DTM
LightNews LightNews
banner
dtmsecurity.bsky.social
DTM
@dtmsecurity.bsky.social
150 followers 110 following 1 posts
Hacker, Security Engineer and Researcher.
https://dtm.uk/
Posts Replies Media Videos
Reposted by DTM
angealbertini.bsky.social
In ~1h, we’ll explore the awesome and clever DOOM.PDF!
www.youtube.com/live/t17joAi...
10 Doom.PDF
YouTube video by Ange Albertini
www.youtube.com
January 19, 2025 at 6:40 PM
Reposted by DTM
angealbertini.bsky.social
I made my #38C3 talk on file formats (fearsome file formats) for all kinds of audience.
Here's how...

Hopefully, a little bit for all kinds of people!
I started with very simple concepts like: 'when were "files" being introduced to end-users?'. Then I 'connect' to my previous talk, showing that some old tricks still work in modern setup, such as remote hacking of cars in 2024 via a format from 1977. Then I introduce modern tools such as Mitra, as we move from funky PoCs to fearsome tools, to generate those PoCs. A mention of small format bugs at scale and the risk of privacy leaks: Acropalypse, SQLBuddy. Now it's time for more advanced stuff: near-polyglots, crypto-polyglots, hash collisions and hashquines. And finally, introducing a genuine use of AI in file format filtering at scale, with Magika, the open-source AI filter at Google.
January 7, 2025 at 9:04 AM
Reposted by DTM
angealbertini.bsky.social
Recording: media.ccc.de/v/38c3-fears...
Fearsome File Formats
Specifications are enough, they say… 10 years after 31c3's "Funky File Formats" … Have things improved? With so many open-source parse...
media.ccc.de
December 28, 2024 at 5:21 PM
Reposted by DTM
angealbertini.bsky.social
I presented about file formats at #38C3.
Thanks for the feedback everyone!
speakerdeck.com/ange/fearsom...
Fearsome File Formats
Presented at 38C3 in Hamburg on the 28th December 2024. With so many open-source parsers being tested and fuzzed, and widely available specs, what c…
speakerdeck.com
December 28, 2024 at 5:19 PM
Reposted by DTM
johnnyspandex.bsky.social
Some Christmas cheer with @buffaloverflow.rw.md . A nice bug in the URL handler for Delinea Secret Server.

blog.amberwolf.com/blog/2024/de...
Delinea Protocol Handler - Remote Code Execution via Update Process (CVE-2024-12908)
AmberWolf Security Research Blog
blog.amberwolf.com
December 26, 2024 at 12:17 PM
Reposted by DTM
ethicalchaos.bsky.social
Sorry folks, I had to remove the Disconnected GPO project from GitHub... but never fear, it has returned as Disconnected RSAT since it now supports the Certificate Authority and Certificate Templates snap-ins in addition to Group Policy support.
github.com/CCob/DRSAT
GitHub - CCob/DRSAT: Disconnected RSAT - A method of running Group Policy Manager, Certificate Authority and Certificate Templates MMC snap-ins from non-domain joined machies
Disconnected RSAT - A method of running Group Policy Manager, Certificate Authority and Certificate Templates MMC snap-ins from non-domain joined machies - CCob/DRSAT
github.com
December 27, 2024 at 11:51 AM
Reposted by DTM
netbiosx.bsky.social
GitHub - almounah/superdeye: Indirect Syscall with TartarusGate Approach in Go
Indirect Syscall with TartarusGate Approach in Go. Contribute to almounah/superdeye development by creating an account on GitHub.
github.com
December 6, 2024 at 8:10 AM
Reposted by DTM
tomnomnom.com
Merry CRTmas everyone poc.lol/crtmas/
Merry CRTmas
poc.lol
December 1, 2024 at 10:00 PM
Reposted by DTM
therceman.bsky.social
Bug Bounty Tip

XSS Filter Bypass: mXSS

Cheers!
November 28, 2024 at 11:22 AM
Reposted by DTM
xpnsec.com
This hack is brilliant, APT28 hopping into a target environment over wifi by compromising neighbouring companies and finding a dual-homed host within range.

volexity.com/blog/2024/11...

And yet... they got caught doing this!
November 22, 2024 at 10:31 PM