miniblog.

← Back to all posts
Jan 9, 2022 at 08:17
The effectiveness of fuzzing, the limitations of current research, your best options today, and a worked example:
Tiemoko Ballo

Related Posts

Oct 28, 2024 at 02:58
I'd heard the conventional wisdom that UX research states that mice are more efficient than keyboards, but turns out there's virtually no research on this!
The widely cited studies on mouse vs. keyboard efficiency are completely bogus
Oct 22, 2024 at 07:10
Whilst LLMs don't always give an accurate answer, the UI is really compelling. I keep finding users whose favourite way of doing research is an LLM.
Jun 8, 2024 at 02:48
It is remarkably hard to escape command line arguments safely on Windows, and the standard libraries of multiple languages have needed patching:
BatBadBut: You can't securely execute commands on Windows
BatBadBut: You can't securely execute commands on Windows
Introduction Hello, I’m RyotaK ( @ryotkak ), a security engineer at Flatt Security Inc. Recently, I reported multiple vulnerabilities to several programming languages that allowed an attacker to perform command injection on Windows when the specific conditions were satisfied. Today, affected vendors published advisories of these vulnerabilities , so I’m documenting the details here to provide more information about the vulnerabilities and minimize the confusion regarding the high CVSS score. TL;DR The BatBadBut is a vulnerability that allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.