Alexander Ermolov
@flothrone
Followers
1K
Following
1K
Media
0
Statuses
611
Security researcher, team lead & speaker. Low-level design, firmware and system software. Fuzzing & testing automation for CI/CD pipelines.
Joined July 2017
Published my OFFZONE 2025 presentation slides (in Russian) on GitHub: https://t.co/xoPNdCgKv8 Had a great time at the conf, kudos to https://t.co/JH7qp0fcCW and other sponsors and crew members for organizing and running it.
bi.zone
От корпорации до стартапа, мы помогаем организациям по всему миру безопасно развивать бизнес в цифровую эпоху
1
5
18
🔍 Full paper: 📄 https://t.co/DqAeEiBzhr 💻 https://t.co/wvliSHIDvx (coming soon) 📢 USENIX Security 2025 Authors: @hdtuanss , @ohtaekk_ , @cheoljun_p, @insu_yun , @yongdaek
#LLFuzz #BasebandSecurity #Fuzzing #CyberSecurity #USENIXSecurity
github.com
LLFuzz: An Over-the-Air Dynamic Testing Framework for Cellular Baseband Lower Layers - SysSec-KAIST/LLFuzz
0
4
27
ZeroNights CFP is open 🔥 Long time no see. ZN will take place on Nov 26, 2025 https://t.co/eU1fKt0H0V The program committee is accepting talks in Offensive and SecOps tracks, rewarding exclusive in-person presentations Submit https://t.co/jsjBKJ1wJI
@cfptime
2
4
9
Published the third part of my blog series about Hydroph0bia (CVE-2025-4275) vulnerability, this one is about the fix as Insyde applied it, and my thoughts on improvements for it. https://t.co/vEIkUNH3Ey
coderush.me
3
36
75
Preliminary analysis shows that Insyde fixed Hydroph0bia (CVE-2025-4275) by forcefully removing the NVRAM vars that lead to exploitation during SecureFlashDxe driver startup, and setting a restrictive variable policy for them, so such vars can't be set from the OS anymore.
1
17
78
Published, go check it out, it is a fun ride indeed: https://t.co/nkk0WkIzFt Part 3 will be done when I see how Insyde fixed the vulnerability and if we could do something about that fix.
coderush.me
There will soon be a part two of the writeup, where we'll use Hydroph0bia for getting arbitrary code execution during FW update and obtain full control over the DXE volume (and all other parts that happen to not be covered by BG/FDM hashing). https://t.co/zhhcStaJHO
1
10
23
🚨Binarly is documenting the discovery of CVE-2025-3052, a memory-corruption flaw in a Microsoft-signed UEFI module that lets attackers bypass Secure Boot and run unsigned code before the OS starts. 🔗 Full details: https://t.co/bnojn8RmsV 🛡️ Advisory: https://t.co/0D3CozbyPu
3
69
117
The embargo (12:00 UTC 2025-06-10) is over, let's start a thread on Hydroph0bia (CVE-2025-4275), a trivial SecureBoot and FW updater signature bypass in almost any Insyde H2O-based UEFI firmware used since 2012 and still in use today. English writeup:
coderush.me
2
93
200
Together with @AlexTereshkin we managed to summarize NVIDIA Offensive Security Research (OSR) work on breaking BMC (reference to our DefCon talk https://t.co/4VBhcLhcUa). This blog post also includes a link to the full paper.
Baseboard Management Controllers (BMCs) are vital for remote server management, but they can also be a significant security risk. Explore findings and recommendations to safeguard your #datacenter infrastructure from NVIDIA's Offensive Security Research team. ➡️
0
13
28
If for some reason #semgrep doesn’t fit your use case, here’s a port of my C vulnerability research ruleset to #weggli: https://t.co/xeiK9oqvL3 Read the linked blog post and check it out!
github.com
A collection of my weggli patterns to facilitate vulnerability research. - 0xdea/weggli-patterns
1
21
78
We're are happy to announce a new release of our #Rust bindings for @HexRaysSA idalib. What's new: - New APIs for working with IDBs, segments, and more - Rust 2024 support - New homepage: https://t.co/m3dJuKWdfr H/T to our contributors @yeggorv & @0xdea
https://t.co/BVvdGP1L7X
github.com
Idiomatic Rust bindings for the IDA SDK, enabling the development of standalone analysis tools using IDA v9.x’s idalib - binarly-io/idalib
0
20
52
Gave a talk on external fuzzing of Linux kernel USB drivers with syzkaller at SAFACon by @SAFATeamGmbH. Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver. Slides: https://t.co/ca479wDoRV
3
55
221
UEFITool / UEFIExtract / UEFIFind NE A71 - added Kaitai-based parser for Dell DVAR varstores - added tracking of recently opened files - macOS built of UEFITool is now developer-signed - fixed a bunch of minor issues https://t.co/wvQXmMiZZB
github.com
Another release, another new Kaitai-based parser for a vendor variable format - Dell DVAR. Those variables don't usually have names, and use hexadecimal IDs instead, but it still can be useful ...
0
9
21
Slides of my talk at #Zer0Con2025! ⚡️ Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits ⚡️ I presented the kernel-hack-drill open-source project and showed how it helped me to exploit CVE-2024-50264 in the Linux kernel. Enjoy! https://t.co/84DqT4rdvm
3
106
349
The new blog post on supervisor shadow stack restrictions / supervisor shadow-stack control https://t.co/YPVai772Zt
tandasat.github.io
This post introduces one of the virtualization features needed to keep kernel-mode shadow stack functional against kernel exploits: supervisor shadow stack restrictions / supervisor shadow-stack...
0
64
160
My writeup of the 2023 NSO in-the-wild iOS zero-click BLASTDOOR webp exploit: Blasting Past Webp - https://t.co/H4m8MBwoWN
21
235
713
Worth a read. A lot of conference talks have a lot less content than this blog post.
Some exciting research to share from Binarly REsearchers @cci_forensics and @pagabuc -- a novel approach to UEFI bootkit detection. 🔥Read the technical paper: "UEFI Bootkit Hunting: In-Depth Search for Unique Code Behavior" 👉 https://t.co/KwmiNq9hdc
1
16
75
UEFITool NE A70 (and companion tools) is the first release to have all NVRAM parsers generated from KaitaiStruct definitions, replacing hand-crafted ones that are proven to be buggy and hard to maintain. Hope the new ones will behave. Do report new bugs! https://t.co/DwvZgnGDXc
github.com
This is a major release that marks an important milestone in moving from hand-crafted parsers to ones generated from KaitaiStruct declarative DSL: all NVRAM parsers are now Kaitai-based. Other impr...
1
27
81
Hey there, Finally published the article on the exploit for CVE-2025-21333-POC exploit. Here the link to the article:
1
152
489