Tom Dohrmann (@13erbse) profile picture

Tom Dohrmann

@13erbse
Joined February 2015
  • Tweets378
  • Following191
  • Followers203
36Media
Photo by Tom Dohrmann (@13erbse)Photo by Tom Dohrmann (@13erbse)Photo by Tom Dohrmann (@13erbse)Photo by Tom Dohrmann (@13erbse)Photo by Tom Dohrmann (@13erbse)Photo by Tom Dohrmann (@13erbse)Photo by Tom Dohrmann (@13erbse)Photo by Tom Dohrmann (@13erbse)
The recording for my BlackHat talk about the SEV firmware has just been published: youtube.com/watch?v=ra-Ef1Qy… #BlackHat2024 #BlackHatUSA
1
1
5
361
(All opinions expressed in that talk are my own)
104
The detailed version of our #WorstFit attack is available now! 🔥 Check it out! 👉 blog.orange.tw/posts/2025-01… cc: @_splitline_
WorstFit: Unveiling Hidden Transformers in Windows ANSI!

WorstFit: Unveiling Hidden Transformers in Windows ANSI!

📌 This is a cross-post from DEVCORE. The research was first published at Black Hat Europe 2024. Personally, I would like to thank splitline, the co-author of this research & article, whose help

blog.orange.tw
Orange Tsai 🍊 (@orange_8361) profile pictureOrange Tsai 🍊
@orange_836111 Dec 2024
Our talk at #BHEU is done! Hope you all enjoyed it. 😉 A detailed blog is on the way, but in the meantime, check out the pre-alpha website worst.fit/ for early access and the slides! Huge thanks to @BlackHatEvents and my awesome co-presenter @_splitline_! 🐈‍
4
204
10
527
76,367
I just merged the 1000th commit into github.com/Freax13/mushroom 🚀
Image from Tom Dohrmann (@13erbse)
4
120
Image from Tom Dohrmann (@13erbse)
5
135
I wrote some docs detailing mushroom's attestation story if anyone's interested: github.com/Freax13/mushroom/…
mushroom/docs/attestation.md at main · Freax13/mushroom

mushroom/docs/attestation.md at main · Freax13/mushroom

Run integrity protected workloads in a hardware based Trusted Execution Environment. - Freax13/mushroom

github.com
1
2
4
261
Tom Dohrmann retweeted
CSCG (@C_S_C_G) profile picture
CSCG@C_S_C_G11 Oct 2024
We did it! 🏆🇩🇪 So excited to have won this incredible competition! The competition was fierce, and every team brought their A-game. Huge thanks to @ECSC2024 for an unforgettable experience! 🎉💻🔥 #ECSC2024 @BSI_Bund
ECSC2024 (@ecsc2024) profile pictureECSC2024@ecsc202411 Oct 2024
Germany team wins #ECSC2024 🥇 🇩🇪
3
7
2
53
4,549
The slides for my Black Hat talk about attacking the firmware used for AMD SEV-SNP are now public: blackhat.com/us-24/briefings… #BHUSA
1
13
1
46
8,160
Proof of concept code for all vulnerabilities is available on GitHub: github.com/Freax13/cve-2024-… github.com/Freax13/cve-2024-… github.com/Freax13/cve-2023-…
GitHub - Freax13/cve-2024-21980-poc

GitHub - Freax13/cve-2024-21980-poc

Contribute to Freax13/cve-2024-21980-poc development by creating an account on GitHub.

github.com
1
1
372
AMD has also published a security advisory: amd.com/en/resources/product…
Guest Memory Vulnerabilities

Guest Memory Vulnerabilities

amd.com
2
276
FYI, @AMD released updates for the SEV firmware today.
Image from Tom Dohrmann (@13erbse)
3
4
503
I'm excited to announce that I have a talk at #BHUSA about some more cool results from my research into the SEV firmware: blackhat.com/us-24/briefings… @BlackHatEvents
Image from Tom Dohrmann (@13erbse)
5
29
7,365
Tom Dohrmann retweeted
Paolo Bonzini (@fagiolinux) profile picture
Paolo Bonzini@fagiolinux6 Jun 2024
SEV-SNP support will be in QEMU 9.1 and Linux 6.11!
3
13
2
44
4,621
Tom Dohrmann retweeted
InstLatX64 (@InstLatX64) profile picture
InstLatX64@InstLatX642 Apr 2024
#AMD refreshed the "AMD64 Architecture Programmer's Manual, Volumes 2" 24593 pdf to v3.41 with #MOESDIF protocol, Instruction-Based Sampling Virtualization, Performance Monitoring Counter Virtualization, etc. amd.com/content/dam/amd/en/d…
Image from InstLatX64 (@InstLatX64)
Image from InstLatX64 (@InstLatX64)
InstLatX64 (@InstLatX64) profile pictureInstLatX64@InstLatX643 Jul 2023
#AMD refreshed the "AMD64 Architecture Programmer's Manual, Volumes 2" 24593 to 3.41: amd.com/system/files/TechDoc…
Image from InstLatX64 (@InstLatX64)
8
3
41
12,769
Tom Dohrmann retweeted
InstLatX64 (@InstLatX64) profile picture
InstLatX64@InstLatX642 Apr 2024
#AMD refreshed the "AMD64 Architecture Programmer's Manual, Volumes 3 General-Purpose and System Instructions" 24594 pdf to v3.36 with #RMPREAD instruction: amd.com/content/dam/amd/en/d…
Image from InstLatX64 (@InstLatX64)
Image from InstLatX64 (@InstLatX64)
InstLatX64 (@InstLatX64) profile pictureInstLatX64@InstLatX643 Jul 2023
#AMD refreshed the "AMD64 Architecture Programmer's Manual, Volumes 3" 24594 to 3.35: amd.com/system/files/TechDoc…
Image from InstLatX64 (@InstLatX64)
1
4
1
23
4,520
New blog post about two bugs in the SEV firmware I reported a while ago: blog.freax13.de/cve/cve-2023…

Bugs Found During My Initial Explorations of the SEV Firmware

This blog post discusses two recently disclosed low-severity vulnerabilities in the SEV firmware. Both vulnerabilities were published in AMD-SB-3007.

blog.freax13.de
6
208
Come check out my talk this afternoon: fosdem.org/2024/schedule/eve… I'll talk about leveraging AMD SEV-SNP to protect the integrity of Linux workloads.
FOSDEM 2024 - Integrity Protect Workloads with Mushroom

FOSDEM 2024 - Integrity Protect Workloads with Mushroom

archive.fosdem.org
2
1
11
458
Today, AMD published a security bulletin AMD-SB-3006 for a low-severity CPU bug that I reported to them affecting SEV-SNP guests. You can read more about it in my latest blog post at blog.freax13.de/cve/cve-2023… #SEV

Suppressing Debug Events in SEV-SNP Guests

TL;DR: The host can force a SEV-SNP guest to skip some debug events such as single-step breakpoints and hardware data breakpoints on affected processors by forcing an intercept to occur at the same...

blog.freax13.de
1
5
243
I finally finished up my blog post about a Linux EoP bug I reported a while ago: blog.freax13.de/cve/cve-2023… #SEV #Linux

The SEV-SNP Exploit Is Coming From Inside The House. The Building Owner Is Helping Too.

This blog post discusses a recently patched privilege escalation vulnerability, CVE-2023-46813, in the Linux kernel that affected guests running as SEV-ES or SEV-SNP VMs.

blog.freax13.de
3
7
571
Tom Dohrmann retweeted
Colin Finck (@colinfinck) profile picture
Colin Finck@colinfinck1 Dec 2023
Happy to be talking at #BlackHat Europe next week about some of the things we did in the past 5 years at ENLYZE. If you like to hear about the state of PLC security and multiple layers of obfuscation in Siemens S7 PLCs, join @13erbse's and my talk: blackhat.com/eu-23/briefings… #BHEU
2
2
3
460
Load more