Remote
Ovi
@0v1@infosec.exchange
security researcher
founder @barghest@infosec.exchange
{ disrupting APT, authoritarian gov, surveillance, privacy violations & corporate injustice }
i mostly dump my thoughts here
0
Followers
0
Following
15
Posts
Joined November 14, 2022
Website:
BARGHEST:
Posts
Replying to
@drwhax@infosec.exchange
@drwhax@infosec.exchange not my find, just patch diff and repo'd to pull bugreport data. would be curious if we see this in the wild
Replying to
@drwhax@infosec.exchange
@drwhax@infosec.exchange also CVE-2026-0160 affecting RTT (US mandated). Reachability is via RTT call.
The only thing good about fedcon was meeting friends and CTFs. Now it's just a meeting place!
Replying to
@CryogenicNighthawk@4d2.social
@CryogenicNighthawk@4d2.social there is no broadly reliable method satisfying all those constraints
Nearly FEDCON time.
Beautiful time for corpos and LE to get together and larp as hackers fighting the good fight.
Replying to
@tek@todon.eu
@tek@todon.eu hope this reaches other OEMs eventually. Pixel lock in is becoming unruly
Today we are disclosing CVE-2026-0073:
A critical no-interaction proximal/adjacent remote code execution vulnerability in adbd's ADB-over-TCP authentication path.
Full technical write-up + exploit flow:
https://barghest.asia/blog/cve-2026-0073-adb-tls-auth-bypass/
amongst bugs this year, i found two bugs in particular that LLMs are just totally failing at finding yet on the surface are super easy.
1 is a critical rce in android and also a high sev persistence chain with it. both resulted from manual code review, no fuzzing (android is so heavily fuzzed anyways)
most of my methodology atm is looking for logic bugs in trust boundaries. ones with big topology. for these bugs I been testing opus 4.7 + gpty in finding it, opus has been running on auto mode (we have a *cyber* approved account) for hours and still not caught it. neither is picking it up. the bug is clear if you read the code and understand the context of the component, but the agent just fails to understand the context or topology.
i can't see how the hype around mythos solves this. it feels like an architecture & compression issue. ultimately llms think in lists and have a small context window, attackers don't. we think in graphs and control flow. what they need to be effective is triage compression and graphing, which a human can do with enough experience. they need a map of the territory at a scale that fits in their context window. till that changes my view on LLMs in vuln research isn't changing.
We are mostly not hackers - we are the hacked.
"Schneier, a security expert, broadens the category of "hacker" to include anyone who studies systems with an eye to finding and exploiting their defects. Under this definition, the more fearsome hackers are "working for a hedge fund, finding a loophole in financial regulations that lets her siphon extra profits out of the system." Hackers work in corporate offices, or as government lobbyists.
As Henry says, hacking isn't intrinsically countercultural ("Most of the hacking you might care about is done by boring seeming people in boring seeming clothes"). Hacking reinforces – rather than undermining power asymmetries ("The rich have far more resources to figure out how to gimmick the rules"). We are mostly not the hackers – we are the hacked."
https://pluralistic.net/2024/04/17/panama-papers-fanfic/#the-1337est-h4x0rs