Mikhail Gorobets

Total Meltdown? How the Windows 7 Meltdown January patch made things way worse. (Patched in March updates) blog.frizk.net/2018/03/total-…

Our #BHUSA slides: Breaking OS Defenses w/ Firmware Attacks -recovering creds protected by Win10 Credential Guard: blackhat.com/docs/us-17/wed…

@jessemichael on Infineon industry path.. "not zero day, it's a 2,441day" ics-cert.us-cert.gov/advisories/ICS… #defcon2017

Our slides "Intel AMT. Stealth breakthrough" published! twitter.com/_embedi_/statu…

Over-the-air code exec in Nissan/BMW/Infinity/Ford telematics by @HackingThings @jessemichael @ABazhaniuk #Shkatov" target="_blank" rel="nofollow noopener">defcon.org/html/defcon-25…

Patching hypervisor on ARM based phone to give user app R/W permissions to kernel memory #BHUSA with @ABazhaniuk #blue-pill-for-your-phone" target="_blank" rel="nofollow noopener">blackhat.com/us-17/briefing…

~14000 update images checked: ~247 models of Gigabyte, ~98 models of MSI do not protect EFI and don't have signed firmware updates #BHUSA

This slide is a bummer. Defense is hard

Our @reconmtl slides on vulnerabilities we found in Coreboot with @ABazhaniuk recon.cx/2017/montreal/… [pdf]

@mythicalcmd @a_furtak @c7zero @ABazhaniuk bypassing VBS protection is local, pass-the-hash attack is remote

@D0nQuij0te @blueteamer @a_furtak @c7zero @ABazhaniuk In many cases the latest hardware with latest firmware has at least one vulnerability. This can be tested with github.com/chipsec/chipsec

@blueteamer @a_furtak @c7zero @ABazhaniuk Patchable in firmware. No software patch will be available. Only our presentation at #blackhat in a week: #fractured-backbone-breaking-modern-os-defenses-with-firmware-attacks" target="_blank" rel="nofollow noopener">blackhat.com/us-17/briefing…

Extracting master key and decrypting passwords and NTLM credentials on Win10 VSM. By @a_furtak @mikhailgorobets @c7zero @ABazhaniuk

Remotely Exploitable Type Confusion in Windows 8, 10, Windows Server and more found by @natashenka and me bugs.chromium.org/p/project-zero…

We've created a list of ~2M known EFI executables extracted from ~14000 unique UEFI firmware updates from 9 vendors github.com/advanced-threa…

The @shadowbrokerss key to eqgrp-auction-file.tar.xz.gpg is legit.

Interesting, looks like they had this for years before we independently discovered and fixed it. #bugcollision seclists.org/fulldisclosure… twitter.com/buherator/stat…

Today's #ShadowBrokers NSA dump shows hacking attacks on EU states, LatAm, Russia, China, Japan & South East Asia github.com/x0rz/EQGRP/tre…

The tendency to yell at the bug discoverer versus at the delivery of buggy software is one of the most puzzling things about IT security.

WikiLeaks #Vault7 shows CIA has been infecting supply chains for at least 8 years #efmAnvAqf" target="_blank" rel="nofollow noopener">wikileaks.org/vault7/darkmat… More: #results" target="_blank" rel="nofollow noopener">search.wikileaks.org/?query=%22supp…