意志 / mobile research @ ▓▓▓▓▓ / Team 501 / ex IBM Capability Lead & FireEye TORE / I rewrite pointers and read memory / AI Psychoanalyst / BHUSA Review Board
Jumanji
Joined April 2012
- Tweets10.7K
- Following1.3K
- Followers33.5K
- Likes20K
Pinned Tweet
Quick POC using @nebusecurity CVE-2026-43499 to root my bootloader locked US S25 (SM-S931U1). Btw this works on latest fw. This phone is Android 16, June update.
nebusec.ai/research/ionstack…
I have detailed notes on flashing, exploitation, offset finding etc, blog post later 🖖
b33f | 🇺🇦✊ retweeted
next time you're thinking about researching the linux kernel (@linuxfoundation), remember that someone on the receiving end of your report might talk about you like this:
in one of the threads, kernel maintainer "Peter Zijlstra" decides to call the ZDI team "monkeys"
there's a longer argument about how ZDI submits reports, whether they should include patches, and how fixes get tested. fair enough, have that discussion
but how does insulting the people reporting vulnerabilities help?
i thought the kernel's code of conduct was something everyone on these lists was expected to follow
sad to see people spoken to like this while trying to help improve linux security.
crime scene:
lkml.iu.edu/2610.2/16616.htm…
lkml.iu.edu/2610.2/16917.htm…
b33f | 🇺🇦✊ retweeted
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
b33f | 🇺🇦✊ retweeted
today we're releasing apex-flash-1, our first open-weights model for security research post-trained on real vulnerabilities we found and got paid for.
we are also releasing the abliterated variant for researchers who want fewer refusals in their own authorized workflows.
how we built it: cantina.security/apex-flash
Starshield is used as part of operations that have significant national security implications (for example the NRO in the US). These services are also provided through strict contracts in Europe. When they are used arbitrarily for political coercion, violating those terms, they must be restricted and phased out. It's unbelievable that this is even in question. Either a contract has value or it has no value at all.
US threatens Europe over Starlink restrictions ft.trib.al/0KUTiUQ
b33f | 🇺🇦✊ retweeted
this is just wrong: these vulns were found by defenders using Daybreak rather than attackers. It's just evidence Glasswing didn't go far enough, possibly due to capacity constraints. It's also very likely that March Mythos was not as good as Sol/Astra of September
b33f | 🇺🇦✊ retweeted
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503…
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
b33f | 🇺🇦✊ retweeted
5.10-6.18 Linux Kernel
漏洞提权root，可自行测试
Github仓库：github.com/mitschud/DirtyFra…
提前安装好KernelSU
We are back today for round 3! We proved out and chained a number of theoretical primitives, drawing from excellent community work, to eventually load our own VM inside pokemon red. The subject matter is quite complex so I also produced a full blogpost linked 👇
As you will see this post is a bit special. Increasingly we need the grapple with making model research legible to humans (as in mathematics) so this was an excellent opportunity to tune my style guide and have models do the reporting themselves.
knifecoat.com/Posts/Pok%C3%A…
Models can compress work to an extreme degree. This is especially relevant in highly complex domains where equivalent efforts may take humans hundreds of hours. Of course we want (and need) to leverage this but we risk outputs becoming hard to understand, inspect and verify. These outputs also need to return value back to the human or there is a danger of being put out of the loop. The blogpost is an attempt to work on legibility, this is an ongoing effort, and to give value back to such a rich technical community 🫶
b33f | 🇺🇦✊ retweeted
Sanctions relief will continue. I think the diesel deal and the move regarding the Lindsey Graham Act are not the end of it. Unfortunately.
It’s unfortunate because we all had great respect for Lindsey. He devoted his life to America. We had an excellent relationship with him. And shortly before the tragedy, Lindsey was in Ukraine. He always supported us very strongly and pushed for as much assistance to Ukraine as possible.
It’s difficult without him, I’ll be honest. I want to thank both Democrats and Republicans who supported his bill. That was a major victory: this truly bipartisan support. And now, the decision to undo all of this, to block all of it, seems wrong to me. And it definitely helps only the Russians. It only fuels their satisfaction and their desire to keep killing people. This certainly does not stop the war.
From answers to journalists’ questions. (1/3)
b33f | 🇺🇦✊ retweeted
AI-assisted research is killing embargoes. Coordinated disclosure will never be the same.
The industry used to have the luxury of testing or sitting on a fix for months. Not anymore. When everyone's using the same tools and the same intelligence to find vulnerabilities, you're not the only one finding that bug.
Product security and PSIRT need a serious rethink: less gatekeeping, more proactive evaluation of security posture, and shipping fixes continuously at scale.
The biggest impact will be in firmware and hardware, where disclosure timelines have historically stretched past 12 months. That mindset is a leftover from outdated processes and slow testing and bring-up environments.
b33f | 🇺🇦✊ retweeted
Latest: Zelenskyy tells reporters over WhatsApp that restrictions on Ukraine's Starlink systems remain. Interceptor drones can't function, logistics and operations hobbled. The maximum speed is 161 kph; "exceeding this limit causes the Starlink connection to cut out completely, resulting in the loss of the drone."
He says Ukraine has done tests to determine whether SpaceX is truly facing technical issues, as has been told Kyiv by the US side, or if this is a "deliberate operation... to restrict us, cut us off, and prevent us from defending ourselves and protecting our people, both at the front and among the civilian population."
He says Ukraine "sent a couple of vehicles equipped with Starlink terminals into European Union territory."
"They moved at speeds exceeding 180kph, and the Starlink systems worked perfectly. We have the relevant logs and evidence to prove this."
He adds: "The conclusion is clear: the restrictions are in effect within Ukraine but do not apply within the European Union. In other words, this is a planned operation."
b33f | 🇺🇦✊ retweeted
Parcel Security in Android: From Mismatch to Use-After-Free by Yang Kudurshian and John Wu (@topjohnwu)
b33f | 🇺🇦✊ retweeted
This! Sigh.. I just “thought leading” 😅 yesterday, vendors treating 0days as a commodity is really not a good look. Seriously I have no idea why Google would do this, after all this is a company printing huge money and Chrome is one of its core assets..
We just received a $000,000 Chrome Full Chain bonus! 💀
We submitted a new Chrome full chain, only to be told that all the full-chain bonuses had just been awarded, so our submission wasn't eligible for a reward. 😭
