EXODUS BLOG

Exploit Techniques

Firefox Vulnerability Research Part 2

NOVEMBER 10, 2020

By Arthur Gerkis and David Barksdale This series of posts makes public some old Firefox research which our Zero-Day customers had access to before it was known publicly, and then our N-Day customers after...

Firefox Vulnerability Research

OCTOBER 20, 2020

A EULOGY FOR PATCH-GAPPING CHROME

FEBRUARY 24, 2020

Authors: István Kurucsai and Vignesh S Rao In 2019 we looked at patch gapping Chrome on two separate occasions. The conclusion was that exploiting 1day vulnerabilities well before the fixes were distributed through the stable channel...

Patch-gapping Google Chrome

SEPTEMBER 9, 2019

Patch-gapping is the practice of exploiting vulnerabilities in open-source software that are already fixed (or are in the process of being fixed) by the developers before the actual patch is shipped to users. This...

Pwn2Own 2019: Microsoft Edge Sandbox Escape (CVE-2019-0938). Part 2

MAY 27, 2019

By Arthur Gerkis This is the second part of the blog post on the Microsoft Edge full-chain exploit. It provides analysis and describes exploitation of a logical vulnerability in the implementation of the Microsoft...

Pwn2Own 2019: Microsoft Edge Renderer Exploitation (CVE-2019-0940). Part 1

MAY 19, 2019

By Arthur Gerkis This year Exodus Intelligence participated in the Pwn2Own competition in Vancouver. The chosen target was the Microsoft Edge browser and a full-chain browser exploit was successfully demonstrated. The exploit consisted of...

Exploiting the Magellan bug on 64-bit Chrome Desktop

JANUARY 22, 2019

Author: Ki Chan Ahn In December 2018, the Tencent Blade Team released an advisory for a bug they named “Magellan”, which affected all applications using sqlite versions prior to 2.5.3. In their public disclosure...

HPE Intelligent Management Center: a case study on the reliability of security fixes

OCTOBER 16, 2018

This post highlights several mistakes in the patches released for vulnerabilities affecting various services of HPE Intelligent Management Center, with a focus on its native binaries. Author: István Kurucsai During our work on N-day...

To ../ or not to ../, that is the question

SEPTEMBER 13, 2018

Contributors: Grant Willcox and Gaurav Baruah Intro During our day-to-day research of N-day vulnerabilities at Exodus, we often come across public advisories containing incorrect root cause analysis of the core vulnerability. This blogpost details...

True Key: the not so uncommon story of a failed patch

SEPTEMBER 10, 2018

In this blog post, we examine the vendor-supplied patch addressing CVE-2018-6661. The vulnerability was initially reported to Intel Security (McAfee) in June 2017 and disclosed publicly in April 2018. Additionally, we contacted McAfee regarding the...

← Previous 1 2 3 4 Next →