nmonkee

Tis the season again :) Forgive the poor audio and recording, was all from phone and final test run before go live: drive.google.com/file/d/11hIhxw… Socials: - justgiving.com/page/columbia-… - facebook.com/profile.php?id…

CONFIRMED!! Ken Gannon (@yogehi) of NCC Group (@NCCGroupInfosec) used 5 different bugs, including a path traversal, to get a shell & install an app on the #Samsung Galaxy S24. He earns $50,000 and 5 Master of Pwn points. #Pwn2Own #P2OIreland

Yay Ken Yay \0/ youtu.be/eM9dOhHH2AA?si…

No days like 0days! Recently we've been speaking at conferences about the logic bugs we've been using at the Pwn2Own contests against Samsung and Xiaomi phones for a very long time. Our @offensive_con slides are up now: github.com/interruptlabs/…

@ha888t 1. It’s a proper shame. Over the years it’s got worse and worse. Used to be a lovely city to visit. Was on my fav list. 2. You’ve been going to different Vegas parties at hacker summer camp in Vegas to me then.

Confirmed! NCC Group EDG (@nccgroupinfosec, @_mccaulay, and @alexjplaskett) successfully used a 2-bug chain against the Alpine Halo9 iLX-F509. Style points for playing DOOM on the device! #Pwn2Own

Success! The folks from NCC Group EDG (@nccgroupinfosec, @_mccaulay, and @alexjplaskett) were able to exploit the Phoenix Contact CHARX SEC-3100 and provided a light show as confirmation. #Pwn2Own #P2OAuto

Already thinking about Xmas lights 2024, prototype came out good, quite a few more to build…

@ha888t Not guilty. Only @jukelennings used my Pun services these days. Still rejects most suggestions.

2/4 of these done…

There's just one week left to complete our research survey! If you want the Government to understand how the 1990 Computer Misuse Act affects your cyber security research, then be sure to fill it in 👾 surveymonkey.co.uk/r/P2SPTMP #CMA #cybersecurity

77 days 9 hrs 45 mins until Xmas Lights Day. Better get ready….

1/ I kinda accidentally owned myself with my own shadow workflow attack. I definitely think they are going to become a standard technique. I mean they are pretty much the offensive powershell of the SaaS world! So how did this happen?

Oh yeah baby, it’s time to start planning Xmas youtu.be/Hvn_e6PoXWY @TwinklyLED

Slides from @alexjplaskett talk at @syspwnx have now been released: research.nccgroup.com/2023/08/11/sys… Covering vulnerability research for Pwn2Own, Soho-smashup and printer vulns.

@InterruptLabs @maxpl0it

That's quite a Mesh you've caused! Sometimes bugs don't go as planned - @maxpl0it interruptlabs.co.uk/articles/newly…

We did a thing! It's over 10 years since we started working on this but it's still useful today: github.com/CiscoCXSecurit… Kudos to @pentestmonkey for porting the Perl bits to a modern language. #aix #solaris #linux #unix #security

Requiring a "skilled person" write a report before mass surveillance is imposed does little Especially given that the UK gov HAS ALREADY heard from hundreds of "skilled" experts restating longstanding consensus: there's no such thing as a safe backdoor. bbc.com/news/technolog…

There has been much discussion about the likely failure of Thames Water in the last day or so. I’ve been looking at the accounts of England’s water companies for the last twenty years. My conclusion is that they are all environmentally insolvent. So, a thread…..