Snooping YouTube History and Breaking State Machines

This week is a shorter episode, but still some solid bugs to look at. From a full chain Chrome exploit, to a Kindle chain from remote to root and a eBPF incorrect calculation leading to OOB read/write.

[00:00:41] Albicla launch clusterfuck

• https://www.reddit.com/r/programminghorror/comments/l25ppk/albicla_launch_clusterfuck/

[00:04:41] [NordVPN] RCE through Windows Custom Protocol on Windows client

• https://hackerone.com/reports/1001255

[00:09:00] Chaining Multiple bugs for Unauthenticated RCE in the SolarWinds Orion Platform

• https://www.thezdi.com/blog/2021/1/20/three-bugs-in-orions-belt-chaining-multiple-bugs-for-unauthenticated-rce-in-the-solarwinds-orion-platform

[00:18:50] The Embedded YouTube Player Told Me What You Were Watching (and more)

• https://bugs.xdavidhu.me/google/2021/01/18/the-embedded-youtube-player-told-me-what-you-were-watching-and-more/

[00:24:27] The State of State Machines

• https://googleprojectzero.blogspot.com/2021/01/the-state-of-state-machines.html


• https://bugs.chromium.org/p/project-zero/issues/detail?id=2085

[00:34:21] KindleDrip - From Your Kindle’s Email Address to Using Your Credit Card

• https://medium.com/realmodelabs/kindledrip-from-your-kindles-email-address-to-using-your-credit-card-bb93dbfb2a08

[00:44:00] New campaign targeting security researchers

• https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/

[00:44:42] An Incorrect Calculation Bug in the Linux Kernel eBPF Verifier

• https://www.thezdi.com/blog/2021/1/18/zdi-20-1440-an-incorrect-calculation-bug-in-the-linux-kernel-ebpf-verifier

[00:49:18] Chat Question: What do we think of HackTheBox

• https://hackthebox.eu

[00:53:51] Bad Pods: Kubernetes Pod Privilege Escalation

• https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation

[00:53:24] [Linux Kernel Exploitation 0x2] Controlling RIP and Escalating privileges via Stack Overflow

• https://blog.k3170makan.com/2021/01/linux-kernel-exploitation-0x2.html


• https://pwn.college/modules/kernel

Watch the DAY[0] podcast live on Twitch (@dayzerosec) every Monday afternoon at 12:00pm PST (3:00pm EST)

Or the video archive on Youtube (@dayzerosec)