Flight Attendant: is there a doctor on board?
Parent: *nudging* That should've been you
Me: Not now, this is serious
Parent: Not asking for a hacker to help, are they?
Me: AAAAAAAA\x00\xd0X?\xfc\x7fBBBBj\x0bX\x99Rfh-p\x89\xe1Rjhh/bash/bin\x89\xe3RQS\x89\xe1\xcd\x80
Parent:~#
Was curious to see the ionospheric impact of this morning's
#SpaceX
#Starship
launch.
It's definitely visible but not many stations below the Gulf of Mexico :(
fwiw here is the ionospheric data from the hour around the launch
I don't see any large disturbances as I would expect. Even a "rapid unscheduled disassembly" should produce something, unless it happened at very low altitude.
So either bugs in my code or broke up quickly?
The H3 rocket has failed to reach orbit on its first test flight.
Range control at Tanegashima Space Center in Japan have sent a destruct command to the H3 rocket after determining there was "no possibility of achieving the mission."
NHK, citing defense ministry, reports the North Korean missile was launched at 7:09am and is expected to fall at 8:18am. Will land about 550 km east of the Korean Peninsula, outside of Japan's EEZ.
Thank you so much
@DefconRaffle
! I'm so glad I stuck around after the closing ceremonies to win the first ever
#BlackBadgeRaffle
. Looking forward playing again at
@defcon
next year!
Very happy we qualified for
#AIxCC
! Between our tiny team and Defcon CTF, we had no time to do a blog or PR release
First, the
@theori_io
CRS was made by
@tjbecker_
and myself. I’m so thankful to work at a company that believes in us and was happy to let us do this
🧵
Can we skip the part where everyone makes bad jokes about NSA and backdoors and move to the part where everyone is happy a tool with undo, collaborative editing, decompilation, function similarity, and extensions was released for free and open sourced?
In addition to maintaining pwntools and pwndbg which lots of folks know and love, and on top of being a great CTF player,
@ebeip90
was also just a super nice person.
This has definitely not been a good year for the infosec community :(
I learnt that Zach Riggle, the author of pwndbg, passed a few days ago.
We weren't close friends, but acquaintances, and discussed stuff in Twitter DMs.
I am sad. My Twitter DMs have lost multiple good folks in the last years :(
Holy crap, just saw this from
@NedWilliamson
: the lead character in a major Chinese teledrama is a CTF player? Does this mean CTFs have finally gone mainstream?
This is a kinda fun read (from Eugenio Benincasa at ETHZ) for people in the CTF scene:
It's quite interesting to see someone look so deeply at CTF team lineages and memberships, and it's extra entertaining for those of us who "lived" it.
This is an excellent point.
We should offer every student a choice between a class in sex education or blockchain education.
It's not like anyone would ever need both
Previous space launch with a breakup (T+14' in Japan's H3) was really visible.
Obviously different size and other parameters. But assuming similar results and no software bugs (😅), maybe suggests breakup was very early (like 5 minutes?)
Since I'm bad at PR or whatever: if any reporters/podcasters/whatever want to talk about
#AIxCC
, feel free to reach out!
Theori was first place in achievements (actual scores TBA), and we were a tiny, unfunded team. Happy to talk about the contest/our team/automated security!
Will post a little more after Defcon (busy with the CTF), but if anyone is curious about the Theori CRS for AIxCC, it was made by just
@tjbecker_
and myself. It looks like it did pretty well!
I made some motivational posters for these trying times. I encourage everyone to print them and hang them at their home, office, place of worship, public bulletin boards, etc.
@thebradhawkins
@ArmsControlWonk
@michaelnute
The data for this animation is from an hourly dump from Japan's GEONET. There are ~realtime data sources available, but the code isn't written (yet? 😉) to take advantage of those.
The LK-99 superconductor saga is really reinforcing my beliefs that:
1) prediction markets are dumb
2) social media influencers are terrible
3) the only ones who really get things done are silent (at least quiet) professionals (and maybe catgirls, I guess)
This whole topic is such a mess. There are literally women who are XY who have had children naturally
The idea that we can bucket men and women into binary categories is old and dumb.
Seems like a good time to re-post my older (now edited) post about athletes with XY DSDs (Disorder, or Difference of Sex Development). Lots of graphs and detail about the relevant biology at the end.
* * *
First: People living with DSDs
@hflwj
@thegrugq
The shellcode pushes the string on the stack in chunks, backwards to front because the stack grows down (push "h", push "/bas", push "/bin")
Super cool! Since someone did the hard part, an easy way to replicate this:
youtube-dl -x --audio-format wav -o 'helicopter.%(ext)s'
sox helicopter.wav channel_r.wav remix 2
minimodem -q 1200 -f channel_r.wav
That'll grab the vid and dump the data :)
People keep DMing me about Proto17’s work on demodulating helicopter telemetry data from live YouTube protest feeds. SDR work is his ninjitsu to be clear, I guided the discussion a bit. Several noted it can be used for what/where/when accountability…
Can we all take a moment to appreciate how 🔥🔥🔥US intelligence is for getting the names and specific mission roles of GRU operatives in what are presumably covert Russian operations?
Wow, I can't wait until the Pwnie Awards at Defcon China award TAG the lamest vendor response for shutting down their watering holes against Hong Kong and Taiwan!
Apparently there's a solid chance the next release of the Linux kernel after 4.19 is going to be 5.0 rather than 4.20.
How much money would
@elonmusk
need to donate to the
@linuxfoundation
to make sure we don't skip 4.20? And to make sure the release name is "Blaze It"?
This is just cheating: pay an employee $1M to install ransomware on a corporate network, then ask for a $5-10M ransom?
That's not even hacking! Where's the skill? the pizzazz?
Doesn't need to be 0days but at least find an unpatched system or phish someone!
@__tinygrad__
I kinda hate the style and line count obsession. BUT there's no other objective way to measure complexity. "Keep lines under X" is enforceable vs "cyclomatic complexity and needs to be less than (unintelligible number)"
PyTorch pulls in literally gigabytes of cruft!
Looks like someone finally made a fuzzcoin!
It looks centralized and not really a cryptocurrency, so I'd call it more of a fuzzing
@home
though
Either way, cool/fun work
@SSLab_Gatech
!
Truly Crown Sterling is the infosec drama gift that keeps on giving. 🤣
They're now suing Blackhat because them being a sponsor didn't stop people from calling them out on sucking? 💯
@dguido
@CSAW_NYUTandon
@realGeorgeHotz
lol I wasn't in the video (it was after I graduated and was no longer at CSAW). But:
(playback should work. I also have a download locally if it doesn't play for you)
Since some people asked for it, here is the
@ionplotbot
animation of the
#SpaceX
#Starship
launch this morning. I don't think there is coverage in the Indian Ocean to attempt to look for the splashdown though.
New blog post "Google: Stop Burning Counterterrorism Operations"
My reflection on an incident where Project Zero and TAG knowingly shut down an active Western counterterrorism cyber operation, and the real-world harm that could have resulted from it.
The international politics aspect of this is beyond my expertise. But PT has great security researchers that release useful, public reports.
Russians working with Russia by itself doesn't seem like enough to justify sanctions--many big companies do work with their government
@XorNinja
@tqbf
It's pure xenophobia. Immigration is fundamental to America's history and success. Nearly half of Fortune 500 companies are created by immigrants.
"American exceptionalism" isn't magic nor a given: it's people like you choosing to come to the US and make it a better place ♥️
I'm just loving watching people online pretending to have domain knowledge in increasingly more obscure areas of expertise
First political science
then virology/epidemiology
then hedge funds and option market makers
now Suez canal giant boat removal
Can't wait for what is next!
Me auditing code: "psh, look at all these bugs, these developers must have been terrible"
Me writing code: "it's impossible to design a schema to structure arbitrary international addresses" ( )
I think this whole "coding" thing may have been a mistake
Hardest part about getting older: getting rid of your dutifully collected cables and converters because they aren't useful anymore.
Thank you for your service DVI, IDE, and USB-B cables
@sirdarckcat
I just read it quickly, but this looks like a great guide! I'm not sure if those that need it most will see it... but it's always great to have better resources for CTF organizers!
PPP has a much less ambitious/detailed guide from a few years ago as well:
We use a lot of LLMs and some fuzzing. But due to engineering and time constraints, we only use 1 of the 3 machines we were given. After the finals the source for all teams CRSs will be made available so watch for that! (I really can’t wait to see the approaches everyone took)
#ESETresearch
discovered a trojanized IDA Pro installer, distributed by the
#Lazarus
APT group. Attackers bundled the original IDA Pro 7.5 software developed by
@HexRaysSA
with two malicious components.
@cherepanov74
1/5
Honestly I'm just surprised we haven't heard from Elon Musk yet about how he will provide 100 Cybertrucks or a rocket ship or something which will tow the boat clear
I'm just loving watching people online pretending to have domain knowledge in increasingly more obscure areas of expertise
First political science
then virology/epidemiology
then hedge funds and option market makers
now Suez canal giant boat removal
Can't wait for what is next!
Sorry I missed seeing so many folks at Defcon! I barely left our team's room to venture out to the actual conference/CTF floor. Hopefully I'll see everyone I missed soon (or next year)!
* The rules were superseded by 300+ issues on Github
* We’re still waiting on explanations for things like “unannounced extension of the submission deadline”
* Infra was actively changing until July
* We don’t know how the event was run, and might not get logs of what happened
@gamozolabs
During CGC
@ForAllSecure
ended up partitioning 20c/40t machines into VMs with 8 cores to avoid fork contention. Totally dumb but had better performance than scaling directly.
I forget if you reviewed it but is a nice (academic) paper on this.
First I also want to shout out to
@tjbecker_
. We already work together, but this is a good excuse for me to mention he’s awesome: cryptography, browser security, blockchain stuff, and now AI 😛
Definitely give him a follow if you aren’t already!
@hflwj
@thegrugq
Well, uh this is definitely not literally an exploit for my parents, if that's what you mean.
The shellcode should roughly work, but I didn't check very carefully that it didn't get mangled by Twitter.
If you don’t know me: this is my second CRS: I was also part of the small team at
@MayhemSec
who worked on Mayhem which won CGC in 2016. I’m so proud of our CGC win, so I am happy to have a chance to pick that up again!