This week's binary episode features a range of topics from discussion on Pwn2Own's first automotive competition to an insane bug that broke ASLR on various Linux systems. At the lower level, we also have some bugs in UEFI, including one that can be used to bypass Windows Hypervisor Code Integrity mitigation.
Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/238.html
[00:00:00] Introduction
[00:02:40]
37C3: Unlocked
- media.ccc.de
[00:08:15] Zero Day Initiative — Pwn2Own Automotive 2024 - Day One Results
[00:16:35] ASLRn’t: How memory alignment broke library ASLR
[00:22:47] Unleashing ksmbd: remote exploitation of the Linux kernel (ZDI-23-979, ZDI-23-980)
[00:26:33] PixieFail: Nine vulnerabilities in Tianocore's EDK II IPv6 network stack.
[00:31:10] Hunting down the HVCI bug in UEFI
[00:35:51] A Deep Dive into V8 Sandbox Escape Technique Used in In-The-Wild Exploit
[00:37:32] Google Chrome V8 CVE-2024-0517 Out-of-Bounds Write Code Execution - Exodus Intelligence
[00:38:38] OffSec EXP-401 Advanced Windows Exploitation (AWE) - Course Review
[00:44:56] Dumping GBA ROMs from Sound
The DAY[0] Podcast episodes are streamed live on Twitch twice a week:
-- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities
-- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.
We are also available on the usual podcast platforms:
-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063
-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt
-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz
-- Other audio platforms can be found at https://anchor.fm/dayzerosec
You can also join our discord: https://discord.gg/daTxTK9
[binary] SoCs with Holes, Crow HTTP Bugs, and Bypassing Intel CET
[bounty] Web3 Universal XSS, Breaking BitBucket, and WAF Bypasses
[binary] An iOS Bug, Attacking Titan-M, and MTE Arrives
[bounty] Reading GitLab Hidden HackerOne Reports and Golang Parameter Smuggling
[binary] Fuchsia OS, Printer Bugs, and Hacking Radare2
[bounty] A Zoom RCE, VMware Auth Bypass, and GitLab Stored XSS
[binary] Pwn2Own, Parallels Desktop, and an AppleAVD Bug
[bounty] Stealing DropBox Google Drive Tokens, a GitLab Bug, and macOS "Powerdir" Vulnerability
[binary] Python 3 UAF and PS4/PS5 PPPoE Kernel Bug
[bounty] Deleting Rubygems, BIG-IP Auth Bypass, and a Priceline Account Takeover
[binary] Pwn2Owning Routers and Anker Eufy Bugs
[bounty] Cloudflare Pages, Hacking a Bank, and Attacking Price Oracles
[binary] NimbusPwn, a CLFS Vulnerability, and DatAFLow (Fuzzing)
[bounty] XSS for NFTs, a VMWare Workspace ONE UEM SSRF, and GitLab CI Container Escape
[binary] Getting into Vulnerability Research and a FUSE use-after-free
[bounty] A Struts RCE, Broken Java ECDSA (Psychic Signatures) and a Bad Log4Shell Fix
[binary] Another iOS Bug and Edge Chakra Exploitation
[bounty] Taking Over an Internal AWS Service and an Interesting XSS Vector
[binary] A subtle iOS parsing bug and a PHP use-after-free
[bounty] A Double-Edged SSRF, Pritunl VPN LPE, and a NodeBB Vuln
Create your
podcast in
minutes
It is Free
Insight Story: Tech Trends Unpacked
Zero-Shot
Fast Forward by Tomorrow Unlocked: Tech past, tech future
The Unbelivable Truth - Series 1 - 26 including specials and pilot
Lex Fridman Podcast