
Day[0] Snooping YouTube History and Breaking State Machines
This week is a shorter episode, but still some solid bugs to look at. From a full chain Chrome exploit, to a Kindle chain from remote to root and a eBPF incorrect calculation leading to OOB read/write.
[00:00:41] Albicla launch clusterfuck
- https://www.reddit.com/r/programminghorror/comments/l25ppk/albicla_launch_clusterfuck/
[00:04:41] [NordVPN] RCE through Windows Custom Protocol on Windows client
- https://hackerone.com/reports/1001255
[00:09:00] Chaining Multiple bugs for Unauthenticated RCE in the SolarWinds Orion Platform
- https://www.thezdi.com/blog/2021/1/20/three-bugs-in-orions-belt-chaining-multiple-bugs-for-unauthenticated-rce-in-the-solarwinds-orion-platform
[00:18:50] The Embedded YouTube Player Told Me What You Were Watching (and more)
- https://bugs.xdavidhu.me/google/2021/01/18/the-embedded-youtube-player-told-me-what-you-were-watching-and-more/
[00:24:27] The State of State Machines
- https://googleprojectzero.blogspot.com/2021/01/the-state-of-state-machines.html
- https://bugs.chromium.org/p/project-zero/issues/detail?id=2085
[00:34:21] KindleDrip - From Your Kindle’s Email Address to Using Your Credit Card
- https://medium.com/realmodelabs/kindledrip-from-your-kindles-email-address-to-using-your-credit-card-bb93dbfb2a08
[00:44:00] New campaign targeting security researchers
- https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
[00:44:42] An Incorrect Calculation Bug in the Linux Kernel eBPF Verifier
- https://www.thezdi.com/blog/2021/1/18/zdi-20-1440-an-incorrect-calculation-bug-in-the-linux-kernel-ebpf-verifier
[00:49:18] Chat Question: What do we think of HackTheBox
- https://hackthebox.eu
[00:53:51] Bad Pods: Kubernetes Pod Privilege Escalation
- https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation
[00:53:24] [Linux Kernel Exploitation 0x2] Controlling RIP and Escalating privileges via Stack Overflow
- https://blog.k3170makan.com/2021/01/linux-kernel-exploitation-0x2.html
- https://pwn.college/modules/kernel
Watch the DAY[0] podcast live on Twitch (@dayzerosec) every Monday afternoon at 12:00pm PST (3:00pm EST)
Or the video archive on Youtube (@dayzerosec)
