Security, reversing, mathematics. Writing emulators and hypervisors in 🇦🇩.
Les Escaldes, Andorra
Joined December 2009
- Tweets698
- Following512
- Followers5K
- Likes8.2K
eMudhra key leaks impact Android's Factory Reset Protection (FRP), thanks to the generous GMS sign-in interface.
TL;DR: Inject mm.setContentFilters('{"user_setup_complete":1, "device_provisioned":1}'); on server JS responses with `mitmproxy --emudhra` and reboot, bypassing SUW. Then, flip system_server's mFrpActive with any N-day to leak the secret and wipe FRP.
Demo below. Full chain private for obvious reasons.
Recently @malltos92 gave great advice applicable to anyone doing novel research:
> DO NOT [...] USE ONLINE MODELS, LLMs will take what you have and amplify it to every code base, effectively making any novel ideas you had extinct. Do not give your knowledge away for free to these online models, monetize them offline.
holy shit.
tristan buckmaster is saying openai has a forced navier–stokes blowup via the córdoba / martínez-zoroa program.
and that it may have used drafts from his and levent alpöge’s private codex sessions.
that’s the córdoba / martínez-zoroa route. almost nobody else was on it.
he also says the first prompt went out after information about his and levent alpöge’s work reached openai. that “very little human input” was not true. that a whole team had already been set on easier problems, including euler. that even the prompt they showed him was written by prompting codex.
then he asked:
did the model have their private codex sessions.
no answer on training.
if any of that holds, openai didn’t just scoop a math result. they may have done it off two researchers’ unpublished drafts, then tried to cut the coauthor because he works at anthropic.
a millennium-problem-adjacent result just became employee drama before an ipo.
i don’t even know which part is crazier.
this is one of the slimiest things i’ve seen in this industry.
It looks like most 0day/bounty prices will drop to a slim premium on top of token costs, and cybersecurity will be proof-of-work (always has been?)
But for now, this seems like the best arbitrage opportunity in years.
3
1,419
Just filed an EU DMA complaint against Alphabet for gatekeeping against secure Android derivatives like @GrapheneOS via Play Integrity.
TL;DR: not certified ≠ not secure. Google lacks a FRAND certification process for non-OEMs that comply with objective security requirements.
Capstone.js, Keystone.js, Unicorn.js ports have been updated and published on NPM.
You can now assemble, disassemble and execute code of many new architectures in your web browser. Faster via WebAssembly, and using BigInt to support i64 interfaces.
alexaltea.github.io/unicorn.…
Hey @googlemaps, when are you going to use gaussian splatting with LoDs (see CityGaussian or LoG papers) to render 3D maps data?
You could merge angled aerial and Street View footage for truly seamless transitions, and benefit from proper transparency and decent-ish specularity.
Are there any small USB MITM devices that let you swap keyboard Win/Alt keycodes from HID reports? Tired of doing in software for each machine...
I'm considering getting @Hak5's OMG cable for this, but feels a bit overkill (no need for WiFi, GNSS or even payloads).
1
3
2,692
Are there any cheap devices with full TrustZone exploits that could be used to generate fake attestations for @GrapheneOS devices?
Firebase App Check and Play Integrity API are getting increasingly pervasive. We need "attestation proxies" now.
Do ransomware negotiations consider that a large % of AI SaaS startup valuations is contributed by the secrecy of their state-of-the-art models/params?
Real shame if weights were leaked. Yes, illegal to use, but also cheap to launder. Piracy on steroids.
Months after this tweet we got c2pa.org/ and truepic.com/. Sony A9III cameras announced this week supports it! Glad to see action.
Are there any cameras with crypto co-processors to digitally sign footage with in-hardware keys?
If not, this absolutely needs to happen; the inaction of vendors/media is baffling.
Might not be enough to fight state-sponsored shoops, but enough to deter medium/small actors.
1
1,844
Filling a customs form, that generates PDFs, which I have to print, "sign" (with a squiggle), scan and send... for some person to read and manually type in an identical form. Just to charge me few cents of taxes and few dozen EUR of "handling".
Bureaucrats are a waste of oxygen.
6
1,412
Are there any physical cryptocurrency coins?
Something like TPM w/ privkey, NFC to broadcast pubkey. Zero-cost offline "transactions" in-person. Button on the back to redeem the coin value (sign+broadcast to another wallet). Cash registers read pubkeys via NFC to compute total.
2
2
2,300
EU AI regulation proposals have convinced me bureaucrats are going down the route of contemporary artists.
Build a career via attention by being provocative, crippling industries, proud of the corpses they leave behind as their masterpiece. Hanlon's razor doesn't cut it.
5
2,761
This will not work, at least not economically.
Even with robust sw, in-hw keys need to resist physical attacks. This worked for Microsoft in Xbox One and later because despite no shortage of talented/motivated people, nobody drops 100k hours + $1m lab hw with with unclear ROI.
This quoted post is unavailable.
2
14
3,645
Interesting that when LLMs hallucinate API/lib functionality, it's just so convincing and convenient.
The latent space seems to contain the collective expectations and wishes of developers. Rather than fighting it, devs could explore it for new features and applications.
Prediction: LLMs will dramatically reduce the dev cost of consuming APIs ⇒ Increasing their traffic/expenses, esp to free APIs ⇒ Short-term lowering quotas, long-term pushing for high perf langs/DBs.
1
3
2,193
"AI Expert" who has never done a single contribution to the field that is not arm-chairing nonsense, or writing fiction that he now mistakes for reality.
Some people are really afraid to miss on free conference breakfast once ChatGPT starts giving keynotes.
'If We Go Ahead On This, Everyone Will Die' Warns AI Expert Calling For Absolute Shutdown zerohedge.com/technology/if-…
9
2,473
Funny how the email caste embraced AI and celebrated the destruction of repetitive manual work performed by now-useless inferior humans (cf. Harari).
Now that self-hosted LLMs threaten *their* bullshit jobs, it's suddenly: "Please stop sand from doing math!!1!".