Session-ception and User Namespaces Strike Again

Day[0]

Content provided by dayzerosec. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by dayzerosec or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://podcastplayer.com/legal.

29d ago 49:36

MP3•Episode home

API hacking and bypassing Ubuntu's user namespace restrictions feature in this week's episode, as well as a bug in CimFS for Windows and revisiting the infamous NSO group WebP bug.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/279.html

[00:00:00] Introduction

[00:00:28] Next.js and the corrupt middleware: the authorizing artifact

[00:06:15] Pwning Millions of Smart Weighing Machines with API and Hardware Hacking

[00:20:37] oss-sec: Three bypasses of Ubuntu's unprivileged user namespace restrictions

[00:32:10] CimFS: Crashing in memory, Finding SYSTEM (Kernel Edition)

[00:43:18] Blasting Past Webp

[00:47:50] We hacked Google’s A.I Gemini and leaked its source code (at least some part)

Podcast episodes are available on the usual podcast platforms:

-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

-- Other audio platforms can be found at https://anchor.fm/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

281 episodes

#Tech #dayzerosec