24 March 2020 Show Notes 34 - Pwn2Own Results, Voatz (again), some web-exploits and a code-reuse mitigation 00:00:28 Learn Exploit Development While Not Dying 00:02:18 Exploit Education 00:07:40 Pwn2Own Results Additional Links: https://www.zerodayinitiative.com/blog/2020/3/19/pwn2own-2020-day-one-results 00:16:27 DEF CON CTF 2020 QUALS COVID-19 DELAY 00:22:38 Software Engineer - Jobs at Apple 00:31:04 Tesla Model 3 Denial of Service Vulnerability [CVE-2020-10558] 00:36:34 Trail of Bits - Voatz Security Review 01:01:57 XXE-scape through the front door: circumventing the firewall with HTTP request smuggling 01:08:20 Don't Clone That Repo: Visual Studio Code^2 Execution Additional Links: https://github.com/doyensec/VSCode_PoC_Oct2019/ https://github.com/doyensec/VSCode_PoC_Oct2019/blob/master/.vscode/settings.json https://github.com/doyensec/VSCode_PoC_Oct2019/commit/19b4687259bd5d1821525a3ebbe6aa76618359c3#diff-62b00de1d62bb867ef03dec7057712f1R50 01:14:30 [Hacker101] Race Condition leads to undeletable group member 01:20:06 JavaScript without parentheses using DOMMatrix Additional Links: https://portswigger.net/web-security/cross-site-scripting/contexts/lab-javascript-url-some-characters-blocked 01:24:29 Hurdle: Securing Jump Instructions Against Code Reuse Attacks Additional Links: https://www.youtube.com/watch?v=qFWTZ2zZ1XQ http://se.ri0.us/2020-03-23-110829182-9e1b1.png
