@ionescu
Windows Internals Author, Developer, Reverse Engineer, Security Researcher, Speaker, Trainer, and most recently Nation State Hacker. Core OS Platform Developer at Apple, Hyper-V Vendor at Microsoft, Chief Architect at CrowdStrike and now Director at CSE.
Why North Korea Is Planning a Second Korean War and How to Stop It
My deep-dive with @andreilankov and @DrRadchenko into North Korean regime, foreign policy, daily life, surveillance state, hackers and much more!
youtu.be/hqTbLkdysBo
www.gofundme.com/f/support-ma...
CJ is an old friend and a longtime cDc NSF member. He suffered a fall and broke his neck -- his insurance refused to pay for an MRI, which led to the break going undiagnosed for a couple of weeks, until his vertebrae had degraded to the point of quadriplegia.
The One Factor That Could Crash the Russian Economy
A new Geopolitics Decanted episode with a deep-dive into the Russian economy and how it's faring in 2025 and what leverage Ukraine might get to negotiate an acceptable peace deal with Putin
www.youtube.com/watch?v=VOYl...
This was a phenomenal breakdown of some novel Linux malware techniques.
www.elastic.co/secur...
Positive Technologies has developed a new attack that exploits the SD Express standard to gain access to a device's memory through its SD card reader
The DaMAgeCard attack exploits the fact that the new SD Express standard can operate in both SDIO and NVMe
swarm.ptsecurity.com/new-dog-old-...
ost2.fyi/Sponsorship....
Gold Sponsors & Windows Security Track sponsor Winsider Seminars & Solutions (@yardenshafir.bsky.social & @ionescu.bsky.social)
π
Long time coming and a cast of hundreds (and a very deep tech stack) but CONGRATS to the team - it's the FIRST ARM64 for Windows build of Git!
There is glory in the unexpressed thought.
www.whitehouse.gov/briefing-roo...
Now I kind of want to write an mIRC plugin
I have a legitimate question β given the incredible progress made by Windows on ARM64, it baffles the mind that this is running on an Intel SoC. Especially if itβs meant to be cheap and sustainable. Seriously β why?
As far as intelligence scandals come, and whatβs comingβ¦ Iβd take this scandal over any other, any time.
I think itβs « Mahalo, ΡΠΎΠ²Π°ΡΠΈΡΒ Β»
This awesome fuzzing blog post by @r00tkitsmm.bsky.social covers a super reliable macOS kernel binary rewriting to instrument any KEXT or XNU at BB or edge level. Mandatory reading for anyone interested in fuzzing whether you use MacOS or not. So many good system internals and fuzzing references!
Brought back memories π₯²
LSASS now runs as PPL by default, and that DLL doesnβt have the appropriate signature. Unless youβre relying on Bonjour for AD auth youβre probably fine. Microsoft launched LSA PPL signing for 3rd parties back in Windows 8.1 in 2013: learn.microsoft.com/en-us/window...
Itβs only been 11 years ;-)
Very excited to finally see this live! An incredible shift in cloud computing.
alright folks, the app code is now public
https://github.com/bluesky-social/social-app
I own tools.zip and am trying to figure out what I should serve
Normally I would use a kernel debugger to look at the wait block and see what object itβs attached to. Is there an ETW event that might log that?
User Mode β into some sort of Ring 3 (non-kernel) service
Iβm guessing this is an EDR or similar product thatβs calling into UM for a responseβ¦
So first MSI has been found to ship their Secure Boot policy in βAlwaysExecuteβ mode on 300+ motherboards, and now they had their BootGuard private key leaked from their source repo (WHY is in their repo? π€¦π»ββοΈπ€¦π»ββοΈπ€¦π»ββοΈ).
Between this and the DBX running out of space, UEFI firmware security needs a reboot.
Windows now has VBS/TPM protected token binding and you can finally now store private keys in hardware and make them truly non-exportable even by a privileged kernel attacker.
Great stuff from Dwizzzle: https://gist.github.com/dwizzzle/a1c4cf4b669053dbeda4a4b24a9aca0f
@ washingtonpost dot com you read that right
Probably one of the best pieces of reporting on the Solarwinds supply-chain attack. Excellent piece by Kim Zetter.
Highly recommended reading.
Thereβs still a UI bug, when writing a draft the blue button to save the draft still says βReplyβ π
Shitposting about other peopleβs security products/detection logic is the natural evolution/side trip of this.
Binge-watched BEEF last night on Netflix and everything from the soundtrack to the experience of being a first generation millennial immigrant from a similar cultural background was cathartic. I cried for hours. I can only imagine how much more this speaks to Asian Americans/Canadians.
0%