Platform Security Summit @platformsec

Conference on composable software supply chain integrity and hardware-assisted platform security, with OpenEmbedded, OpenXT and other ecosystems PlatformSecuritySummit.com/2019/videos Joined April 2018

Tweets

10K
Followers

987
Following

4K
Likes

3K

Xeno Kovah @XenoKovah

2 months ago

The TPM classes at OST2 are a great way to learn about the most widely available hardware-backed security mechanism for the low-low price of $0 from the comfort of your own emulator :)

OpenSecurityTraining2 @OpenSecTraining

2 months ago

📣New OST2 class release!📣 The TPM trilogy is complete! "TC1103: Advanced TPM usage" by Dimi Tomov is now public at ost2.fyi/TC1103! Learn about advanced TPM policy access controls, protecting external keys in a TPM, implementing maximum security TPM-backed FDE, and

0 3 17 5K 14

0 4 32 2K 10

View Details

Ryan M @Grimdoomer

3 weeks ago

New blog post on reverse engineering and modifying HDD firmware. In this part I cover obtaining, analyzing, and modifying firmware, using backdoor commands to hot patch code in RAM, and using JTAG to debug a live HDD icode4.coffee/?p=1465

12 139 875 52K 414

View Details

Alex Ionescu @aionescu

2 weeks ago

This information class was added only a few years ago. In the age of trillion dollar spending on AI code reviews and security, codeQL, KASAN and more, the world’s leading operating system kernel still added code to increment an arbitrary user controlled pointer in a system call

Clandestine @akaclandestine

3 weeks ago

GitHub - orinimron123/CVE-2026-40369-EXPLOIT: Full exploit code for CVE-2026-40369 - A Windows kernel arbitrary write vulnerability that allows browser sandbox escape from all browsers render process sandbox · GitHub github.com/orinimron123/C…

1 43 177 38K 117

3 13 99 28K 47

View Details

Platform Security Summit @platformsec

2 weeks ago

Gatekeepers decided what platform security capabilities shipped.. [now] joined by open-source, specialized firms and manufacturers with AI-augmented teams. Can future supply chains configure platforms for device fleets, threat models and regulations at the speed customers expect?

DL Timmerman @bereanpi

2 weeks ago

Really great read for those in software. And for product managers, discipline is still key as pointed out in the comments.

0 0 0 241 1

0 1 1 221 1

View Details

Donncha Ó Cearbhaill @DonnchaC

3 weeks ago

Excited to see @Google launch Intrusion Logging, the first purpose-built system to enable forensic investigations of advanced attacks on mobile. @AmnestyTech has worked with @Android as a design partner, during the development of Intrusion Logging and Advanced Protection Mode

3 55 157 19K 64

View Details

Alex Rad @defendtheworld

4 weeks ago

It is hard to understate how much more hardened Apple's Application-Processor-side of WiFi is than any other operating system out there. Between MIE and the XZM allocator there's some serious hardening on the latest iOS and iPhone 17. We spend a lot of time in wifi land and Apple's the gold standard here. The first big thing to know about Apple's WiFi on iOS is that they removed attack surface from the kernel and brought it into userland with DriverKit (developer.apple.com/videos/play/ww…). The concept was initially formed by Simon Douglas while he was at NeXT, Inc working for Steve Jobs and brought to Mac in 2019 by Douglas and team. Most memory corruption can't get far by design and it should be exceedingly difficult to see another Ian Beer type wifi exploit (projectzero.google/2020/12/an-ios…) This use after free bug occured in `wifid`, a root userland process on iOS and can be triggered without any user interaction.

Supernetworks, Inc @spr_networks

4 weeks ago

iOS 26.5 dropped today with a fix for CVE-2026-28994 — a Wi-Fi use-after-free our @defendtheworld discovered via automated Wi-Fi fuzzing. The bug is preauth and requires no user interaction.

1 6 89 94K 30

8 59 499 88K 224

View Details

Linux Plumbers Conference 2026 @linuxplumbers

3 months ago

CFP for LPC 2026 is open! Important dates: Thursday, April 23, 2026: Deadline to submit proposals to host a microconference Sunday, June 28, 2026: Deadline to submit LPC Refereed Track Presentations Proposals and Kernel Summit Presentations Proposals. lpc.events/event/20/abstr…

0 8 12 902 3

View Details

James Morris 👾 @xjamesmorris

2 months ago

📢 🐧 The schedule for Linux Security Summit North America (LSS-NA) 2026 is published! ➡️ events.linuxfoundation.org/linux-security… 👀 LSS-NA 2026 will be held May 21-22 in Minneapolis, MN, co-located w/ OSS. ✏ Register: events.linuxfoundation.org/linux-security… #linuxsecuritysummit #linux #infosec

0 1 0 150 1

View Details

Ryan Naraine @ryanaraine

2 months ago

If AI finds the zero-day, writes the exploit, and patches the code, who trains the next generation of security researchers? Chris St. Myers' "Cognitive Rust Belt" essay kicked off a debate we couldn't stop having. Apple Podcasts podcasts.apple.com/us/podcast/thr…

5 14 49 5K 18

View Details

Xeno Kovah @XenoKovah

2 months ago

@ryanaraine I do. ost2.fyi/Vulns1001, ost2.fyi/Vulns1002

1 3 23 6K 16

View Details

Ryan Naraine @ryanaraine

2 months ago

This stirred a lot of thinking and emotion. I'd read it closely 👇🏽

SentinelLabs @LabsSentinel

2 months ago

The Cognitive Rust Belt - If you wait for the technology to settle before you address this, you will find there is nothing left to save. sentinelone.com/blog/the-imple…

0 4 16 8K 16

3 5 14 5K 6

View Details

Andy Greenberg (@agreenberg at the other places) @a_greenberg

2 months ago

Two weeks after the DarkSword iOS hacking tool was revealed, Apple is taking the rare step of pushing a security fix to older iOS 18 iPhones rather than just telling users to update to iOS 26, as it had previously done. (Which left millions vulnerable.) wired.com/story/apple-wi…

4 25 95 39K 28

View Details

Mark Ermolov @_markel___

2 months ago

Intel SGX has fallen! Its most important key is in our hands: we extracted the Global Wrapping Key from an instance of the Intel Gemini Lake platform

34 350 2K 221K 703

View Details

Mark Ermolov @_markel___

2 months ago

This is made possible by executing arbitrary microcode on the DFX-locked system. And although this was a truly challenging task, we were able to do it after researching in details the interaction between PMC and PUNIT

1 4 222 21K 5

View Details

nedwill @NedWilliamson

3 months ago

The marginal effects here mean we are getting some amazing data about the types of bugs that were most exposed to AI, and once these waves of fixes go in and if things taper we’ll see the ongoing bug stream as a frontier capability signal.

1 4 25 16K 2

View Details

MG @_MG_

2 months ago

The “foreign routers ban” is being enforced at the FCC certification stage. If you don’t know what that means, here’s a quick explainer: Once you (the manufacturer) have FINALIZED your new hardware design, you produce a few units and send them off to a specialized lab to test the radio emissions from your device. If everything goes perfectly (no test failures), 2-3 months later you will have a FCC certification. Then you have to apply the FCC label to your product. Without the completed FCC cert, you cannot legally market, import, or sell in the USA. So, mass production typically doesn’t start until after the cert happens, unless you are very confident that you will one-shot the lab tests without any hardware revisions. Else, you’d be stuck with tons of hardware you can’t sell. This FCC change will be especially painful to anyone who was about to get their new device certified. The requirement to have an on-shoring plan is probably going to be the most significant hurdle for manufacturers. If this ban included all current routers (it doesn’t), it would have been way more painful. Not just from the consumer side with supply impact. But imagine every existing router having to go through a 3+ month process with labs that would be instantly booked with backlog for years. Sure, some sort of leaned down re-cert process would have been more probable, but you get the point.

7 26 91 9K 23

View Details

Hacker News 20 @betterhn20

2 months ago

FCC Updates Covered List to Include Foreign-Made Consumer Routers fcc.gov/document/fcc-u… (news.ycombinator.com/item?id=474953…)

0 1 0 117 1

View Details

Eric Geller @ericgeller

2 months ago

The FCC today updated its list of products that can't be sold in the U.S. to include *all* consumer routers made in foreign countries. It's a big but potentially disruptive move to limit supply-chain security risks to U.S. networks. docs.fcc.gov/public/attachm…

64 248 862 339K 277

View Details

Bex Cran @bexcran

3 months ago

Just remembered about this awesome video by @oxidecomputer where they discuss debugging powering on the board for the first time, including using AMD’s socket stress tool. “Twitter Space 12/6/2021 -- Tales from the Bringup Lab” youtu.be/lhji-kP3Lhk?si…

0 3 17 5K 19

View Details

Adrian L Shaw  @adrianlshaw

3 months ago

@never_released It would be nice for an iPad to start macOS when a keyboard is connected. Could be a quick boot VM based on a snapshot. Maybe with access to the files app on the host.