I'm publishing some
research today, a major design flaw in Windows that's existed for almost *two decades*. I wrote a blog post on the story of the discovery all the way through to exploitation.
https://googleprojectzero.blogspot.com/2019/08/down-rabbit-hole.html …
-
Show this thread
-
Here's a repository of all the code and tools I developed to explore this attack surface.https://github.com/taviso/ctftool
16 replies 268 retweets 799 likesShow this thread -
Replying to @taviso
What's interesting is that Windows Defender AV detects the pre-compiled binary files in the github release however the EXACT SAME CODE that I compiled myself as instructed (VS2019+GNU make) gets past just fine. Or maybe that sort of thing with AV shouldn't actually be surprising?pic.twitter.com/bOvWIGFhhN
2 replies 0 retweets 5 likes -
Even building the exact same source code twice in succession on the same machine provides distinct binaries with many differences (in meta data, not executable code). If detection is done based on file hash it will fail.
1 reply 0 retweets 2 likes -
"WE DON'T USE HASHES ANYMORE, STOP CALLING US BLACKLISTING"
1 reply 0 retweets 4 likes -
"THEN WHY DOES A SINGLE-BYTE CHANGE MAKE YOUR SOLUTION AS USELESS AS AN INFLATABLE DARTBOARD?" (hoping for an American Chopper Argument meme :)
1 reply 0 retweets 1 like -

Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.