ESP32 Backdoor Drama and SAML Auth Bypasses

Day[0]

Content provided by dayzerosec. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by dayzerosec or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://ppacc.player.fm/legal.

1M ago 1:14:08

MP3•Episode home

Discussion this week starts with the ESP32 "backdoor" drama that circled the media, with some XML-based vulnerabilities in the mix. Finally, we cap off with a post on reviving modprobe_path for Linux exploitation, and some discussion around an attack chain against China that was attributed to the NSA.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/277.html

[00:00:00] Introduction

[00:00:25] The ESP32 "backdoor" that wasn't

[00:14:26] Speedrunners are vulnerability researchers

[00:27:58] Sign in as anyone: Bypassing SAML SSO authentication with parser differentials

[00:38:47] Impossible XXE in PHP

[00:52:41] Reviving the modprobe_path Technique: Overcoming search_binary_handler() Patch

[01:04:15] Trigon: developing a deterministic kernel exploit for iOS

[01:06:43] An inside look at NSA (Equation Group) TTPs from China’s lense

Podcast episodes are available on the usual podcast platforms:

-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

-- Other audio platforms can be found at https://anchor.fm/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

281 episodes

#Tech #dayzerosec