Jasper | Neodyme retweeted
Solana was built for security. As the ecosystem scales, so does our investment in the tools, standards, and support.
Today that commitment deepens with a new security program, active monitoring, formal verification for top protocols, and a new crisis response network.
Learn more 👇
Jasper | Neodyme retweeted
Alongside STRIDE, the Solana Incident Response Network (SIRN) is now live. A membership-based network of security firms for real-time incident response across the Solana ecosystem. Available to all protocols. Prioritized by TVL.
Founding members: @asymmetric_re, @osec_io, @neodyme, @multisig and @zeroshadow_io
Jasper | Neodyme retweeted
Small update on the unfolding Drift timeline: as surfaced in other threads (eg nitter.gq/TheSoftwareJedi/status…), the malicious proposal and execution were nonce transactions (those can be signed offline and not immediately submitted to the network).
The thing about nonce accounts is, that they have an authority set.
So we can go look on-chain to find nonce accounts that are configured to work with any of the new and old drift multisig members. When we do that with dune, we find *three* nonce accounts:
One created March 31st, used in exploit for 6UJb, member of new multisig:
solscan.io/account/EmYEryTDX…
And two created March 24th. One used in exploit for 39Jy, member of old multisig: solscan.io/account/7s7s6saC5…
And one NOT used in exploit, for a key in old multisig 45cZ...: solscan.io/account/41zpDnNbC…
This can be an indication that they were prepared to attack the old multisig before the migration happened.
There are two additional nonce accounts created by the same authority as the above three, that seem also related to the attack but are not multisig members.
You also don't have to set up the nonce account before signing a transactions. It is perfectly possible to keep that also stealthy, and only create the nonce account once you are ready to submit the transaction. But it appears the attacker didn't do so, and thus "leaked" all keys he wanted to be able to create offline transactions for.
i missed the fact that these drift related squads txs had durable nonces... that changes things. perhaps all my wallet security rants are misapplied here.
the drift admins may not have completely exposed their keys. just signed a rogue tx sometime in the last 10 days / 2 days respectively. theres no way to tell when it was signed, just sometime in the window.
so if thats the case, perhaps proper wallet security was in place - but they were somehow tricked into signing something without knowing. a key thing to look at here would be a fake squads page, since it seems like those wallets were signing legit squads txs during the window.
wallet1: solscan.io/account/39JyWrdbV…
nonce1: solscan.io/account/7s7s6saC5…
nonce1 used in attack: solscan.io/tx/2HvMSgDEfKhNry…
wallet2: solscan.io/account/6UJbu9ut5…
nonce2: solscan.io/account/EmYEryTDX…
nonce2 used in attack: solscan.io/tx/4BKBmAJn6TdsEN…
Jasper | Neodyme retweeted
Excellent discussion on the current and future landscape of Solana auditing. Thank you @mikemaccana!
We spoke with Marius at @Neodyme - auditors for Anza, Jump, Marinade, Drift and more - on the past and future of Solana program security.
Jasper | Neodyme retweeted
We spoke with Marius at @Neodyme - auditors for Anza, Jump, Marinade, Drift and more - on the past and future of Solana program security.
Most descriptions of the hack floating around on twitter were incorrect or incomplete. Here's what actually happened.
Jasper | Neodyme retweeted
Meet our colleagues at the "Festival der Zukunft" at @DeutschesMuseum in Munich. Don't miss our talk on July 3 at 4pm!
Check it out here: 1e9.community/festival-der-z…
Jasper | Neodyme retweeted
Part 3 of our Riverguard series is out!
We're looking under the hood at the "fuzzcases" Riverguard uses to catch real-world bugs in Solana smart contracts.
Still shocked how often some of these pop up.
Check it out 👉 neodyme.io/en/blog/riverguar…
Jasper | Neodyme retweeted
From iframes and file reads to full RCE. 🔥
We found an HTML-to-PDF API allowing file reads and SSRF - then chained it into remote code execution via a Chromium 62 WebView exploit.
👉 Read the full write-up here: neodyme.io/en/blog/html_rend…
Jasper | Neodyme retweeted
Interested in learning about Windows exploitation?
This August, join us in Las Vegas for an intensive, hands-on 4-day DEFCON training:
Binary Exploitation on Windows, led by Felipe and Kolja!
🗓️ When: August 9–12, 2025
📍 Where: Las Vegas Convention Center
Jasper | Neodyme retweeted
🔎Digging deeper into COM hijacking!
In Part 3, we explore two new vulnerabilities:
🗑️ Webroot Endpoint Protect (CVE-2023-7241) – SYSTEM via arbitrary file deletion
📥 Checkpoint Harmony (CVE-2024-24912) – SYSTEM via a file download primitive
Read more: neodyme.io/en/blog/com_hijac…
Whoops, he's at it again: How to circumvent Windows 11's BitLocker encryption, by @t_lambertz.
Your laptop was stolen. It’s running Windows 11, fully up-to-date, device encryption (BitLocker) and Secure Boot enabled. Your data is safe, right? Think again! This software-only attack grabs your encryption key. Following up on our #38C3 talk: neodyme.io/blog/bitlocker_sc…
Just @0x4d5aC and @__k0lja casually finding vulnerabilities in several well-known antivirus solutions.
Nothing to see here, move along.
Following our #38c3 talk about exploiting security software for privilege escalation, we're excited to kick off a new blog series! 🎊
Check out our first blog post on our journey to 💥 exploit five reputable security products to gain privileges via COM hijacking: neodyme.io/blog/com_hijackin…
Jasper | Neodyme retweeted
Slides for our talk "The Key to COMpromise" (AV/EDR privilege escalation) are on GitHub.
If you want to discuss this stuff, you can find @__k0lja or me at the CTF area of 38C3
github.com/0x4d5a-ctf/38c3_c…
