The `left-pad` incident was 10 years ago today.
https://en.wikipedia.org/wiki/Npm_left-pad_incident
Thankfully, we've completely solved software supply chains in the years since.
Remote
Zhuowei Zhang
@zhuowei@notnow.dev
pleroma 2.10.2Mostly bad puns. It's pronounced "joe-way". Happy to explain jokes.
he/him, opinions are my own. https://zhuoweizhang.net
he/him, opinions are my own. https://zhuoweizhang.net
2737 Followers
0 Following
50 Posts
Joined January 17, 2021
Figma runs a local server with a valid *signed* SSL certificate for https://figmadaemon.com:44960 (resolves to 127.0.0.1) ?!
https://gist.github.com/Willamin/dedc1de2d1d5d4e8db4e49b25007a34c
I thought this was not allowed?
(https://groups.google.com/g/mozilla.dev.security.policy/c/eV89JXcsBC0/m/wsj5zpbbAQAJ?pli=1)
What certificate authority allowed this?!
> Comodo
Ah
https://gist.github.com/Willamin/dedc1de2d1d5d4e8db4e49b25007a34c
I thought this was not allowed?
(https://groups.google.com/g/mozilla.dev.security.policy/c/eV89JXcsBC0/m/wsj5zpbbAQAJ?pli=1)
What certificate authority allowed this?!
> Comodo
Ah
At long last, we have stolen the macOS from classic kernel extension Dont Steal Mac OS.kext
Want to tell a salesperson and an engineer apart?
Ask them to pronounce "codesign"
Ask them to pronounce "codesign"
James Bond's "License to Kill" approved by Debian as a Free Software license
A Windows @0xabad1dea@infosec.exchange in transactional NTFS?
usb stick says trans writes
Kaspersky researchers just found and presented a Snapdragon 410/210/617 bootrom exploit - CVE-2026-25262 in this month’s Qualcomm security bulletin.
It’s well known that every forensics tool supported exploiting those SoCs from the bootrom, but for 9 years, nobody knew how they were doing it.
This is some amazing research that finally solves the mystery..
I’m sure the BananaHackers community of Snapdragon 210 flip phone modders will find a use for this.
MacBook Neo · Geo
MAX 8192 MEGA
PRO–GEAR SPEC
MAX 8192 MEGA
PRO–GEAR SPEC
Just bought $1.4 trillion of GPUs from OpenAI after they shut down Sora.
I can finally run Crysis on Medium settings.
I can finally run Crysis on Medium settings.
Rapid7 got a stack smash on... a Brother laser printer
https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed/
https://www.rapid7.com/cdn/assets/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf
https://bsky.app/profile/stephenfewer.bsky.social/post/3lsg7ubf3ek2h
https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed/
https://www.rapid7.com/cdn/assets/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf
https://bsky.app/profile/stephenfewer.bsky.social/post/3lsg7ubf3ek2h
If our universe is a computer simulation, then all those "Can it run Doom?" demos actually all ran on the same computer
Still reading through gracecondition’s DirtySlide writeup (https://gracecondition.github.io/posts/dirtyslide/).
The writeup says it’s only usable in a macOS virtual machine - not a physical macOS/iOS device. Has anyone looked further into this?
The writeup gives two reasons:
Triggering 536 in the vulnerable context needs an application sandbox bypass.
iOS does support residing shared caches:
- https://projectzero.google/2021/01/a-look-at-imessage-in-ios-14.html#:~:text=for%203rd%20party%20apps%20this%20means says that if an app crashes inside the shared region, launchd will re-launch the process next time with
_POSIX_SPAWN_RESLIDE.
And the shared_region_map_and_slide_2_np syscall exists
iOS should allow the syscall, at any rate:
https://github.com/Lessica/iOS-Sandbox-Profiles/blob/9bf1164cee918fcbf09bb918ef277d2dccfe8078/profiles/23C55__iPhone12%2C1/builtin_collection/container/container.sb#L9789
(unless you’re in lockdown mode in WebKit?)
https://github.com/WebKit/WebKit/blob/30dcf5d1c9402dea5a26158e103f7e4333a7eac2/Source/WebKit/WebProcess/com.apple.WebProcess.sb.in#L1241
It also needs an SPTM (Secure Page Table Monitor) bypass
Do you have to spray page tables or can you spray something else that also lands in the physmap?
I mean, I doubt anyone will actually look into this, since a kernel r/w isn’t enough for a jailbreak. It can only do kfd-style mods, and we already have those on iOS 26.0 via Darksword.
Had a go at making koiTerminal build in Android Studio, since I want to play with Android Virtualization Framework but don't want to build AOSP.
It-It's not like I like you or '1'='1'
Sunday is the 10-year anniversary of the npm left-pad incident.
Premultiplied Alpha Male
When did Ghidra start supporting reading DWARF debug data for macOS kernels?
I got a surprise when Ghidra started showing decompiles with variable names.
I got a surprise when Ghidra started showing decompiles with variable names.
Broadcom acquires the virtualization platform simulating our universe
The "S" in "Vibe coding" stands for "Security"
32 GB of RAM?
We're going to need a miracle.
██ENG███
█OOMSDAY
Replying to
@Aissen@social.treehouse.systems I enabled DoH in Firefox and tried https://figmadaemon.com:44960 ; it seems to open still.
Replying to
@AlesandroOrtiz@infosec.exchange Yes. (Every time I run netstat -a -n on my computer, I see this port, and every time I go on the internet and search for it.)
I'm still amused that the Linux distro for Gamers is a Fedora remix.
You'd expect, like, Gentoo, or at least Arch like SteamOS - but no, Bazzite is a Fedora Atomic distro.
You'd expect, like, Gentoo, or at least Arch like SteamOS - but no, Bazzite is a Fedora Atomic distro.
Replying to
@siguza@infosec.space Starting an app from Xcode lets you break on entry, before dyld runs. However, I don't know if starting an app from Xcode goes through launchd and the reslide path.
Replying to
I’m guessing the vm_shared_region_slide_page_v5 change is one of the kernel memory corruption CVEs (CVE-2026-39868 or CVE-2026-43724, can’t tell)
I don’t see how the vm_map_msync issues can cause kernel memory corruption, so it’s probably not the cvevm_shared_region_map_file: an LLM thinks it might lead to read out of bounds and a denial-of-service, but no memory corruption (https://gist.github.com/zhuowei/5a78638228263e02697e43d24c8f63b7) I don’t have enough experience to tell if that’s truevm_shared_region_slide_page_v5: seems like you could get some memory corruption - if you manage to map a shared region with a page_starts that points past a page, and have your corruption target on the very next page of physical memory. Can you do that?
There is no electro-motive division
Replying to
Tried diffing 15.7.5 without DWARF on Ghidra 12.0.4: BinDiff gave me "Error: AttachFlowGraph: couldn't find call graph node for flow graph 00000000".
Will go back to an older Ghidra version and try again.
(... how do you all patch diff stuff?! Do you go through this every time?)
Replying to
@tihmstar@infosec.exchange You're not reading the right press releases: https://www.google.com/search?q=site%3Anvidia.com+codesign
Mastodon-Bluesky crossposter (pair-o'-social relationship)
Replying to
At any rate, the LLM’s suggestion msgctl(IPC_SET) + msgctl(IPC_RMID) only seems to be callable as root.
This piece of code I'm researching is well-written enough and small enough that, after an hour of fuzzing, it reached full coverage with only a few harmless 1-byte over-reads detected.
So I guess all those commenters are right after all: you can write secure C code.
So I guess all those commenters are right after all: you can write secure C code.
Replying to
In the end I couldn't get this to work on Ghidra 12.0.4 since it gave me a "Storage does not have a stack varnode" error: https://github.com/NationalSecurityAgency/ghidra/issues/9131
Will try with an older Ghidra.
Replying to
@65GHz@toots.nu curses, I missed the "A file descriptor of -1 is used to indicate that the data to be put in the shared region for this mapping comes directly from the processes address space." branch in shared_region_map_and_slide_setup.
Make the neighbour a page table Could you put something else there?
Replying to
Ah. Ghidra docs: "NOTE: ExtensionPoint logistics have changed! It is no longer sufficient to implement ExtensionPoint in order for the ClassSearcher to dynamically pick up your class."
https://ghidra.re/ghidra_docs/api/ghidra/util/classfinder/ExtensionPoint.html
BinExport now provides a Ghidra script instead to start the export process instead.
Replying to
OK, I’m not smart enough to figure out if the msgctl(IPC_SET) is exploitable: an LLM outputs one plausible-sounding vector (https://gist.github.com/zhuowei/390b9e171641561f88ceb2119d984bc1) but I am not knowledgable to say whether it’s doable or if it matches CVE-2026-28986.
Replying to
(I did shove xnu's NFS server and NFS client kext into an LLM, and it didn't find any bugs. So the actual bug might not be in NFS - maybe they're just using NFS as part of the exploit?)
Replying to
Same "Storage does not have a stack varnode" error on Ghidra 11.4.2.
Per the comments in that issue, I'm going to try importing the kernels without DWARF and see if that fixes it.
Replying to
Replying to
More macOS 15.7.7 diffs:
msgget, instead of doing
/* Make sure that the returned msqid is unique */
msqptr->u.msg_perm._seq++;
(seq is a short)
Now does something fancier: (decompiled:)
int uVar1 = msqptr->u.msg_perm._seq;
msqptr->u.msg_perm._seq = uVar1 & ((short)uVar1 >> 0xf ^ 0xffffU);
https://github.com/apple-oss-distributions/xnu/blob/5c306bec31e314fa4d8bbdafb2f6f5a6b7e7b291/bsd/kern/sysv_msg.c#L670
Huh, macOS 15.7.7 removes MACH_VOUCHER_ATTR_KEY_TEST from the kernel. https://github.com/apple-oss-distributions/xnu/blob/5c306bec31e314fa4d8bbdafb2f6f5a6b7e7b291/osfmk/ipc/ipc_voucher.c#L2761 According to the comments, iOS already removed the whole voucher subsystem, anyways, so it’s not interesting - but I wonder why they had something named _TEST compiled into a production kernel…
Replying to
I don't think the vm_shared_region_slide_page_v5 is exploitable in practice since he kernel checks dyld caches must be owned by root and on a SIP-protected volume. So I don't think you can even reach this code?)