eyalitki

5 ms·

31.
by eyalitki 6y ago
I have written one for that years ago in Java. It generates a map according to my first "click" and solves it deterministically. If it reaches a state in which it has to guess, it regenerates the map, and tries again. It happens s
32.
by eyalitki 6y ago
Only on Ubuntu, in which the first click must be "0". On Windows it could for example be "2" and then you have to guess which of the adjacent 8 cells are the 2 mines...
33.
Infiltrating the network using a malicious ZigBee lightbulb(research.checkpoint.com)
8 points by eyalitki 6y ago|1 comments
34.
by eyalitki 6y ago
Here is the link to the full technical paper: https://research.checkpoint.com/2020/apache-guacamole-rce/
35.
Remote Code Execution in Apache Guacamole RDP Gateway (CVE-2020-9497/8)(research.checkpoint.com)
2 points by eyalitki 6y ago|0 comments
36.
by eyalitki 6y ago
The printers get it from treck (HP OfficeJet and LaserJet use it), which probably means that other clients of this TCP/IP stack will be vulnerable as well. Although I can't figure out why this feature should be "on-by-default
37.
by eyalitki 6y ago
Yes. We have 12 bits masking just the lower page, in addition to more than 10 bit above that. Chances to guess that correctly are VERY slim.
38.
by eyalitki 6y ago
Too sad we had to wait 22 years to a similar change to find its way to the more widely used glibc / uclibc(-NG)
39.
by eyalitki 6y ago
While ptmalloc/dlmalloc/tcmalloc use a single-linked list meta-data that is stored adjacent to the user buffers, in jemalloc there is no such meta-data. jemalloc's design stores the sensitive meta-data separately, thus removi
40.
by eyalitki 6y ago
Not yet. Working with each open-source demanded a lot of effort, so we were hoping that integrating it into a few dominant libraries will attract the attention of the rest. We will happily assist them if they need/want our help.
41.
by eyalitki 6y ago
We can detect corruption in 15/16 times. In our tests, when we didn't detect a corruption, the program still crashed, but without a proper error message. One should remember that the pointer is masked, so an attacker without the s
42.
by eyalitki 6y ago
We executed the benchmark suite multiple times, and results were consistent. It was way more stable than the same execution on a PC with multiple programs. Anyway, the maintainers of glibc performed the same checks and confirmed our measure
43.
Safe-Linking – Eliminating a 20 year-old malloc() exploit primitive(research.checkpoint.com)
115 points by eyalitki 6y ago|28 comments
44.
by eyalitki 6y ago
Happy to see that people still remember our talk :)
45.
by eyalitki 6y ago
Glad to hear that they took our advice, and enabled automatic firmware updates by default. We suggested this feature when we helped them fix the fax vulnerabilities (DEFCON 26 - What The FAX?!), happy to see they listened.
46.
The Path Not Taken: How We Accidentally Bypassed Window's PathCanonicalize()(research.checkpoint.com)
1 points by eyalitki 6y ago|0 comments