landr0id

15 ms·

151.
by landr0id 4y ago
>2. However, once an account gets the blue check, the owner is free to change the profile pic and display name, and the blue check doesn't go away. afaik twitter will remove your verification status if you do this maliciously. Like
152.
by landr0id 4y ago
Different. These are enhanced mitigations to detect when a program is calling into the kernel from a weird state that should never happen in a well-formed program. It basically prevents certain types of exploits from successfully calling in
153.
by landr0id 4y ago
I mean, the video is on DJI's official YouTube channel. Definitely sponsored.
154.
by landr0id 4y ago
There are definitely many better ways of doing this, it’s more of a thought experiment.
155.
by landr0id 4y ago
TIL TPMS works over RF. The blog mentions that it's at a super low power, and not that I'd ever want this, but I can't help but wonder if it's possible to set up well-placed sensors at a fixed position on a road to captu
156.
by landr0id 4y ago
If you accept the job pay attention to what the Hyper-V team does. They were the best kernel team that I personally worked with and were eager to do things the best way possible.
157.
by landr0id 4y ago
Super minor nitpick but ROP wasn’t used for the King Kong/SMC exploit. I would consider it a ROP exploit if multiple return-oriented gadgets were chained together to form a full exploit chain, but what happened here is the syscall ha
158.
by landr0id 4y ago
They require you to acknowledge some terms that grant you access to the Unreal Engine source code. They grant it by adding you to their GitHub org which has the engine source code as a private repo.
159.
by landr0id 4y ago
Excellent work! As I learned more about digital modes and packet radio I had similar thoughts! This is a really cool writeup and I'm stoked someone looked into this.
160.
by landr0id 4y ago
Good read, but man those gifs are distracting.
161.
by landr0id 4y ago
It's a JavaScript engine bug and JS is disabled by default. Still important, but I question whether anyone who enables JS in Tor is worth compromising.
162.
by landr0id 5y ago
When I was in university I was working on some biology homework and didn't have Excel, but I did have Numbers! I quickly became annoyed with how smart Numbers tried to be with formatting. It knew better than me what data type some cell
163.
by landr0id 5y ago
>they also have bricked retail xbox360 consoles of nefarious (teenage) actors. I was in the "xbox underground" group and later worked at Microsoft. they never bricked retails, lol.
164.
by landr0id 5y ago
This is sweet! This is actually a very similar approach to how I deobfuscate Python bytecode: https://github.com/landaire/unfuck/blob/bfa164b4e261deffeb37... My code is pretty messy, but I take the same exact
165.
by landr0id 5y ago
Fuck yes
166.
by landr0id 5y ago
I haven't heard of this tool before, but I don't think it would work for obfuscated code. Check out the graph image on my wiki [1]. While this image doesn't show the exact scenario, imagine that the first instruction is a `JU
167.
by landr0id 5y ago
Myself and other “enthusiasts” wanted to know how certain functionality was implemented in a commercial application, so I wrote this. I was taking about a month off from work for a winter break and spent 2 weeks deep diving and reverse engi
168.
by landr0id 5y ago
I am the maintainer. I explained on reddit: >Why the name? > >There were many times that I looked at a code graph and said “this is fucked”. Seemed like a good name. it's just a fun side project. not that serious
169.
by landr0id 5y ago
While its goals are a bit different from confidential computing, people saying "no" here have apparently never heard of the Xbox One. More generally, securing a device against its physical owner is notoriously difficult. Tony Chen
170.
by landr0id 6y ago
>In the case of the Switch, it's not necessary to emulate the whole device or even processor, especially if the intention is to run Switch games on a computer Switch has an ARM processor so it's definitely a requirement to emul
171.
by landr0id 6y ago
Yes. The problem though is as soon as the vulnerability used in the exploit becomes public Sony pushes out a patch.
172.
by landr0id 6y ago
Most fuzzers I think have a dictionary of special values they’ll occasionally use. I wrote a structure-aware fuzzer framework which uses random values for the initial generation, then on subsequent mutations will perform arithmetic/bit
173.
by landr0id 7y ago
HardenedBSD got the userland running fine. It was iirc mostly irrational fear by the FreeBSD team that someone's bad application would break.
174.
by landr0id 7y ago
HardenedBSD (FreeBSD fork) has had ASLR and other mitigations since forever. Shawn submitted a patch that was never merged because of mailing list politics or something of that sort + people afraid it was going to break the world. https:&#
175.
by landr0id 7y ago
Yep, they're also pretty popular with people who cheat in ESEA/FaceIT third-party ladders. One of the guys, ra1f, eventually outed himself [1]. The software-based anticheat is fairly decent, pushing people to hardware-based cheats
176.
by landr0id 7y ago
>Is Qualys getting paid for this excellent work, and if so, by who? I can't say I have any info on this subject, but having a group of people do stellar newsworthy offensive security research around widely used products is a good wa
177.
by landr0id 7y ago
Check out winocm's view of a 112-core server: https://twitter.com/winocm/status/1183533208605990913
178.
by landr0id 7y ago
Does this apply to the internal build system as well? As far as I know this issue still has not been addressed in recent Android system images for Pixel devices: https://twitter.com/landaire/status/1152739987869167
179.
by landr0id 7y ago
Pretty sure at this point they’re just focused on getting feedback on the design before actually doing work on creating the tool. See this thread: https://twitter.com/filosottile/status/1180861642546073600?s...
180.
by landr0id 7y ago
>it appears that the payload is relatively large Not knowing much about Blazor, what are you referring to here? The size of the WASM blob for your own code, or does Blazor have an associated runtime that's large? And what is conside

More ›