Sign in

jduck

@jduck.me
725 followers 246 following 50 posts

Continuously learning about computer security through research and development.

PostsRepliesMedia
Reposted by jduck
waffle .-. @waffle.pet · 26/12/2025
btw me and my friend are still looking for CCC tickets, if you happen to be willing to sell them please message me!! .-. #39c3
068
jduck @jduck.me · 14/07/2025
It's official. No hacker summer for me due to family health complications. I will miss everyone but hope you have a great (and safe) time!! ❤️
030
Reposted by jduck
Zion Leonahenahe Basque @mahal0z.bsky.social · 25/04/2025
I'm proud to announce that myself and @AtipriyaBajaj have created the Workshop on Software Understanding and Reverse Engineering (SURE), which will be co-located at CCS 2025. sure-workshop.org/ Please follow our workshop account @sureworkshop and RT it for visibility :).
sure-workshop.org
SURE 2025 | The Workshop on Software Understanding and Reverse Engineering
The Workshop on Software Understanding and Reverse Engineering
176
Reposted by jduck
Binary Ninja @binary.ninja · 23/04/2025
We're proud to announce the release of Binary Ninja 5.0. Here's some highlights: Union Support, Dyld Share Cache & Kernel Cache, Firmware Ninja, Auto Stack Arrays, Stack Structure Type Propagation, and so much more. Check out the blog post for more information: binary.ninja/2025/04/23/5...
02515
Reposted by jduck
Steve Klabnik @steveklabnik.com · 23/04/2025
Does using #rustlang really make your software safer? tweedegolf.nl/en/blog/152/...
tweedegolf.nl
Does using Rust really make your software safer? - Blog - Tweede golf
We keep saying that Rust is how we make software safer. In this blog, we'll tackle a real-world vulnerability, 'rewrite it in Rust', and show you the results of our empirical research, both as a h ...
15317
jduck @jduck.me · 22/04/2025
I'm proud to announce that I, through my company @magnetitesec.bsky.social, donated to the Redox OS project! If you're not familiar, Redox OS is a pure Rust Micro kernel based operating system. This donation allows them to sponsor one additional student for their Summer of Code!
082
jduck @jduck.me · 15/04/2025
I played @defcon.bsky.social CTF quals with @shellphish.bsky.social this year! I'm really impressed with the difficulty levels Nautilus Institute put forth. Making CTF challenges in the AI era has... special considerations... but they nailed it :-) Thanks to everyone involved for a great weekend!
050
Reposted by jduck
Quarkslab @quarkslab.bsky.social · 08/04/2025
There is a small bug in the signature verification of OTA packages in the Android Open Source Framework. Official builds doing normal double verification of packages are not vulnerable but OEMs and third party apps may be. Jérémy Jourdois explains it here: blog.quarkslab.com/aosp_ota_sig...
blog.quarkslab.com
A small bug in the signature verification of AOSP OTA packages
A signature verification bypass in a function that verifies the integrity of ZIP archives in the AOSP framework
045
Reposted by jduck
Elias 🦀🇵🇸🇻🇪🇧🇷 @elias.sh · 05/04/2025
"Building a Linux Kernel Driver using Rust": rust-exercises.ferrous-systems.com/latest/book/...
rust-exercises.ferrous-systems.com
Building a Linux Kernel Driver using Rust - Rust Exercises
0429
Reposted by jduck
BSides Canberra @bsidescbr.bsky.social · 31/03/2025
Our Call for Presentations & Events is now open! Got cool research, a fresh exploit, or a unique cybersec insight? Submit your talk & be part of Australia’s biggest hacker con! cfp.bsidescbr.com.au/bsides-canbe...
cfp.bsidescbr.com.au
BSides Canberra 2025
Schedule, talks and talk submissions for BSides Canberra 2025
023
Reposted by jduck
Steve Klabnik @steveklabnik.com · 31/03/2025
github.com/ariel-os/ari... /via @mattkeeter.com #rustlang
github.com
GitHub - ariel-os/ariel-os: Ariel OS is a library operating system for secure, memory-safe, low-power Internet of Things, written in Rust
Ariel OS is a library operating system for secure, memory-safe, low-power Internet of Things, written in Rust - ariel-os/ariel-os
1454
Reposted by jduck
Phrack Zine @phrack.org · 24/03/2025
Don't forget, the CFP for the 40th anniversary issue of Phrack is open until June 15th 2025. You can be someone's favorite article in the future!! bsky.app/profile/phra...
0710
Reposted by jduck
stacksmashing @stacksmashing.bsky.social · 29/03/2025
Having some fun with EM measurements today - side-channels are awesome!
1424
Reposted by jduck
Paged Out! @pagedout.bsky.social · 29/03/2025
Paged Out! #6 has arrived! And it's jam-packed with content! You can download it here: pagedout.institute?page=issues....
02227
Reposted by jduck
AHA! @austinhackers.takeonme.org · 27/03/2025
Tonight. AHA 0xDE. If it is your first time attending, you will give an “intro talk”. This is an opportunity to share about yourself and allow us to get to know you. This is an important part of the new attendee process. Please take it seriously. If you’ve given an intro talk before, but have […]
infosec.exchange
Original post on infosec.exchange
022
jduck @jduck.me · 25/03/2025
Happy to share my slides from BOOTSTRAP25. Unfortunately the bug discussed is still not patched in Linux 6.14.0 despite it being reported explicitly. Slides are in markdown but there's a PDF in "releases" too github.com/jduck/bs25-s...
github.com
GitHub - jduck/bs25-slides: Slides from "Musing from Decades of Linux Kernel Security Research" at BOOTSTRAP25
Slides from "Musing from Decades of Linux Kernel Security Research" at BOOTSTRAP25 - jduck/bs25-slides
1147
Reposted by jduck
Andrew Case @attrc.bsky.social · 20/03/2025
The sedexp Linux malware was disclosed in late 2024. In my talk at @kernelcon.bsky.social, I will present my own deep dive of the malware, including many parts that have not been made public, such as loading of a memory-only rootkit. Be sure to attend for a teardown with @volatilityfoundation.org 3!
0127
jduck @jduck.me · 08/03/2025
Has anyone else seen m.imdb.com/title/tt0218... ? Eerie
m.imdb.com
Antitrust (2001) ⭐ 6.1 | Action, Crime, Drama
1h 48m | PG-13
120
jduck @jduck.me · 04/03/2025
Last week I attended Vector35 @re-verse.io RE//verse conference and it was great! Excellent food, high signal to noise (RE/VR), and great people. I scored some amazing schwag including a SIM transposer and a @binaryninja.bsky.social hacky sack! w00t!
0110
Reposted by jduck
Andrew Case @attrc.bsky.social · 03/03/2025
On March 29th, I will be speaking at @bsidessd.bsky.social on Volatility 3, including all its new features and plugins. Be sure to attend to catch a sneak peak at the new framework before the major release later this Spring! www.bsidessd.org #DFIR #infosec
087
Reposted by jduck
Aleks @fuzzyaleks.bsky.social · 26/02/2025
Digital vs film X-ray . Film offers higher resolution and better dynamic range with the same settings, but slightly longer exposure time (and more tedious image acquisition). Comes in handy when it comes to tiny electronics. Images of an Abbott Lingo continuous glucose monitor.
021
Reposted by jduck
pinkflawd.bsky.social @pinkflawd.bsky.social · 19/02/2025
BlackHoodie will be back at @ringzer0.bsky.social Bootstrap conference in Austin, TX 🤠 On Friday March 21st I'll be teaching Compiler Internals for Security Engineers, a class for women by women, and it's free. Register here blackhoodie.re/Ringzer0_Boo...
blackhoodie.re
Blackhoodie at Ringzer0 Bootstrap 2025
Compiler Internals for Security Engineers
0711
Reposted by jduck
Tweede golf @tweedegolf.bsky.social · 19/02/2025
Tamme is giving a talk at Embedded World 2025! He shows how Rust’s type system and package manager can help to improve development speed and code quality. Also visit us at our booth, or book a time slot for a private chat: buff.ly/4308AWE  @diondokter.nl #ew25 #embeddedworld #rustlang
083
Reposted by jduck
Gábor Nyéki @gabornyeki.com · 19/02/2025
Greg KH is a voice of reason downthread: lore.kernel.org/rust-for-lin...
lore.kernel.org
Re: Rust kernel policy - Greg KH
39013
jduck @jduck.me · 18/02/2025
I'm giving a talk at BOOTSTRAP25 in Austin! Hope to see y'all there! ringzer0.training/bootstrap25-...
ringzer0.training
TALK: Musing from Decades of Linux Kernel Security Research // Joshua J. Drake
The Linux Kernel powers billions of devices across industries, making it critical infrastructure. But is it secure? Josh explores this by comparing its security investments to a typical SDLC, sharing ...
0103
Reposted by jduck
James Munns @jamesmunns.com · 13/02/2025
It is EXTREMELY cool to me that: * Use of Rust on Embedded platforms is such a high percentage of the ecosystem (16.8% bare metal, 12.9% with an OS) * The usage is increasing year over year Check out the survey results! blog.rust-lang.org/2025/02/13/2...
Bar graph of "Which operating systems or runtimes do you develop Rust software for".
2537
jduck @jduck.me · 06/02/2025
NanoKVM is sketchy. youtu.be/plJGZQ35Q6I
youtu.be
NanoKVM: The S stands for Security
YouTube video by apalrd's adventures
030
jduck @jduck.me · 01/02/2025
First episode is up! youtu.be/7IHKRzGQeog via @rkl.bsky.social
youtu.be
Episode 1: Digital Jesus aka Matt Harrigan
YouTube video by Where Warlocks Stay Up Late
021
Reposted by jduck
James Munns @jamesmunns.com · 23/01/2025
I'm trying to think of a good way to flex Poststation as a demo for the embedded world booth. Does anyone have ideas of fun, interactive, and maybe mind bending things to have 8-16 independent MCUs do? I plan to fit it all into a eurorack case, as individual cards/modules.
231
Reposted by jduck
Julius Gustavsson @jgust.xyz · 23/01/2025
I did the podcast thing! It was great fun chatting with Matthias Endler on his “Rust in Production” podcast. We talked about our little Rust based ECU at Volvo Cars and how it came about. Check it out: corrode.dev/podcast/s03e...
corrode.dev
Volvo with Julius Gustavsson - Rust in Production Podcast | corrode Rust Consulting
The car industry is not known for its rapid adoption of new technologies. Therefore, it’s even more exciting to see a company like Volvo Cars embracing Rust for core components of their software stack...
24210
Reposted by jduck
Xeno Kovah @xenokovah.bsky.social · 13/01/2025
I’ve published CLUES (Custom Lightweight UUID Exchange Schema) and my current data about Bluetooth custom UUIDs to its own repository so that it can easily be incorporated as a git submodule in other research projects. github.com/darkmentorllc/CLUES_Sche…
github.com
GitHub - darkmentorllc/CLUES_Schema: Custom Lightweight UUID Exchange Schema (CLUES!)
Custom Lightweight UUID Exchange Schema (CLUES!). Contribute to darkmentorllc/CLUES_Schema development by creating an account on GitHub.
011
Reposted by jduck
Xeno Kovah @xenokovah.bsky.social · 13/01/2025
I’ve published BTIDES (BlueTooth Information Data Exchange Schema) to its own repository so that it can easily be incorporated as a git submodule in other research projects. I have started using this for crowdsourced BT info sharing. github.com/darkmentorllc/BTIDES_Sch…
github.com
GitHub - darkmentorllc/BTIDES_Schema: BlueTooth Information Data Exchange Schema (BTIDES!)
BlueTooth Information Data Exchange Schema (BTIDES!) - darkmentorllc/BTIDES_Schema
001
jduck @jduck.me · 13/01/2025
Worst Fit by @orange.tw. Nasty stuff. blog.orange.tw/posts/2025-0...
blog.orange.tw
WorstFit: Unveiling Hidden Transformers in Windows ANSI!
📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help
032
Reposted by jduck
The Rusty Bits @therustybits.com · 10/01/2025
In this one we learn about using embassy to do embedded development with async Rust: youtu.be/pDd5mXBF4tY
youtu.be
Intro to Embassy : embedded development with async Rust
YouTube video by The Rusty Bits
14217
jduck @jduck.me · 08/01/2025
@thejpster.org.uk You don't follow so I can't message but I hear the PR is coming next week
000
Reposted by jduck
Łukasz @maldr0id.bsky.social · 03/01/2025
If you haven't seen the Honey tech drama you absolutely have to, it's awesome! youtu.be/vc4yL3YTwWk
youtu.be
Exposing the Honey Influencer Scam
YouTube video by MegaLag
2204
jduck @jduck.me · 03/01/2025
Why do vendors claim reliable and secure and then have vulns like this?? Let me guess, ping again?? www.moxa.com/en/support/p...
moxa.com
Privilege Escalation and OS Command Injection Vulnerabilities
320
Reposted by jduck
Jonathan Pallant @thejpster.org.uk · 03/01/2025
Why is there no tech/hacker news coverage on Aedan Cullen‘s amazing RP2350 OTP glitch work? It’s weird. Here’s the GitHub: github.com/aedancullen/...
github.com
GitHub - aedancullen/hacking-the-rp2350: Resources from my talk "Hacking the RP2350" at 38C3
Resources from my talk "Hacking the RP2350" at 38C3 - aedancullen/hacking-the-rp2350
4256
jduck @jduck.me · 28/12/2024
Oh! @raspberrypi.com RP2350 gotcha detailed at CCC. Does he win the prize?? events.ccc.de/congress/202...
events.ccc.de
38c3: Hacking the RP2350
The RP2350 security architecture involves several interconnected mechanisms which together provide authentication of code running on the chip, protected one-time-programmable storage, fine-grained con...
041
jduck @jduck.me · 19/12/2024
Today I used a vinyl sticker from a conference in the place of heatshrink or electrical tape. Gotta do what you gotta do. Can't have this stuff shorting out!
030
jduck @jduck.me · 17/12/2024
I just disabled Android "Quick phrases" for my alarm clock app after realizing it's causing alarms to be ineffective. Who came up with this feature??? Why is it on by default?? Ensh**tification much?? Is there a class action suit I can join??
010
Reposted by jduck
Björkus "No time_t to Die" Dorkus @thephd.dev · 06/11/2024
📢 It's time for you to MAKE YOUR VOICE HEARD 🗣️ ... ... In the C Survey for the Name of a new Operator!! This one, being something a LOT of you are familiar with! Read up, let us know, and SPREAD THE WORD: thephd.dev/the-big-arra...
thephd.dev
The Big Array Size Survey for C
New in C2y is an operator that does something people have been asking us for, for decades:
76326
Reposted by jduck
Andy Greenberg @agreenberg.bsky.social · 16/12/2024
Digital license plates, legal to buy in some states and drive with nationwide, can be jailbroken. Hackers can install new firmware in minutes, then change plate numbers via a Bluetooth app to evade surveillance, tolls and tickets—or make someone else pay. www.wired.com/story/digita...
wired.com
Hackers Can Jailbreak Digital License Plates to Make Others Pay Their Tolls and Tickets
Digital license plates sold by Reviver, already legal to buy in some states and drive with nationwide, can be hacked by their owners to evade traffic regulations or even law enforcement surveillance.
38536
jduck @jduck.me · 14/12/2024
I'm looking forward to that conference badge with CHERI architecture... When is it coming? Hehe
020
Reposted by jduck
Mike Bell @rebelmike.bsky.social · 12/12/2024
Picking up from last week's thread on overclocking the #RP2350, I'm going to be pushing this Pico 2 further tonight. To start with, I'm doing a run of tests at 576MHz and 1.7V, to see how much difference the cooling has made.
4529
jduck @jduck.me · 12/12/2024
If you're looking for a good time programming, I recommend #adventofcode Day 6. Part 2 took me 4 tries to get a correct and performant solution.
0110
Reposted by jduck
BSides Canberra @bsidescbr.bsky.social · 04/12/2024
Boot security in the MCU, Daniel & Zoltan Madarassy - BSides Canberra 2024 youtu.be/LXdSVcvhJuI?... #BSidesCbr2024
youtu.be
Boot security in the MCU, Daniel & Zoltan Madarassy - BSides Canberra 2024
YouTube video by BSides Canberra
067
jduck @jduck.me · 10/12/2024
Is this expected behavior in Go?? I'm seeing the original array get modified by just creating slices from it. pastecry.pt/MMo4dp#Uk_Ha... Output: pastecry.pt/Y1eZuS#Uf7Ge... #AdventOfCode
pastecry.pt
PasteCry.pt: A secure pasting solution offering client-side encryption.
Pastecry.pt provides a pasting solution to allow users to paste content securely. We provide a client-side encryption and never handle the un-encrypted data or keys outside of your machine assuring th...
110
Reposted by jduck
Seth Abramson @sethabramson.bsky.social · 07/12/2024
13603849114285
Reposted by jduck
Catalin Cimpanu @campuscodi.risky.biz · 08/12/2024
Positive Technologies has developed a new attack that exploits the SD Express standard to gain access to a device's memory through its SD card reader The DaMAgeCard attack exploits the fact that the new SD Express standard can operate in both SDIO and NVMe swarm.ptsecurity.com/new-dog-old-...
45924