of Intel Microcode" has been accepted at #WOOT23! 🎉
We extend our #BHUSA work to show how microcode tracing and patching can be useful to improve CPU performance and security đź‘€
We extend our #BHUSA work to show how microcode tracing and patching can be useful to improve CPU performance and security đź‘€
+ We trace microcode updates to reverse engineer the secret Intel microcode update algorithm and perform its security evaluation.
+ We present the first x86 PAC implementation, attack it with PACMAN, and provide the first public PAC implementation not vulnerable to the attack.
+ We present the first x86 PAC implementation, attack it with PACMAN, and provide the first public PAC implementation not vulnerable to the attack.
+ We design a novel breakpoint idea: microcode breakpoints, 1000x faster than software breakpoints, and show their application for fuzzing.
+ We present constant-time hardware division to efficiently protect cryptographic software from side channels on data-dependent operations.
+ We present constant-time hardware division to efficiently protect cryptographic software from side channels on data-dependent operations.
Webhooks are a big part of @kubernetesio. I've recently been going down the webhook rabbithole, especially for offensive use-cases. And here's what I think. A 🧵 1/
@kubernetesio #kubernetes uses an access control object called an Admission Controller. This is beyond AuthN and AuthZ. This allows you to create objects that will allow you the operator to define workloads and configs that are admitted in your cluster. appsecengineer.com/courses-collec…
2/
2/
@kubernetesio This is largely done using Admission Control webhooks. There are two types of webhooks you can use in #k8s, they are:
- validating
- mutating
Watch my 1m video here if you want to learn the differences
3/
- validating
- mutating
Watch my 1m video here if you want to learn the differences
3/
If you were looking for a list of all the #Microsoft talks at #BHUSA, @msftsecresponse has a summary here: msrc-blog.microsoft.com/2019/07/29/mee…
@msftsecresponse At 11:15 AM today, #Microsoft’s @markmorow and @TrimarcSecurity’s @PyroTek3 will discuss the most common attacks against the cloud + effective defenses in their session, "Attacking and Defending the Microsoft Cloud (Office 365 & Azure AD)" #MSFTatBlackHat
Also at 11:15 AM today, @JosephBialek will share his research into a vulnerability reported through the Hyper-V bug bounty in his #BHUSA session "Exploiting the Hyper-V IDE Emulator to Escape the Virtual Machine" #MSFTatBlackHat
Microsoft Defender ATP researcher @dana_baril reached out to Check Point researcher @EyalItkin about his research into the RDP vulnerabilities he reported through Microsoft's bug bounty program. The collaboration led to speedy protection for customers. cyberscoop.com/microsoft-blac…
At the Black Hat conference next week, Eyal and Dana will share their research and their unique perspectives – offense and defense – on the CVE-2019-0887 Poisoned RDP. #MSFTatBlackHat #BHUSA blackhat.com/us-19/briefing…
Today, @5aelo and I unrestricted five bugs in iMessage! Here are some highlights:
@5aelo CVE-2019-8647 is a remote, interactionless use-after-free
bugs.chromium.org/p/project-zero…
CVE-2019-8662 is similar
bugs.chromium.org/p/project-zero…
bugs.chromium.org/p/project-zero…
CVE-2019-8662 is similar
bugs.chromium.org/p/project-zero…
@5aelo CVE-2019-8660 is remote, interactionless memory corruption
bugs.chromium.org/p/project-zero…
bugs.chromium.org/p/project-zero…
My challenge of the night: create an app for #BHUSA 1/
The 1st challenge is to get the data. At @BlackHat there is 4 types of sessions:
- arsenal
- briefings
- sponsored-sessions
- training
2/
- arsenal
- briefings
- sponsored-sessions
- training
2/
After extracting the data from their website, I imported everything in a Firebase Realtime Database 3/
I thought I’d know all the stuff in this talk and just went to see @Lipner. But nope...Dr Lipner is still dropping new knowledge. #bhusa @SAFECode
If you’re not big enough to “do everything” this talk is for you. My key points:
1. Have a vuln response process, use it to learn, and fix more than just what’s reported.
2. Devs are accountable for writing secure code—don’t “test it in.”
3. Do RCAs
1. Have a vuln response process, use it to learn, and fix more than just what’s reported.
2. Devs are accountable for writing secure code—don’t “test it in.”
3. Do RCAs
4. Track SDL in the mainstream bug tracking workflow you track other bugs in.
5. Have a bug bar — exploitability matters.
6. Secure your 3rd party code. If you ship it, it’s your problem.
5. Have a bug bar — exploitability matters.
6. Secure your 3rd party code. If you ship it, it’s your problem.
"@Ethan_Heilman likes breaking hash functions for fun."
The security of the signature scheme reduces to the security of the hash function.
