Viewing profile — bahorn

Stack Clashing is pretty neat, something you should really pay attention to in embedded spaces (its often exploitable in UEFI land as most EDK2 builds lack guard pages). I got to w…

Bit confused on how this group got access to the rabbit codebase, as this sounds closer to backend code and not jadx'ing the APK. Are there any details on that?

I understand the issue, I have checked /dev/pts/ and seen systemd-run create a user readable pts there. I'm not adverse to that one getting chown()'d, but there really isn't any im…

This is not a systemd-run specific issue either. I reproduced this targeting sudo (just `cat` the parent tty), in fact able to capture my password as I type it in, and capture comm…

I put a bit further thought into this. The claim is that because the pty has user permissions its possible to hijack it, but that really hasn't been true for years which is why the…

This is not a real bug and the trick is possible with sudo if you just hijack the parent process of sudo with reptyr instead of sudo directly. Also seems a bit absurd to try and pr…

From their FAQ and blog posts, I don't believe they apply much FHE. Seems what they do is use work from a different subfield [1], which seems to be able to achieve the required spe…

It actually does run on KVM! I spent yesterday trying to get it to work and found the trick was setting the chipset to i440FX, and putting every drive on the IDE bus. Probably not …

Far from the most qualified to answer this but it's probably a mixture of market demand, the targets, mindshare and QA. Higher value targets tend to use iOS more often so their adv…

I stumbled upon a talk from GRCon18 a few weeks ago where they did this [1], though on a much more restricted testcase. Find the idea interesting, but I'm curious how resistant it …

I've ran some student hackathons in the UK (worth noting we have a very different culture than the US scene) and we actually tried to discourage the whole working 24 hours straight…

Worth noting that it's quite common for people to not be publicly listed as part of Github organizations. The archive.org snapshot of the organization page from February [1] shows …

While the authors of this definitely didn't handle this well, I'd argue it's a pretty severe weakness and the tool shouldn't have been released in this state. Active probing has be…

The google form lists the prices in an image: * $119 for 4GB of RAM * $149 for 8GB of RAM But the early version apparently is only the 8GB variant.

Been using the project for a year now and submitted a few patches. It's a fun project to hack on, so would recommend getting involved if this sort of thing interests you. Regarding…

I arranged everything on day I needed to move on (except in Dushanbe where I arranged the transport to Khrough via the hostel, who I just told the night before). Worked even on the…

I did the journey in early September, starting in Dushanbe, as part of my backpacking trip throughout Central Asia. Highlight of my trip. Surprisingly easy to travel as a lone back…