I've spent the last 7 years as chief architect, which realistically meant doing every job from infrastructure to product and occasionally acting CTO.
I am interested in everything, and curious to try new things.
I've spent the last 7 years as chief architect, which realistically meant doing every job from infrastructure to product and occasionally acting CTO.
I am interested in everything, and curious to try new things.
arxiv.org/abs/2411.16844
arxiv.org/abs/2411.16844
But in my corner it just still feels empty. Where are you all?
But in my corner it just still feels empty. Where are you all?
The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system().
It's RCE, not auth bypass, and gated/unreplayable.
Looks like this got caught by chance. Wonder how long it would have taken otherwise.
www.openwall.com/lists/oss-se...
It has everything: malicious upstream, masterful obfuscation, detection due to performance degradation, inclusion in OpenSSH via distro patches for systemd support…
Now I’m curious what it does in RSA_public_decrypt
The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system().
It's RCE, not auth bypass, and gated/unreplayable.
a-mnesia (not am-nesia)
what else?
a-mnesia (not am-nesia)
what else?