pop_eax retweeted
Nerds reaction if someone does ransomware: "whoa whoa whoa based"
Nerds reaction if someone cheats in multiplayer video games: "fuck you, you're a piece of shit"
It was awesome hacking with yall! Thanks to the wonderful zkhack team for organizing such a great event.
🥈 Second Place 🥈
ZK-AntiCheat, by @pop_eax, built w/ @NoirLang & @aztecnetwork
ZK-AntiCheat is a first-of-a-kind privacy preserving anticheat engine!
project: devfolio.co/projects/zkantic…
repo1: github.com/zk-AntiCheat/
pop_eax retweeted
Nice write-up on hacking a credit card terminal: stefan-gloor.ch/yomani-hack
Would have been nice to take it to the next level and looked into that "secure OS" tho 🤠
pop_eax retweeted
🚨🚨🚨We just broke everyone’s favorite CTF PoW🚨🚨🚨
Our teammate managed to achieve a 20x SPEEDUP on kctf pow through AVX512 on Zen 5. Full details here: anemato.de/blog/kctf-vdf
The Sloth VDF is dead😵
This is why kernelCTF no longer has PoW!
pop_eax retweeted
OAuth Client Confusion is an easy-to-overlook vulnerability that can lead to account takeovers. If an app doesn’t verify that an Access Token was generated for its specific Client ID, an attacker can hijack accounts.
Here’s how it works:
pop_eax retweeted
One of my favorite traits in programmers is a love for writing lots of code AND an equal love for deleting it.
A willingness to build elaborate prototypes and throw them away to rebuild better is a marker of greatness IMO.
pop_eax retweeted
🔥 Microsoft fixed a high severity data exfiltration exploit chain in Copilot that I reported earlier this year.
It was possible for a phishing mail to steal PII via prompt injection, including the contents of entire emails and other documents.
The demonstrated exploit chain consists of techniques that didn't even exist 2 years ago. 🔥
In particular, it involves:
1. Prompt Injection 💉
2. Automatic Tool Invocation (without human in loop) to bring PII into chat context ⚙️
3. ASCII Smuggling 🫣
4. Rendering of benign link + invisible text 👀
5. (Optional) Conditional instructions to only trigger when certain users view the content ☝️
Discussing two demos (stealing sales data and MFA codes), including the videos I had shared with MSRC in February.
@simonw @goodside @llm_sec
embracethered.com/blog/posts…
almost 1 year later and here we are
pop_eax retweeted
Remember everyone. C is a safe language. Just be sure you don't write any bugs in your code like checking to see if an integer is going to overflow...🤦
Me: Let's check if the upcoming addition is undefined behavior and bail out.
Compiler: Nah, let's remove that check since it is undefined behavior.
research.swtch.com/ub
