26 - Return of the Zombieload, Bezos Hacked, and other exploits

28 January 2020

Show Notes

26 - Return of the Zombieload, Bezos Hacked, and other exploits

Pwn2Own Miami 2020

Allegations that Saudi Crown Prince involved in hacking of Jeff Bezos’ phone

Additional Links: https://twitter.com/dinodaizovi/status/1221324029841244161

Chris Rohlf on Twitter: "...Mobile security was largely a success relative to the state of the desktop..."

More MDS Attacks: Intel Patching its Patch of the Patch for MDS/ZombieLoad Attacks

Additional Links: https://blogs.intel.com/technology/2020/01/ipas-intel-sa-00329/#gs.upv68b

MDHex Vulnerabilities

JSSE Client Authentication Bypass (CVE-2020-2655)

Local Privilege Escalation in many Ricoh Printer Drivers for Windows (CVE-2019-19363)

ModSecurity Denial of Service (CVE-2019-19886)

GGvulnz - How I hacked hundreds of companies through Google Groups

Neowise CarbonFTP v1.4 / Insecure Proprietary Password Encryption (CVE-2020-6857)

arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess fault - Patchwork

Cisco Webex Meetings Suite and Cisco Webex Meetings Online Unauthenticated Meeting Join Vulnerability (CVE-2020-3142)

iGPU Leak: An Information Leakage Vulnerability on Intel Integrated GPU (CVE-2019-14615)

Additional Links: https://github.com/HE-Wenjian/iGPU-Leak/blob/master/iGPU-Leak_Slides.pdf

Information Leaks via Safari's Intelligent Tracking Prevention

GhostImage: Perception Domain Attacks against Vision-based Object Classification Systems

Nightmare - A collection of binary exploitation / reverse engineering challenges and writeups

The Life of a Bad Security Fix

macOS/iOS: ImageIO: heap corruption when processing malformed TIFF image