Yarden Shafir

Haven’t uploaded them but happy to do that if you find them useful on their own :)

YouTube video by Microsoft Israel R&D Center BlueHat IL 2025 - Yarden Shafir - Look, Ma—No Privileges! How Windows Gives You Kernel Pointers...

Looks like BlueHatIL talks are online now, so here’s my talk for anyone who wanted to learn about the latest episode of KASLR and couldn’t make it: www.youtube.com/watch?v=Dk2r...

I wonder if Google maps can give me driving directions to TraceView, Tennessee

AI search engines are the future

Microsoft threat actor found in the wild

To me this looks like an oversight by Microsoft, not an intentional thing, but I’m not sure windows defender ever blocked any drivers through the ELAM callback so I don’t know if this changes much.

Other EDRs: do you use the ELAM blocking functionality or only use it for the cert?

Wdboot.sys driver entry, function is empty and has no functionality.

For about a year now, WdBoot.sys essentially does nothing. Microsoft installs 2 versions:
- \System32\drivers\wdboot.sys is the “full”, functional version
- \System32\drivers\wd\wdboot.sys is the “empty” version, which is the one being updated and loaded.

Does anyone know the reason behind this?

The dying words of the American empire will be “I don’t think this code does anything. I’ll go ahead and delete that.”

Oh look they’re going to vibe program the SSA systems. I’m sure this will be perfectly fine and will cause no issues.

Knowing they eat steak makes them even scarier

Kookaburra

This cute little thing sounds like a witch laughing in a dark forest and has tried to kill me twice so far

I was told Australia is scary but didn’t expect to land and immediately get threatened by a public bus

Windows is going through some stuff right now

Blog: Zen and the Art of Microcode Hacking This blog post covers the full details of EntrySign, the AMD Zen microcode signature validation vulnerability recently discovered by the Google Security team.

"Zen and the Art of Microcode Hacking"

Tragic signature bypass enables custom microcode loading on AMD processors, and a tool to do it. The blog is extremely well written and provides concise explanations of topics mentioned + plenty of resources! A must read.

bughunters.google.com/blog/5424842...

Small anecdote about thread priorities and throttling on Windows 11:
I’m downloading a large file.
Estimated time left: 28 minutes.
Open notepad, put it as the front window. Download time left: 57 minutes.
Close notepad, browser back in front. Time left: 27 minutes.

I’m not saying you definitely have to go to @BlueHatIL this year, I’m just letting you know it’s free, by the beach and I’ll be there dropping kernel pointers to anyone who asks nicely

Meet Rayhunter: A New Open Source Tool from EFF to Detect Cellular Spying Rayhunter is a new open source tool we’ve created that runs off an affordable mobile hotspot that we hope empowers everyone, regardless of technical skill, to help search out cell-site simulators (CSS...

I work with cool people who do cool things: www.eff.org/deeplinks/20...

Celebrating flat fuck Friday

Wanted to live tweet so bad but also didn’t wanna look away from the show it was so good. And the best singer in this was Janet!

Not that I saw but there were some of the usual shout outs and the narrator responded to all of them

“It was a strange night… how strange? As strange as the strangest thing going through Trump’s head”

This is a full theatre production, live singing and all. This is everything I could ever ask for.

The narrator is brilliant and I’m crying laughing.

Going to a Rocky Horror show in a quiet UK town and the crowd is almost entirely old British people so I’m expecting an incredible time

BlueHat IL 2025- Congratulations- your submission to the main hall was accepted!

🎉🎉

More baking!

Every single Canadian stereotype is correct. It is -4c (24f) today and I've seen one people walking around in shorts and another one in a short-sleeved t-shirt. Not a single person is wearing a hat.

Did a bit of baking this weekend

Of course!

Good morning

Does anyone know companies hiring for entry level roles (in Canada/remote)? And I mean *real* entry level, not degree + 2 certs + 3 years experience “entry level”.

Not just cybersecurity, any entry level roles at all, in any area.