Will Harris @parityzero

Chrome Security gnome. I work on the sandbox and local data protection on Windows. @parityzero.99 on signal. Opinions here are my own! will.phase.net Joined June 2011

Tweets

2K
Followers

4K
Following

800
Likes

3K

Will Harris @parityzero

a month ago

@0xcharlie The sooner we have the bug the sooner we are able to fix it for users. Breaking exploits with offset changes doesn't cause the bug to magically disappear or make users any safer.

2 1 7 321 0

View Details

@0xcharlie We already tried to avoid releasing Chrome updates in the days leading up to pwn2own just in case a benign offset change meant we didn't get a juicy bug. Prefer to get the bug than not. Harder to avoid now though with weekly updates...

1 1 18 578 1

View Details

Will Harris @parityzero

2 months ago

@simplylurking2 Hmm, many techniques here might not work any more...? e.g. Secure Preferences now enabled on Enterprise and use App-Bound Encryption for hashes. Post what you find from your testing :)

1 0 1 27 0

View Details

Will Harris @parityzero

2 months ago

@simplylurking2 Setting Chrome policy needs admin though doesn't it...? HKCU policy keys are ACLed?

1 0 1 50 0

View Details

Will Harris @parityzero

2 months ago

@5aelo seems like strong CFI should be possible - I suppose I am talking both forward and backward edge, and maybe CET or some hardware support? I think this seems more achievable than 'solving the JIT problem' but I dunno

0 0 0 56 0

View Details

Will Harris @parityzero

2 months ago

@5aelo Why does building strong CFI also mean you can probably solve the JIT problem?

1 0 0 118 0

View Details

Charlie Miller @0xcharlie

2 months ago

pwn2own has always been a great datapoint for how hard it is to find vulns, what exploit mitigations are working, new exploitation techniques, and now how AI works on offensive security.

s1r1us (mohan) @S1r1u5_

3 months ago

this year's pwn2own isn't just interesting because there will be lots of entries with AI+human. it is also interesting because a) anthropic burned a ton of tokens on firefox, basically running claude in a loop until it found something for a month, probably exhausting whatever

10 34 331 63K 87

3 11 77 13K 19

View Details

Bobby Seagull MBE @Bobby_Seagull

2 months ago

This young man Manchester Madgwick seems to know everything. What a mind. Bravo 👏🏻 #UniversityChallenge

35 13 372 21K 3

View Details

Katie🌻Moussouris (she/her/she-ra/she-hulk) 🪷 @k8em0

2 months ago

Great advice from @AnthropicAI on prep for accelerated AI vulnerability discovery, including what to do if you don’t have a dedicated security team, if you’re reporting bugs you found, or are an open source maintainer. /ht @_decius_ for sending the link claude.com/blog/preparing…

3 26 82 10K 72

View Details

Will Harris @parityzero

4 months ago

@WindowsCentral Make it so right clicking on a file in explorer on a modern 64-core theadripper 3995WX doesn't take 3 seconds to open the context menu.

2 0 1 1K 0

View Details

Chris Wysopal @WeldPond

4 months ago

The window between vulnerability disclosure and real-world exploitation keeps shrinking. The Zero Day Clock visualizes how fast attackers are operationalizing new CVEs. What used to take months now often happens in days, or hours. The future needs to be Secure by Design. zerodayclock.com #AppSec #CyberSecurity

11 48 179 22K 106

View Details

Heather Adkins - Ꜻ - Spes consilium non est @argvee

4 months ago

Someone finally made a proper video on the xz backdoor. It’s missing a lot of the story, that I hope gets told someday, but still worth a watch.

Veritasium @veritasium

4 months ago

The Internet Was Weeks Away From Disaster and No One Knew

13 37 264 48K 49

1 5 32 4K 16

View Details

Will Harris @parityzero

5 months ago

@afneil On international flights with no first class cabin they sometimes don't even bother calling group 1 (BA Gold) and go straight to 2 (business class).

0 0 1 700 0

View Details

Will Harris @parityzero

5 months ago

@xaitax I find it amusing that Copilot is using App-Bound Encryption - how about adding this support directly into the OS instead? Does this mean I work in AI Security now? :)

1 0 2 146 0

View Details

Alex @xaitax

6 months ago

Interesting. Microsoft Edge now finally switched on App-bound encryption for their passwords. At least for me now on Version 144.0.3719.35. Last test on Version 142.0.3595.53 this wasn't the case.

0 1 4 605 0

View Details

Will Harris @parityzero

6 months ago

@jrozner @dinodaizovi yes, DBSC means the attacker must maintain persistence on the device so increases the cost/risk of any attacks.

0 0 0 12 0

View Details

Will Harris @parityzero

6 months ago

@jrozner @dinodaizovi ... you need something like application isolation or strong application secret binding (macOS has keychain, Windows has app-bound encryption). 2/2

1 0 0 68 0

View Details

Will Harris @parityzero

6 months ago

@jrozner @dinodaizovi yes, exactly - so the cookie can be stolen but it can't be used off the device because of the need to present the short lived bearer token which is hardware bound. I don't think the goal of DBSC is to block an attacker with a persistent presence on the device. for that ... 1/2