Research

293 readers
1 users here now

/r/netsec's branch in the fediverse.

A community-curated aggregator of technical research. Our mission is to extract signal from the noise.

Only post technical content here. New tools (and major releases of existing ones), novel techniques, deep dives and post mortems are the ideal content. CTF and bug bounty writeups could be acceptable if they showcase lesser known approaches or techniques.

Non-technical content (both beginner and CISO level) will be considered spam.

founded 1 year ago
MODERATORS
execveat@infosec.pub
listing: all - local
1
1
What's your side project of a month? (infosec.pub)
submitted 1 year ago by execveat@infosec.pub to c/research@infosec.pub
0 comments fedilink
 
 

If you're working on a research or side project, this is your platform to share your findings, roadblocks, breakthroughs, and more. Doesn't matter if it's still a work in progress or has been recently published - all stages of research are welcome.

Maybe you're not actively researching, but you're closely following an interesting development in the industry or a certain researcher's work - feel free to share that here too!

Or perhaps, you've got an idea for a project or research you wish to undertake, but need resources, collaborators, or simply some guidance - let the community know.

Here's a simple guideline to kickstart the conversation:

  • What's the research about? (Give a brief overview of the project or topic)
  • Current progress/Findings (If applicable)
  • Challenges and roadblocks (What issues are you facing or expect to face?)
  • Help needed (Are you looking for collaborators, resources, advice, etc.?)
2
3
Research Guides: Primary Sources: A Research Guide: Open Access (umb.libguides.com)
submitted 2 months ago by alphanerd4@lemmy.world to c/research@infosec.pub
0 comments fedilink
3
2
Q2'23 ThinkstScapes Infosec research review (s3.eu-west-1.amazonaws.com)
submitted 1 year ago by ranok@sopuli.xyz to c/research@infosec.pub
0 comments fedilink
4
1
RowPress: Amplifying Read Disturbance in Modern DRAM Chips (people.inf.ethz.ch)
submitted 1 year ago by himazawa@infosec.pub to c/research@infosec.pub
0 comments fedilink
5
1
WWDC23: Passkeys (blog.millerti.me)
submitted 1 year ago by execveat@infosec.pub to c/research@infosec.pub
0 comments fedilink
6
1
BChecks (SDL for defining custom scans) available in Burp 2023.6 (portswigger.net)
submitted 1 year ago by execveat@infosec.pub to c/research@infosec.pub
0 comments fedilink
 
 

It's like nuclei templates I guess, but built into Burp. Only available in the Early Adopter release for now.

7
1
Every Signature is Broken: On the Insecurity of Microsoft Office’s OOXML Signatures (www.usenix.org)
submitted 1 year ago by execveat@infosec.pub to c/research@infosec.pub
0 comments fedilink
 
 

OOXML signatures are rendered pretty much useless due to 3 flaws in specification and 2 flaws in implementation.

"The vulnerabilities have been acknowledged by Microsoft. However, Microsoft has decided that the vulnerabilities do not require immediate attention."

8
1
CS:GO: From Zero to 0-day (neodyme.io)
submitted 1 year ago by execveat@infosec.pub to c/research@infosec.pub
0 comments fedilink
 
 

They've chained 4 logic bugs to achieve RCE in CS:GO, pretty impressive. Valve sucks at communication and bug bounty payouts though.

9
1
Side projects for May/June 2023 (🔒podcast) (video.infosec.exchange)
submitted 1 year ago by mjh@infosec.pub to c/research@infosec.pub
0 comments fedilink
 
 

h/t @NeonPayload@infosec.pub for the video.

My slipping goal for the past month has been the continued production of a weekly podcast. Nothing long, short form that could be listened to on a train or in the car.

The challenge I'm facing head on is how to make it unique. Sure, I can do NPR reading the news but who cares and who is that, what is my target audience. My simple solution so far is to go back and try to find a style and content that people can't get from a dozen different sources on their phone already.

Ideas and recommendations appreciated.