eQuiNoX (@eQuiNoX__) profile picture

eQuiNoX

@eQuiNoX__
Joined November 2010
  • Tweets811
  • Following346
  • Followers362
This talk is going to be very interesting, and not even because it makes scaling fuzzers easier. I'm more interested to see how hard it is to emulate device specific kernel drivers in general in QEMU, as it prevents needing a real device for testing 👀 events.ccc.de/congress/2025/…

[39c3] Build a Fake Phone, Find Real Bugs: Qualcomm GPU Emulation and Fuzzing with LibAFL QEMU

Mobile phone manufacturers ship competitive hardware supported by increasingly complex software stacks, ranging from firmware and bootloaders to kernel modules, hypervisors, and other TrustZone...

events.ccc.de
3
19
161
9,195
Modern iOS Security Features – A Deep Dive by Moritz Steffin and @naehrdine arxiv.org/pdf/2510.09272
Image from Alex Plaskett (@alexjplaskett)
4
143
627
35,110
With H2HC on hiatus this year, the security community stepped up to create the 307 Temporary Security Conference—and we were proud to be part of it! We presented our research on vulnerabilities in the CAN BCM protocol in the Linux kernel. Thank you to everyone who watched! The slides and exploit demos are now available. Slides allelesecurity.com/wp-conten… Demo 1: Exploit for UAF read (CAN BCM) to dump shadow file & MySQL root hash. youtube.com/watch?v=znTLHc2m… Demo 2: Exploit for UAF read in CAN BCM (CVE-2023-52922) that leaks encoded freelist pointer and slab object addresses youtube.com/watch?v=XQ3QlXqn…
Image from Allele Security Intelligence (@alleleintel)
7
1
18
6,575
LUKS2 stores its encryption config in a JSON header on the disk itself. An attacker with write access changes "aes-xts-plain64" to "cipher_null-ecb", which does nothing. The CVM boots as if the disk was still encrypted. blog.trailofbits.com/2025/10…
Image from Trail of Bits (@trailofbits)
1
2
1
3
718
stop using ubuntu 24.04 to host your kernel pwn challenges lmao kqx.io/post/qemu-nday/
Image from Gabriel Prostitis (@___prosti)
Image from Gabriel Prostitis (@___prosti)
Image from Gabriel Prostitis (@___prosti)
5
87
3
561
71,943
You can write '2' (0x32) anywhere in the filesystem of a Linux-based network switch. How do you get root? That's basically what my talk at @GrehackConf was about - enjoy! youtu.be/F4CudbWHZ7Y?t=504 youtu.be/X-ZJH4d2tuE?t=1162
2
20
108
23,309
Whelp! Looks like we have reached the point where 32-bit Linux debug builds have too many symbols on some configurations, exceeding design limits for RELA relocations. OTOH x86 32-bit with similar config only has 135k symbols for v6.15 so something's up on RISC-V...
Image from Marco Bonelli (@mebeim)
Marco Bonelli (@mebeim) profile pictureMarco Bonelli@mebeim8 Jun 2025
Been stuck on the next syscall tables releases for v6.15 for a few days because of an annoying RISCV 32-bit build error. Bisecting yields different commits depending ZSTD support. I am kind of lost. If anyone could repro it would be helpful: lkml.org/lkml/2025/6/6/951
1
3
1
15
2,921
Our paper "SIMurai: Slicing Through the Complexity of SIM Card Security Research" just went public! In this paper, we explore the question: What kind of attacks could a hostile SIM launch against your phone? Surprisingly, a lot.
Screenshot of the first page from the SIMurai paper, including title, author names, and parts of the abstract.

ALT Screenshot of the first page from the SIMurai paper, including title, author names, and parts of the abstract.

2
96
5
258
34,077
Introducing a fun class of security bug I call “Mishandled Hardware Specification”. It may arise only at the hardware-software boundary due to software developer’s misunderstanding of a documented hardware behavior. I see instances in hypervisor core code (VMM attack surface / Guest OS attack vector), and hypothesize that kernels and firmwares may be affected more by it quantitatively but to a lesser security degree
Image from Alisa Esage Шевченко (@alisaesage)
3
16
69
9,068
eQuiNoX retweeted
Zisis (@_zisis) profile picture
Zisis@_zisis8 Aug 2024
You can find the slides from my BHUSA2024 talk Bugs of Yore: A Bug Hunting Journey on VMware's Hypervisor at i.blackhat.com/BH-US-24/Pres…
3
26
1
82
9,925
*ahem* I interrupt your feeds to bring you a blog post about CVE-2023-2163 Here we detail how we found, RCA and develop an ebpf exploit :) bughunters.google.com/blog/6…
Blog: A deep dive into CVE-2023-2163: How We found and Fixed an eBPF Linux Kernel Vulnerability

Blog: A deep dive into CVE-2023-2163: How We found and Fixed an eBPF Linux Kernel Vulnerability

This blog post takes a look at the years where eBPF was one of the kernel subsystems that grabbed the attention of a lot of security researchers. We will tell the story of how we discovered CVE-202...

bughunters.google.com
3
32
2
130
26,315
Checkout FizzBuzz101's corCTF 2024 challenge writeups! Leaking Flags from Initramfs with Spectre v1: willsroot.io/2024/08/just-a-… KVM Escape from a nested L2 guest to the L1 hypervisor: willsroot.io/2024/08/trojan-…
1
52
1
172
27,186
Virtual Escape; Real Reward: Introducing Google’s kvmCTF security.googleblog.com/2024…
Virtual Escape; Real Reward: Introducing Google’s kvmCTF

Virtual Escape; Real Reward: Introducing Google’s kvmCTF

Marios Pomonis, Software Engineer Google is committed to enhancing the security of open-source technologies, especially those that make up t...

security.googleblog.com
1
31
2
129
13,028
eQuiNoX retweeted
mdowd (@mdowd) profile picture
mdowd@mdowd2 Jul 2024
Fun Fact: I found those signal bugs (sendmail and openssh) while writing the chapter on signals for TAOSSA. Writing stuff you think you know well helps you to discover your blind spots, and also consider new ideas!
6
43
7
291
36,788
PagedOut issue #4 is now available. My article on leaking host KASLR bits from a guest VM using a TLB side channel can be found on page 58
PagedOut (@pagedout_zine) profile picturePagedOut@pagedout_zine1 Jun 2024
Issue #4 is out – enjoy! pagedout.institute/?page=iss… Please RT and tell your friends :)
Image from PagedOut (@pagedout_zine)
1
17
75
12,736
#Linux kernel bugs found by syzbot per month: syzkaller.appspot.com/upstre… (also split by type) 1. It's not going down over 7 years. 2. syzbot is doing well lately. syzkaller: our kernel #fuzzer: github.com/google/syzkaller
Image from Dmitry Vyukov (@dvyukov)
4
31
1
177
58,275
To Boldly Go Where No Fuzzer Has Gone Before: Finding Bugs in Linux' Wireless Stacks through VirtIO Devices A paper by @soenke_hu et al. about externally fuzzing the Linux kernel's Wi-Fi and Bluetooth stacks. computer.org/csdl/proceeding…
Image from Linux Kernel Security (@linkersec)
1
17
1
59
5,129
just finished a new blogpost on how i exploited the V8 javascript engine at a CTF! it's a beginner friendly journey from a memory corruption to a browser pwn, and features lots of cool CSS to help you understand various concepts along the way. have fun!! lyra.horse/blog/2024/05/expl…

Exploiting V8 at openECSC

A beginner-friendly journey from a memory corruption to a browser pwn.

lyra.horse
8
116
4
438
46,951
Last year I discovered multiple bugs in virtio-net for VirtualBox (CVE-2023-22098, CVE-2023-22099, CVE-2023-22100) and wrote a 100% reliable VM escape using an out-of-bounds write (with ASLR defeat). Published the exploit code: github.com/google/security-r…
8
145
674
84,996
Starting my travel to San Francisco for IEEE S&P. I'll present our Linux Kernel Fuzzing paper on wednesday, for which we just published the source code 👇 github.com/seemoo-lab/VirtFu…

GitHub - seemoo-lab/VirtFuzz: VirtFuzz is a Linux Kernel Fuzzer that uses VirtIO to provide inputs...

VirtFuzz is a Linux Kernel Fuzzer that uses VirtIO to provide inputs into the kernels subsystem. It is built with LibAFL. - seemoo-lab/VirtFuzz

github.com
32
1
111
16,096
Load more