Project Space Whale: A Love Letter to the Browser Games and MMOs I Played on Ubuntu in 2005
TL;DR: Go play it, dawg.
friday@ortiz.sh:~$
The new original cyber dog. Linux, crypto(graphy), Machine Learning.
Latest posts
Who turned all this shit on? A Kernel Hardening Guide
tl;dr: I asked the nice robot to help me build a repo that categorizes kernel config options by risk and legitimate users, creating a hardening guide for things you should probably just disable.
Introducing 0xB33SM0K3R: The Ultimate eBPF Bypass Technique
TL;DR: Your eBPF tools are safe. This is tongue-in-cheek post about a general exploit technique applied to the eBPF subsystem, parodying clout chasing tweeters and overwrought corporate blogs. It could be useful for rootkits, but is not a vulnerability in and of itself.
Replicating an eBPF SDIV Oops
TL;DR: Signed division is hard and sometimes it makes the kernel sad.
Vulnerable eBPF CTF Challenge 01
A CTF style vulnerable box where you need to find and exploit a mistake in an eBPF program that allows privilege escalation to root.
Interactivity is the halting problem in a trench coat.
Or: please, please, stop piping curl into bash in prod.
Stop saying eBPF when you mean cBPF.
TL;DR: Let’s detect malware that uses BPF the right way. eBPF has become a hot topic, which leads to some hype whenever BPF is found in malware. The thing is, BPF malware is nothing new and most malware is using cBPF, not eBPF. Conflating cBPF with eBPF is harmful to defenders, who really need to understand the difference between the two when writing detections.
Never Stop Reading: Crashing the HaikuOS Port of Cave Story
TL;DR: Cave Story for HaikuOS go SEGV.
whoami, who am I? Thoughts on protecting digital and human identities.
TL;DR: What is identity security, why we often do it wrong, and how we can get it right.
BeeSTrING: Critical Vulnerability in BPF Subsystem Allows Fully Unauthenticated RCE as Root
TL;DR: Look at the publication date, I’m fucking with you.