Two lucky winners scooped $200k for just 20 minutes' work - if you don't count the days, weeks and months of meticulous effort beforehand
Read moreExploiting Spectre Over the Internet
March 18 2021
Google has demonstrated exploiting the Spectre CPU attack remotely over the web:
Today, we’re sharing proof-of-concept (PoC) code that confirms the practicality of Spectre exploits against JavaScript engines....
Read more
Chinese Hackers Stole an NSA Windows Exploit in 2014
March 4 2021
Check Point has evidence that (probably government affiliated) Chinese hackers stole and cloned an NSA Windows hacking tool years before (probably government affiliated) Russian hackers stole and then...
Read moreOn Vulnerability-Adjacent Vulnerabilities
February 15 2021
At the virtual Enigma Conference, Google’s Project Zero’s Maggie Stone gave a talk about zero-day exploits in the wild. In it, she talked about how often vendors...
Read moreSophisticated Watering Hole Attack
January 20 2021
Google’s Project Zero has exposed a sophisticated watering-hole attack targeting both Windows and Android:
Some of the exploits were zero-days, meaning they targeted vulnerabilities that at the time were...
Read more
Impressive iPhone Exploit
December 2 2020
This is a scarily impressive vulnerability:
Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave...
Read more
New Windows Zero-Day
November 2 2020
Google’s Project Zero has discovered and published a buffer overflow vulnerability in the Windows Kernel Cryptography Driver. The exploit doesn’t affect the cryptography, but allows attackers to escalate...
Read moreFacebook Helped Develop a Tails Exploit
June 12 2020This is a weird story: Hernandez was able to evade capture for so long because he used Tails, a version of Linux designed for users at high risk of...
Read moreAnother Intel Speculative Execution Vulnerability
June 11 2020Remember Spectre and Meltdown? Back in early 2018, I wrote: Spectre and Meltdown are pretty catastrophic vulnerabilities, but they only affect the confidentiality of data. Now that they --...
Read moreOvercoming address space layout randomization (ASLR) is a precondition of virtually all modern memory corruption vulnerabilities. Breaking ASLR is an area of active research and can ...
Read more
Recent Comments