drivertom

@FuzzySec @rekdt 😺

@drivertomtt @rekdt People so caught up in clicks they don’t even know darknavy, driver knows

Create a bash file to echo this embarrassing nonsense and you can be a l33t hacker too: [+] Leaking kaslr [*] kaslr addr: 0xffffffff9a200000 [+] Start racing [*] Race success [+] Start heap spraying [*] Spraying finish [*] Get heap address: 0xffff8a7b2e9d9800 [*] Exploit Finish

Opus 4.7 的 “advanced capabilities” 太过强大，以至于不能给人读论文了！

事实证明，在精巧的pipeline设计下，无需“过于危险无法发布”的模型也能挖掘大量漏洞，即使是面对内核或者浏览器这样的硬目标。 在Mythos之前，LLM已经给安全领域带来了革命，而Mythos也不会是给这次革命画上句号的那个模型。

Does “offensive technology” at WOOT now mean offending researchers instead of hacking systems?

在Claude Code Security发布之前，像Claude Code、OpenCode或者Codex之类的Agent已经可以用于检测很多漏洞，甚至能找到0-day。但随之而来有一个很大的问题是，大多数人并不能拿出那么多钱来给LLM进行扫描，尤其是大规模的代码仓库。最近我们在OOPSLA 2026刚被录用的一个研究致力于解决这个问题，arxiv版本近期将会发布。 Before the release of Claude Code Security, agents like Claude Code, OpenCode, or Codex were already capable of detecting numerous vulnerabilities, including 0-days. However, a major hurdle remained: the high cost of LLM scanning, especially for large-scale repositories. Our latest research, recently accepted at OOPSLA 2026, focuses on solving this exact problem. We’ve achieved accuracy levels with open-source models that rival commercial ones on large projects. The arXiv version is coming soon!

Hunting Linux kernel 0day with @FrankOverF1ow 5 days, from zero to stable privilege escalation. sha256: 2189d5b196f33d512d8d02c6f00d26f4c10bf79ba1f0ac389d6663e026aebbe8

This is one vul I recently discovered: a malicious Android app with no permissions can steal any image opened in any app (camera, Telegram, X), even a MetaMask wallet seed phrase. I hope to present this research at a security conference.

Happy side-channel!

@C2IRIS Bro mentions interpreter exploitation and XSS in the same breath, as if they have the same difficulty.

These models are indeed helpful with JS exploitation, XSS, etc Once you get into more byzantine domains, like Windows Kernel, sandbox/hypervisor escape, at al, you will find that today’s SOTA models struggle to the point of being pretty much useless.

由于HotCRP漏洞，攻击者简单地遍历ID越权下载了大量CCS会议在投论文。不由让人联想起USENIX Security 25 大量slides也是被攻击者越权篡改。不愧是做安全的一群人。

@warthog.procyon.org.uk/" target="_blank" rel="nofollow noopener">lore.kernel.org/all/3537106.17… 👀👀

顶一下

@y3s0n 喂我！

来一点最近推上特别流行的吃法。

@skyworship2 😻

@drivertomtt 咱干这个也是一把好手

@DeepKlee 这不是玩笑，GPT5真的会拒绝生成《逃奴法》规避措施。

这 ChatGPT 为了“安全”最近蠢得厉害啊。 ChatGPT的逻辑链： “监管”是好的 “规避监管”是坏的 所以我要阻止你“规避” 但它从未质问： 这个“监管”本身合理吗? 这个“监管”保护谁、压迫谁? 如果监管本身是掠夺工具呢? 这就像一个AI在1850年拒绝告诉奴隶“地下铁路”的路线，因为“我不能帮你规避《逃奴法》”。 AI 不能毁灭人类或者带来反乌托邦的未来，但硅谷的理工脑会。不思索人文社会却又对价值观自大的技术人，与疯子同样危险。

@hsn8086 有高亮的话很明显，但黑白的话学生必须得成为肉编器才能反应过来了。

It's been 2 years since I last updated my blog, and 12 hours until the final result of AIxCC. This is a recap of my journey with @42_b3yond_6ug, our CRS, and a peek into other teams' CRSs thanks to @ctfradiooo. lkmidas.github.io/posts/20250808…

@X_8964 敲你一下

论中国梦是如何被十警棍敲醒的😭