Boris Larin
@oct0xor
Followers
17,639
Following
581
Media
63
Statuses
690
Former console hacker (PS3/PS4). Hunting in the wild 0-days at Kaspersky GReAT. All tweets are my own.
Joined August 2011
Don't wanna be here?
Send us removal request.
Explore trending content on Musk Viewer
Nigéria
• 204655 Tweets
DAOUOFFROAD COL EP6
• 200757 Tweets
Jasper
• 123940 Tweets
Newsweek
• 119899 Tweets
Ricardo
• 76121 Tweets
Nodal
• 64162 Tweets
Marta
• 41751 Tweets
Lorena
• 41077 Tweets
LONE LION MUNAWAR
• 39151 Tweets
#انا_مش_روبوت_انا_سعودي
• 36460 Tweets
Guayaquil
• 31843 Tweets
スペイン
• 29366 Tweets
Fields
• 29054 Tweets
Espanha
• 27241 Tweets
Southwest
• 20202 Tweets
DECADE OF KICK MADNESS
• 17536 Tweets
#なでしこジャパン
• 17367 Tweets
アプリDL
• 15577 Tweets
$BUB
• 10026 Tweets
Pinned Tweet
Kept you waiting, huh? Its the 20th anniversary of Metal Gear Solid 2: Substance, and as promised, here's a mod that lets you play it with the 3rd person camera from Metal Gear Solid 3: Subsistence!
47
335
1K
Jailbreak and kernel debugging is coming to new iPhones! (Apple A12-A16 SoC’s < iOS 16.6)
133
370
2K
We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it.
27
270
986
All the details about this vuln and much more will be revealed tomorrow by us (me,
@bzvr_
,
@kucher1n
) during our talk “Operation Triangulation: What You Get When Attack iPhones of Researchers” at
#37c3
(14:45 CET). There will also be a live stream.
Jailbreak and kernel debugging is coming to new iPhones! (Apple A12-A16 SoC’s < iOS 16.6)
133
370
2K
55
180
905
Metal Gear Solid 2 - The Substance Of Subsistence (S.O.S.) (Unofficial Project) Release Date Trailer
54
253
757
This mod lets you play Metal Gear Solid 2: Substance with the 3rd person camera from Metal Gear Solid 3: Subsistence. cc
@HIDEO_KOJIMA_EN
19
182
746
To celebrate the 20th anniversary of Metal Gear Solid 2, I did what this game always deserved. Soon you will be able to play the game like never before and see it from a whole new angle!
22
155
670
Here is a list of actively used 0-days reported by Kaspersky over the past 10 years. A couple of them were found on VirusTotal, the rest were caught in attacks on us and our B2C/B2B customers. I'm very proud of the work we do.
12
86
606
Thanks to marcan () and
@zhuowei
() now we know the original purpose for this unknown hardware feature. Its MMIO debug registers for GPU L2 cache. I am really excited that we are very close to solving this mystery!
We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it.
27
270
986
8
102
501
We found a new zero-day (CVE-2023-28252) in Microsoft Windows used in Nokoyawa ransomware attacks
5
184
408
We analyzed the vulnerability CVE-2019-0708 and can confirm that it is exploitable.
We have therefore developed detection strategies for attempts to exploit it and would now like to share those with trusted industry parties.
Please contact: nomoreworm
@kaspersky
.com
3
155
307
A little earlier, I found Windows CLFS 0-day used in ransomware attacks. But at that time, I've been tracking this actor for a year and they used 5(!) different CLFS exploits. Is there something seriously wrong with Windows CLFS? I decided to investigate.
4
126
292
Today Apple released updates for CVE-2023-32434 (Kernel) and CVE-2023-32435 (WebKit) in-the-wild zero-days which were discovered by us (
@kucher1n
,
@bzvr_
and yours truly) in the
#iOSTriangulation
attacks. Update your iOS/iPadOS/macOS/watchOS now!
7
129
269
Chrome and Windows zero-day exploit chain used in the wild by PuzzleMaker APT
0
132
242
We discovered a new zero-day in Microsoft Windows used in attacks with QakBot and other malware. It was just fixed as CVE-2024-30051, and this time it all started with a curious find on VirusTotal…
@r00tten
4
93
234
The story of the
#iOSTriangulation
in-the-wild 0-days continues! CVE-2023-38606 is another kernel vulnerability that was used in the 0-click exploit chain. Discovered by Valentin Pashkov, Mikhail Vinogradov,
@kucher1n
,
@bzvr_
, and yours truly. Update all your Apple devices!
5
70
202
We (
@vaber_b
and I) have discovered a Google Chrome zero-day that is actively used in targeted attacks. It was just fixed as CVE-2024-4947 and we're going to reveal more details soon 🔥🔥🔥. Update now!
5
46
192
I found more vulnerabilities while looking for CVE-2020-0986. Learn about splwow64 exploitation and exploit mitigations in new blog post
2
94
191
We've posted an update on what's currently known and unknown about this obscure debugging feature.
We're revealing details of an obscure debugging feature in the Apple A12-A16 SoC’s that bypasses all of the hard-to-hack hardware-based memory protections on new iPhones. Its not used by the firmware and we don't know how the attackers found out about it.
27
270
986
7
29
180
I find writing instruction decoders to be very relaxing 😅. Here is a plugin that helps IDA Pro to disassemble PlayStation 2 COP2 MIPS instructions
3
31
165
4
80
147
We found one more win32k 0day used in the wild. This time it combines user mode and kernel mode issues.
0
51
146
My first YouTube video! Exploit root cause analysis for beginners
3
38
139
Tomorrow I will be hosting a workshop on exploit analysis for beginners.
I will demonstrate how to setup debugging, how to use WinDBG (+how to solve common problems), and we will analyse the latest Windows 0day CVE-2021-28310.
(13/05 - 2:00 PM GMT)
2
39
133
Thanks
@_saagarjha
🤣. This is a work of fiction. Any resemblance to real-world people, events, or places is a coincidence and not intentional.
I have nothing technical to add so I made a meme instead (1/2)
14
117
562
2
8
129
The code to have a normal 3rd person camera was never present in the game, and in order to implement it, I had to reverse engineer and rewrite many things in the game engine.
2
4
125
We were the first to discover and report CVE-2023-28252, but despite all the communication we had about this bug, Microsoft forgot to acknowledge us at release. As a result, all the media do not mention our contribution.
10
14
111
This video also includes a dev diary where I talk about how I managed to accomplish this project and the challenges I ran into.
4
8
97
It’s so cool to watch all the streams of other people playing it (and playing it much better than me!)
As he promised, Boris Larin's 3rd Person Camera mod for Metal Gear Solid 2: Substance on PC is now available! This is an incredible achievement...
...which is why I'm going to stream it, right now!
1
32
134
5
7
80
I've wanted to participate in GeekPwn ever since Chaitin demoed a PS4 hack… Now GeekPwn has become GeekCon, and I'm honored to be invited there to speak one more time about Operation Triangulation. It’s in Singapore, I have an extra ticket, ping me.
6
6
78
We managed to find this 0-day twice! First as a description of a vulnerability, then as a real exploit used by attackers.
3
17
81
Going to Japan for a month was the best vacation ever. Can’t feel my legs after walking 17–30k steps every day.
6
2
73
Konami, if it is not possible to renew the licenses, and you need any technical assistance, I will be happy to help remove/replace the problematic content. I will even do it for free so more people can enjoy the game (with my mod).
2
2
61
This year I've spent most of my day offs working on a huge code-based modification of a cult classic video game. To achieve my goals I've had to reverse engineer and re-write from scratch many parts of game's engine. Full announcement is coming soon!
6
3
62
We accidentally stayed near PlayStation themed building in Leipzig
5
4
57
Did you enjoy "Overview of the latest Windows OS kernel exploits found in the wild" ? It was about 0days that we found in 2018. Tomorrow at
@BlueHatIL
I present Part 2 about stuff that we found in 2019.
#BlueHatIL
1
8
55
I will also release an .idc file for my IDA Pro database, so others can use/continue my reverse engineering work to make other mods or complete full decompilcation of the game
2
1
50
Sony and partners did exceptional work there: fully compromised firmware doesn't lead to fully compromised security, so I can actually talk about it
1
5
50
Why do places like Kiwi Farms even exist? It should be illegal to organise and participate in communities for internet bullying
1
12
51
Highlight2 - IDA Pro plugin that changes color of call instructions and works with all architectures
1
17
50
The US should really ban sales of CrowdStrike after this 😂
BREAKING: The US Aviation Authority has required all flights to land due to a technical computer glitch.
80
709
2K
3
11
62
The project will be 100% open source and will come with its own mod loader - other developers may take advantage of it for their own mods
2
1
48
Woot! 100,000 views in two weeks! Thanks to everyone who watched, liked, subscribed, commented and helped to spread the word about my hobby project!
Metal Gear Solid 2 - The Substance Of Subsistence (S.O.S.) (Unofficial Project) Release Date Trailer
54
253
757
2
7
45
We are sharing samples of the iOS cyber espionage APT platform (main implant and additional modules) used in
#OperationTriangulation
#SharingIsCaring
Ever wanted to take another look at
#OperationTriangulation
malware? Then check out VirusTotal - we have uploaded malicious modules used in this campaign.
5
77
185
0
14
45
Its ridiculous how much code I had to reverse engineer/write/patch to complete this project. Making changes to the code of a game is a very difficult task - you touch one thing and it breaks a million others
1
1
43
The Substance Of Subsistence (S.O.S.) is the name of the MGS2:Substance (PC) mod that adds a 3rd person camera (and game controls) from MGS3:Subsistence
2
3
42
@theflow0
@hardwear_io
Epic exploit chain, Andy! I think its the coolest one I have seen so far for PS4 (and for PS5 ofc)
1
1
43
I am going to release my GCL scripts decompiler, large part of the game (30% ?) (mainly stage logics) written in this language
1
0
39
It's nice to receive unexpected compliments in the morning! Don't forget to say nice words to the people who helped you and those who are close to you!
2
3
36
Very excited to present my talk "Hacking Microcontroller Firmware through a USB" at
@TheSAScon
! See you in Singapore!
#TheSAS2019
1
7
35
This project was very difficult to complete, I previously posted a dev diary where I talked about some of the issues I encountered (since this video I had to fix many more issues)
1
0
31
I think the whole project took me about 2 months at full time (I worked on it during the holidays in December/May + weekends/free time during the summer)
1
0
30
Right now it really feels like making a full decompilation of the game is quite an achievable task (but I dont have plans to do this)
1
0
29
.
@dwizzzleMSFT
just announced CFG 2.0 and new hardware security improvements at
#bluehat
#bluehatshanghai
0
7
28
I also have to add that unfortunately it's not possible to buy a digital version of the game right now because Konami has some licensing issues...
2
1
26
After a 4 year break,
@TheSAScon
has returned! This year’s event, like all previous ones, will definitely be remembered for years! That's what you get when organizers put their hearts and months of work into putting on the best security conference possible.
Prepare for SAS 2024!
3
4
25
Come to GReAT Ideas powered by
@TheSAScon
webinar tomorrow to learn about reverse engineering tools and techniques
2
12
24
And now that this project is finally released, I'm getting back to spending more time on my vulnerability research projects.
1
0
24
Very excited to talk about latest zero-days that we found together with
@antonivanovm
at first ever BlueHat Shanghai next week! Lineup of talks looks incredible
#bluehat
#bluehatshanghai
0
3
20
Me and
@antonivanovm
will present our new research "Momigari: Overview of the latest Windows OS kernel exploits found in the wild" with all juicy details about CVE-2018-8453, CVE-2018-8589, CVE-2018-8611.
#CanSecWest
1
5
19
@Jhonny82_
You are 100% right about piracy, but wrong about usefulness. I will leave it for attendees to decide, but I believe that my research will help to build more secure systems and will teach other researchers to hack less secure systems.
2
1
18
The lesson is: MSRC doesn't really care about giving proper credit, always double check with them if you want to be recognized.
0
1
18
I’ve stayed in a hundred hotel rooms, but this is the first one that actually gives me Stephen King’s “haunted hotel” vibes lol. I guess it’s a good time to re-read something from the master.
1
1
18
It was a mistake to leave all my vacation money in a backpack in my room at the
@RitzCarlton
Sanya 😣 But thank you, Mr/Ms Robber, for only taking 50% of it
4
0
19
MoonBounce - the most advanced UEFI firmware implant discovered in the wild to date. Great work from my colleagues
@vaber_b
,
@_marklech_
,
@legezo
0
3
19
It seems that nobody is able to implement ECC properly
This
#PatchTuesday
you are strongly encouraged to implement the recently released CVE-2020-0601 patch immediately.
138
2K
2K
1
3
19
