Zaolin

3.2K posts

Zaolin banner
Zaolin

Zaolin

@_zaolin_

Head of Solution Engineering @Binarly, IT-Consultant @ Niche Systems. Ex-CEO of @immune_gmbh. Founder of @9eSec, President of the @osfw_foundation.

Germany Katılım Kasım 2011
594 Takip Edilen741 Takipçiler
Sabitlenmiş Tweet
Zaolin
Zaolin@_zaolin_·
For eveyone wondering what's @IntelSoftware planning for the Firmware Support Package 3.0 #fsp and USF is basically going fully closed-source on the firmware side. This means Intel's #fsp decides to drop #OSF open-source firmware. It's really a shame... #fsp-3-0-or-fsp2-next-next" target="_blank" rel="nofollow noopener">universalscalablefirmware.github.io/documentation/…
English
8
25
35
0
Zaolin retweetledi
3mdeb
3mdeb@3mdeb_com·
The @QubesOS Summit 2024 has officialy started! We’d like to extend our gratitude once more to our Platinum Sponsors, @FreedomofPress Foundation and @mullvadnet for their unwavering support! Don't forget, you can still grab your virtual pass here: buff.ly/3MLiS3E
English
0
3
15
1.6K
Zaolin retweetledi
Alex Matrosov
Alex Matrosov@matrosov·
More updates will be coming tomorrow at the #LABScon stage. The problems related to the test and non-production keys are much bigger than we initially thought.
BINARLY🔬@binarly_io

🚨NEW: "PKfail Two Months Later: Reflecting on the Impact." by @pagabuc Based on pk.fail data 📈 🖥️10,095 unique firmware images uploaded 🔥791 of which contained an untrusted PK 🛟9304 is safe 💥8.5% vulnerable rate 🔬Full report: binarly.io/blog/pkfail-tw…

English
0
11
13
3.3K
Zaolin retweetledi
BINARLY🔬
BINARLY🔬@binarly_io·
🚨NEW: "PKfail Two Months Later: Reflecting on the Impact." by @pagabuc Based on pk.fail data 📈 🖥️10,095 unique firmware images uploaded 🔥791 of which contained an untrusted PK 🛟9304 is safe 💥8.5% vulnerable rate 🔬Full report: binarly.io/blog/pkfail-tw…
BINARLY🔬 tweet media
English
1
8
15
5.4K
Zaolin retweetledi
BINARLY🔬
BINARLY🔬@binarly_io·
🚀 Just one week until @LABScon_io , where @pagabuc and @matrosov unveil our latest research: “PKFAIL: Supply-Chain Failures in Secure Boot Key Management.” 🔬 This research dives into new data insights uncovered since the initial #PKFAIL disclosure, including a brand-new vulnerability affecting servers based on Supermicro hardware. 📻 Stay tuned — next week is packed with exciting announcements from our team!
BINARLY🔬 tweet mediaBINARLY🔬 tweet media
English
0
14
22
5.9K
Zaolin retweetledi
Dasharo
Dasharo@Dasharo_com·
@_zaolin_ @binarly_io Philipp will showcase the latest updates to Binarly's Risk Hunt platform and demonstrate its capabilities. 🗓️ Sep 12, 19:00 UTC 🎟️ Sign up: buff.ly/47dBUJk
English
0
2
4
125
Zaolin retweetledi
BINARLY🔬
BINARLY🔬@binarly_io·
🎉 The all-new Binarly Transparency Platform v2.5 introduces Reachability Analysis to help security teams prioritize vulnerabilities by analyzing the potential reach and impact of exploitable code paths. A game-changer in software security! binarly.io/blog/introduci…
English
1
16
25
3.7K
Zaolin retweetledi
Ryan Hurst
Ryan Hurst@rmhrisk·
Wohoo! @binarly_io has just released 2.5 of their platform with some major new capabilities like reachability analysis, custom rules , secret discovery and cryptographic asset discovery, and container support. youtu.be/4TG6X1WjWH4?si…
YouTube video
YouTube
English
0
2
10
2.8K
Zaolin retweetledi
Ryan Hurst
Ryan Hurst@rmhrisk·
Most products that detect secrets do little more than a ‘strings’ looking for certificates and high entropy data. @binarly_io actually does reachability analysis which cuts down on the noise substantially enabling you to focus on what matters.
Ryan Hurst@rmhrisk

Wohoo! @binarly_io has just released 2.5 of their platform with some major new capabilities like reachability analysis, custom rules , secret discovery and cryptographic asset discovery, and container support. youtu.be/4TG6X1WjWH4?si…

English
1
3
12
1.9K
Zaolin
Zaolin@_zaolin_·
@_markel___ Probably Intel TDX is dead as well, right?
English
1
0
3
2.2K
Mark Ermolov
Mark Ermolov@_markel___·
The last step is remaining nevertheless to fully compromise Intel SGX - knowing of FK0 Fuse Encryption Key (FK0 FEK), but we hope to do it like we did for CSME...
English
9
14
466
51.3K
Mark Ermolov
Mark Ermolov@_markel___·
Intel HW is too complex to be absolutely secure! After years of research we finally extracted Intel SGX Fuse Key0, AKA Root Provisioning Key. Together with FK1 or Root Sealing Key (also compromised), it represents Root of Trust for SGX. Here's the key from a genuine Intel CPU😀
Mark Ermolov tweet media
English
103
964
4.9K
972.2K
Zaolin retweetledi
Alex Matrosov
Alex Matrosov@matrosov·
The question is whether this key is reused (like the Intel Boot Guard story) across the Intel ecosystem or rotates per CPU generation or product line🍿 Confidential computing? 🔥
Mark Ermolov@_markel___

Intel HW is too complex to be absolutely secure! After years of research we finally extracted Intel SGX Fuse Key0, AKA Root Provisioning Key. Together with FK1 or Root Sealing Key (also compromised), it represents Root of Trust for SGX. Here's the key from a genuine Intel CPU😀

English
2
18
64
9.4K
Zaolin retweetledi
BINARLY🔬
BINARLY🔬@binarly_io·
Last week, @NIST rolled out new guidance on Post-Quantum Encryption. ⏳The clock is ticking ... “Technology managers can inventory their systems for applications that use encryption, which must be replaced before cryptographically relevant quantum computers appear."
BINARLY🔬 tweet media
English
1
5
14
1.9K
Nikolaj Schlej
Nikolaj Schlej@NikolajSchlej·
Returned to Cupertino and restarted my FWSEC job today. Was a productive leave and I was able to resolve most of the issues that pushed me into it, but selling everything and moving over the Atlantic just to move back in 4 month is no fun, will try not to repeat this ever again.
English
1
1
23
3K

Keşfet

@xorpse @binarly_io @QubesOS @FreedomofPress @mullvadnet @pagabuc @LABScon_io @matrosov