← Feed

Posts

• View post

  CVE-2024-13745 in EDK II (likely, "WONTFIX"): "what you measure is not what you use". The story about firmware measuring bytes different from ones being used. It affects PCR[5], so the severity is low (nobody cares about PCR[5] by default). https://www.openwall.com/lists/oss-security/2026/05/29/2

• View post

  Most FDE vendors/projects don't consider vectors requiring repeated physical access as a vulnerability. But there is another side to this: an HDD/SSD firmware backdoor (or a network attacker injecting arbitrary data into a disk image booted over the network) has a way to inject attacker-controlled data into an encrypted volume despite code integrity controls like Secure Boot and TPM-based unlocks (the "Implementation and Implications of a Stealth Hard-Drive Backdoor" p...

• View post

  @GossiTheDog, @wdormann: 1. This is not the same as "mount the OS drive on another computer using your own password", because a PIN alone isn't enough to mount a BitLocker-protected volume in the "TPM + PIN" mode. Since early BitLocker bypasses, Microsoft explicitly states that "a PIN known to an attacker" is a vector (e.g., "[t]o exploit the vulnerability the attacker needs to know the TPM PIN if the user is protected by t...

• View post

  It seems that CVE-centric processes are failing again... June 18, 2026: TrueConf LLC publishes a security update (source: https://trueconf.com/blog/update/trueconf-server-security-updates-june-2026). June 18, 2026 – August 11, 2026: TrueConf LLC urges its customers to update ASAP at least five times (by e-mail). No details given, but five e-mails are unusual for a routine update. August 11, 2026: Kaspersky posts an article about detected (in-the-wild) exploitation of two vulnerabilities alrea...

• View post

  I posted the slides from two talks here: https://dfir.ru/2026/09/09/two-conference-talks-slides/ If you like BitLocker bypasses, here is my list: CVE-2024-43513 dubbed "bitlockpick", CVE-2025-21202 dubbed "bitlockpick 2", CVE-2026-20928 dubbed "cold boot attack without cold and boot", CVE-2025-21214 – a bug from the 90’s, CVE-2025-21215 – turning the Windows boot loader into the keylogger to capture the BitLocker’s PIN. But the talk wasn&am...

• View post

  * My shell script to collect data from compromised NetScalers (timelines, core dumps, etc.): https://github.com/msuhanov/easy_triage/blob/main/easy_triage_fbsd.sh * My NSE script to fingerprint the NetScaler TCP stack: https://github.com/msuhanov/nse/blob/main/netscaler-id.nse

• View post

  For some reason, Citrix removed my name from the acknowledgements section of their advisory: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 Original credits: > Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, and Maxim Suhanov Now: > Michael Tucker and Chew Keong Tan of the JPMorgan Chase XOR Team I reported CVE-2026-88778, a vulnerability that (a) allows IP spoofing and (b) allows thousands of NetScaler hosts to p...

• View post

  In 2022, Microsoft decided to propagate Mark-of-the-Web into mounted containers. Here is how they did that and why third-party code (like WinRar) still fails to correctly propagate the Zone.Identifier ADS. https://dfir.ru/2026/06/29/mark-of-the-web-the-rules-changed-the-tools-didnt/