Defcon Quals, Dead μops, BadAllocs, Wordpress XXE

Big episode this week, with a lot of discussion about CTFs, kernel drama, and Github's exploit policy. Then some really interesting exploit strategies on Tesla and Netgear, along with some simple, yet deadly issues in Wordpress and Composer.

[00:00:32] An Update on the UMN Affair

• https://lwn.net/SubscriberLink/854645/334317047842b6c3/


• https://www-users.cs.umn.edu/%7Ekjlu/papers/full-disclosure.pdf

[00:11:29] [GitHub] Exploits and Malware Policy Updates

• https://github.com/github/site-policy/pull/397


• https://github.com/github/site-policy/pull/397/commits/f220679709b60dd4d6b34465a56b89bb79efcfe6#diff-24d72c4cb9785e60d5cbf50905291a5e079f4efd8c03f67904077cc2af4b8412L34

[00:18:22] OOO - DEF CON CTF

• https://oooverflow.io/


• https://twitter.com/oooverflow/status/1388920554111987715

[00:34:23] BadAlloc - Memory Allocation Vulnerabilities

• https://msrc-blog.microsoft.com/2021/04/29/badalloc-memory-allocation-vulnerabilities-could-affect-wide-range-of-iot-and-ot-devices-in-industrial-medical-and-enterprise-networks/


• https://us-cert.cisa.gov/ics/advisories/icsa-21-119-04

[00:40:15] I See Dead μops: Leaking Secrets via Intel/AMDMicro-Op Caches

• http://www.cs.virginia.edu/venkat/papers/isca2021a.pdf


• https://comparch.org/2021/05/01/i-see-dead-uops-thoughts-on-the-latest-spectre-paper-targeting-uop-caches/

[00:54:43] Brave - Stealing your cookies remotely

• https://infosecwriteups.com/brave-stealing-your-cookies-remotely-1e09d1184675

[00:57:37] Facebook account takeover due to unsafe redirects after the OAuth flow

• https://ysamm.com/?p=667

[01:03:11] WordPress 5.7 XXE Vulnerability

• https://blog.sonarsource.com/wordpress-xxe-security-vulnerability/

[01:05:43] PHP Supply Chain Attack on Composer

• https://blog.sonarsource.com/php-supply-chain-attack-on-composer

[01:10:25] Multiple Issues in Libre Wireless LS9 Modules

• https://www.iot-inspector.com/blog/advisory-multiple-issues-libre-wireless-ls9/

[01:14:50] macOS Gatekeeper Bypass

• https://objective-see.com/blog/blog_0x64.html


• https://cedowens.medium.com/macos-gatekeeper-bypass-2021-edition-5256a2955508

[01:19:28] Linux Kernel /proc/pid/syscall information disclosure vulnerability

• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1211

[01:24:08] Remote Zero-Click Exploit in Tesla Automobiles

• https://kunnamon.io/tbone/

[01:31:00] NETGEAR Nighthawk R7000 httpd PreAuth RCE

• https://ssd-disclosure.com/ssd-advisory-netgear-nighthawk-r7000-httpd-preauth-rce/

[01:34:43] Parallels Desktop RDPMC Hypercall Interface and Vulnerabilities

• https://www.zerodayinitiative.com/blog/2021/4/26/parallels-desktop-rdpmc-hypercall-interface-and-vulnerabilities

[01:39:24] Exploiting Undocumented Hardware Blocks in the LPC55S69

• https://oxide.computer/blog/lpc55/

[01:40:05] python stdlib "ipaddress" - Improper Input Validation [CVE-2021-29921]

• https://sick.codes/sick-2021-014/

[01:40:35] Ham Hacks: Breaking Into Software-defined Radio

• https://labs.bishopfox.com/industry-blog/ham-hacks-breaking-into-software-defined-radio

[01:41:59] gand3lf/heappy: A happy heap editor to support your exploitation process

• https://github.com/Gand3lf/heappy

[01:43:38] LiveQL Episode II: The Rhino in the room

• https://securitylab.github.co