The Curious Engineer

All blogs / Security

Security

scarybeastsecurity.blogspot.com

Hacking everything, by Chris Evans / scarybeasts

SecurityReverse engineeringRetro computing

’10’15’20’25
Posts
112 from 2 Feb 2008 to 17 May 2021
Posting
quiet since 2021
Kind
personal blog
Feed
https://scarybeastsecurity.blogspot.com/feeds/posts/default

2021 1

  1. Recovering "lost" treasure-filled floppy discs with an oscilloscope

2020 7

  1. The cleverest floppy disc protection ever? Western Security Ltd.
  2. Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA
  3. Turning a £400 BBC Micro (1981) into a $40,000 disc writer (1987)
  4. Weak bits floppy disc protection: an alternate origins story on 8-bit
  5. A wild bug: 1970s Intel 8271 disc chip ate my data!
  6. Sampled sound 1980s style: from SN76489 square waves to samples
  7. Clocking a 6502 to 15GHz (!)

2017 10

  1. Excited to join Dropbox!
  2. Introducing Qualys Project Zero?
  3. *bleed, more powerful: dumping Yahoo! authentication secrets with an out-of-bounds read
  4. *bleed continues: 18 byte file, $14k bounty, for leaking private Yahoo! Mail images
  5. Further hardening glibc malloc() against single byte overflows
  6. Are we doing memory corruption mitigations wrong?
  7. [0day] Proving Box.com fixed ASLR via ImageMagick uninitialized zlib stream buffer
  8. Proving missing ASLR on dropbox.com and box.com over the web for a $343 bounty :D
  9. Ode to the use-after-free: one vulnerable function, a thousand possibilities
  10. Black box discovery of memory corruption RCE on box.com

2016 7

  1. Redux: compromising Linux using... SNES Ricoh 5A22 processor opcodes?!
  2. [1days] [0days] [PoCs] More gstreamer FLIC / vmnc issues
  3. [1day] [PoC with $rip] Deterministic Linux heap grooming with huge allocations
  4. [0day] [PoC] Incorrect fix for gstreamer FLIC decoder vulnerability CESA-2016-0004
  5. [0day] [exploit] Advancing exploitation: a scriptless 0day exploit against Linux desktops
  6. [0day] [PoC] Risky design decisions in Google Chrome and Fedora desktop enable drive-by downloads
  7. [0day] [exploit] Compromising a Linux desktop using... 6502 processor opcodes on the NES?!

2015 1

  1. vsftpd-3.0.3 released... and the horrors of FTP over SSL

2014 5

  1. Exile for the BBC Micro; some elegant solutions
  2. Using ASAN as a protection
  3. Execute without read
  4. Together, we can make a difference
  5. Internet Bug Bounty issues its first $10,000 reward

2013 2

  1. vtable protections: fast and thorough?
  2. Exploiting 64-bit Linux like a boss

2012 9

  1. The joys and hazards of multi-process browser security
  2. Chrome 20 on Linux and Flash sandboxing
  3. vsftpd-3.0.0 and seccomp filter sandboxing is here!
  4. vsftpd-3.0.0-pre2
  5. vsftpd-3.0.0-pre1 and seccomp filter
  6. On the failings of Pwn2Own 2012
  7. Some random observations on Linux ASLR
  8. Chrome Linux 64-bit and Pepper Flash
  9. The dirty secret of browser security #1

2011 10

  1. Alert: vsftpd download backdoored
  2. libxml vulnerability and interesting integer issues
  3. Bug bounties vs. black (& grey) markets
  4. Fiddling with Chromium's new certificate pinning
  5. Multi-browser heap address leak in XSLT
  6. Busy Chrome day...
  7. Dangerous file write bug in Foxit PDF Reader
  8. I got accidental code execution via glibc?!
  9. Some less obvious benefits of HSTS
  10. A harmless SVG + XSLT curiousity

2010 11

  1. Minor leak, major headache
  2. IE8 CSS-based forced tweeting
  3. Internet Explorer considered harmful
  4. Firefox fixes CSS-based cross-origin theft issue
  5. Fixing responsible disclosure
  6. More money for critical Chromium security bugs!
  7. Open redirectors: some sanity
  8. vsftpd HTTP lunacy!
  9. Encouraging More Chromium Security Research
  10. Posting raw XML cross-domain
  11. "Logout XSRF" - significant web app bug?

2009 29

  1. Generic cross-browser cross-domain theft
  2. Bypassing the intent of blocking "third-party" cookies
  3. Cross-domain search timing
  4. vsftpd-2.2.2 released
  5. A new fuzz frontier: packet boundaries
  6. Chromium and Linux sandboxing
  7. vsftpd-2.2.1 released
  8. HITB Malaysia 2009 and sandboxing
  9. Patching ffmpeg into shape
  10. vsftpd-2.2.0 released
  11. Apple ColorSync heap overflow
  12. Beware the little pieces you use in your web app
  13. iPhone and Safari advisories
  14. vsftpd-2.2.0pre1 and network separation
  15. Clusterfuzzing
  16. Bonus Safari XXE (only affecting Safari 4 Beta)
  17. Apple's Safari 4 also fixes cross-domain XML theft
  18. Apple's Safari 4 fixes local file theft attack
  19. vsftpd-2.1.2 released and new security tricks
  20. A more plausible E4X attack
  21. HiTB Dubai: all over apart from the blogging
  22. Sun Java JRE Pack200 bugs
  23. LittleCMS exploit
  24. LittleCMS vulnerabilities
  25. Linux kernel minor "seccomp" vulnerability
  26. Linux kernel minor signal vulnerability
  27. vsftpd-2.1.0 and ptrace() sandboxing
  28. vsftpd-2.1.0 released
  29. Bypassing syscall filtering technologies on Linux x86_64

2008 20

  1. Opera, SVGs and Java applets
  2. Firefox cross-domain text theft....
  3. Cookie forcing
  4. Owning the paranoid: browser background traffic
  5. E4X and a Firefox XML injection bug
  6. Firefox cross-domain image theft... and the "302 redirect trick"
  7. PacSec presentation
  8. Some Python bugs
  9. Cross-domain leaks of site logins
  10. Ode to the bug that almost was
  11. A dangerous combination of browser features
  12. Buffer overflow in libxslt
  13. On FTP, SSL and broken interfaces
  14. Lame OpenOffice PCX crash
  15. Fancy an exploitation challenge?
  16. iPhone Safari update fixes old libxslt version
  17. Sun JDK image parsing vulnerabilities
  18. Buffer overflow in Ghostscript
  19. Your FTP / SSL solution is really secure, right?
  20. Sun JDK6 XXE protection broken