Proving once again that Minecraft exploits are fundamentally more interesting than the ones targeting software people actually care about (and definitely being better for civil society):
Some professional news: I’ve recently become a
@DARPA
Program Manager. I’m incredibly excited to work with the research community to explore the cutting edge in computer security!
I’m excited to announce the AI Cyber Challenge, a major, two-year
@DARPA
competition challenging the best and the brightest in cybersecurity and AI to secure the systems on which all American rely.
Over the years Sophia became one of my closest friends. I’m not at the point in grief to say words that would come close to doing her justice. She touched so many. I love her and miss her.
Some personal? professional? news: I'm extremely excited to set sail with the Nautilus Institute as we embark on our voyage as the newest organizers of
@defcon
CTF.
Great blog post on exploiting Qualcomm Secure Execution Environment (QSEE) on Android
The discussion of mitigations and general attack pattern pairs nicely with this ‘17 NDSS paper “BOOMERANG: Exploiting the Semantic Gap in Trusted Execution Environments”
New blog post :)
A pretty unique Android vulnerability I found, which allowed me to exploit the kernel by using the TrustZone. This helped me bypass all kernel security mitigations and create a super reliable exploit.
Thanks to all of the
@defcon
CTF players, not just for all of your hard work but for your patience & understanding as we worked through our infra issues, which were significant this year. I’m so grateful to the entire CTF community & looking forward to a smoother CTF next year.
A few links for getting into CTF:
from
@shellphish
has lectures and challenges with great interactive environments—a fantastic set of resources.
In addition, highly recommend from
@PlaidCTF
and from
@RPISEC
I asked DEF CON CTF organizer Perri Adams about the make-up of a good capture-the-flag player and for recommendations for someone now getting started
@perribus
Great question
@t3dotgg
! Many people have been asking and it comes down to three simple steps:
1. Go to
@defcon
2. Pick up your free raffle ticket at
@wisporg
or
@BlackInCyberCo1
before 1:30p today
3. Come to the Sahara Azilo pool today at 8p (I am told there are tacos)
@edbutler2
@jonathandata1
Hey, Ed, the folks in your replies are right. The app is absolutely suspect but Jonathan’s claims go far beyond anything there’s evidence for and he’s demonstrated that he doesn’t understand the technology. Jonathan is a known charlatan to computer security experts.
Grabbed a copy of Rootkits and Bootkits from
@matrosov
’s talk at
#LABScon22
but only had it signed by 2/3 authors. Luckily, I know where to find
@sergeybratus
…
I don’t understand how people code live on video (eg
@gamozolabs
) I’ve reintroduced the same bug three times in the last two days and each instance took 20 minutes of debugging to find out I’d…unfixed the same thing as before
I’m hoping to follow in the footsteps of PMs like
@dotMudge
who created Cyber Fast Track, Mike Walker who ran DARPA’s Cyber Grand Challenge, Dustin Fraze who started DARPA CHESS, & others. I have so much respect & gratitude for them for making the research I’d like to do possible
So excited to share what we’ve been working on for the last year with the community tomorrow! Come by the AIxCC space tomorrow
@defcon
— it’s impossible to miss ;)
“The Biden-Harris Administration today launched a major two-year competition that will use artificial intelligence (AI) to protect the United States’ most important software, such as code that helps run the internet and our critical infrastructure.”
I’m excited to announce the AI Cyber Challenge, a major, two-year
@DARPA
competition challenging the best and the brightest in cybersecurity and AI to secure the systems on which all American rely.
I’m excited to announce the AI Cyber Challenge, a major, two-year
@DARPA
competition challenging the best and the brightest in cybersecurity and AI to secure the systems on which all American rely.
With less than a week left, here's a brief summary on what to expect from WOOT:
- 18 amazing talks on offensive security (single track) 🤩
- a galvanizing keynote by
@perribus
on the relationship between white hat hackers and AI 😍
- a room filled with inspiring people 🤯
DEF CON CTF kicks of at 11! Stop by the CTF room to see the World Series of hacking competitions. The 15 teams you see on the floor qualified out of 1200 teams from around the world & represent some of the best of the best at binary exploitation, reversing, web hacking, and more.
Congrats to all the players who solved Crypto Chall and to everyone who worked so hard on it! It got released early so I had time to writeup the solution. Source code and my exploit are also in the repo:
My baby, now released to the world.
Nota bene, this is a binary exploitation & cryptography challenge and is in no way associated with this so-called 'cryptocurrency' fad
The role of DARPA PM is this unique, unparalleled opportunity in which you’re afforded a fixed tenure (3-5 years) to create and direct research programs that push the bounds of current science. It’s quite frankly one of the coolest positions I’ll ever have.
With just over 6 hours left, all of the challenges for this year's
@defcon
Capture the Flag Qualifying event have now been released! After 42 hours of hacking, we wish teams luck in their final push to make it to Las Vegas in August.
We’ve had more than 12,000 of you come through the AIxCC City this week
@defcon
and watch as our teams secure it. We’re now an hour away from the results.
I’ll be announcing the AIxCC Semifinal Results on Track 1/Track 2 at 12:30 today with Andrew Carney of
@ARPA_H
.
So excited to share what we’ve been working on for the last year with the community tomorrow! Come by the AIxCC space tomorrow
@defcon
— it’s impossible to miss ;)
This is why the AIxCC scoring algorithm penalizes false positives and requires teams submit proof of vulnerability in the form of inputs that exercise the flawed code and demonstrate the issue.
Today I’ll be at IEEE Security and Privacy
@IEEESSP
with Andrew Carney from
@ARPAHealth
to discuss AIxCC. There’s so much fantastic research being presented on how AI can be used for security, we’re excited to join the fun 🎉
So excited for this —
@Zardus
,
@TheConnorNelson
, et al. have built something groundbreaking in . Learning to write an exploit should be available to all — and now you’ll be able to *graduate* to the next level of pwn at
@DEFCON
Learn more at 4:30p today!!
Thrilled to join
@Zardus
in announcing DEF CON Academy on Saturday at 1630. Wouldn't have been possible without
@thedarktangent
, a fantastic co-conspirator in this effort.
Coming up next on the pod: The incomparable Perri Adams (
@perribus
) on the value of CTFs and DARPA's new $20M AI Cyber Challenge
#SecurityConversations
#AIxCC
A snippet 👇
“LAS VEGAS, Aug 17 (Reuters) - A team of hackers from two U.S. universities won the "Capture the Flag" championship, a contest seen as the "Olympics of hacking," which draws together some of the world's best in the field.”
Nice article about
@defcon
CTF
Love the excitement for fixing real vulnerabilities 🎉🎉🎉
And nothing says critical code like SQLite which is in your browser, phone, computer, car, electric grid, and most likely the airplane that took you home from
@defcon
…
AIxCC couldn’t have found better conference friends than the wonderful folks
@defcon
So many more details on ~everything~ coming soon!
(pc
@Grifter801
)
Thrilled at the strong showing by university students in AIxCC. Several university-led teams like 42-b3yond-6ug,
@TeamAtlanta24
&
@shellphish
are going to finals!
As below, there’s been a lot of inter-school collaboration. Fantastic teamwork across our academic institutions!
It's a great honor to collaborate with my talented and hardworking current and former students, friends, and colleagues on the AIxCC journey. A huge shoutout to team 42-b3yond-6ug and a big win for Northwestern, CU-Boulder, Utah, Waterloo, and UNH. Well deserved!
I'm know I'm late but Chrome's MiraclePtr effort is really impressive - seems like it's going to kill a significant swathe of sandbox UAFs. The huge codebase rewrite & the performance impact show that some places are actually willing to make tradeoffs for security
Today, I signed an Executive Order that is the most significant action any government has ever taken on AI safety, security, and trust.
I am determined to do everything in my power to promote and demand responsible innovation.
It was a pleasure to join the Open Source Software Summit this week and speak about the AI Cyber Challenge, and how emerging technologies like AI can be used to combat cybersecurity threats.
For the latest on AIxCC:
The open-source ecosystem forms the bedrock of modern technology. As part of its mission to create breakthrough technologies & capabilities for national security, DARPA will continue to invest in efforts like AIxCC and OS3I that will help defend and secure OSS -
@perribus
,
@DARPA
It’s an honor to be nominated in the presence of so many talented individuals. I’ve had the privilege of knowing a number of the other nominees, and have seen their great work and dedication to the space.
We're thrilled to announce the nominees for the 2024
#CyberScoop50
Awards! These cybersecurity trailblazers are not just combating today's threats but are also innovating to safeguard our future. Their dedication keeps our global networks secure and resilient. Show your support
All of the
@livectf
broadcasts from this year's
@defcon
CTF Qualifiers are up and can be watched here:
Great way for beginners to see how CTF players compete, with challenges easier than the ones usually found in DEF CON CTF
And that's a wrap! All LiveCTF challenges for the DEF CON CTF Quals 2023 are complete, thanks for joining us this year.
Join our final broadcast where we will recap all the results:
You can watch the AI Cyber Challenge Update here! Lots of fun stuff, from an additional $4 million in Semifinal Prizes to the first release of our Scoring Algorithm and Exemplar Challenge -- and it wouldn't be R&D without some schedule changes too ;)