@Bitfinding Co-Founder. Ex-hacker. Mostly EVM these days. Previously at @Microsoft, @MarshallWace.
Joined July 2009
- Tweets809
- Following776
- Followers1.3K
- Likes1.4K
Pinned Tweet
Wrote a post about those cases when shared_ptr<T> doesn't use atomic operations for the reference count. Spoiler: it's only in GNU and I couldn't decide if it's secure or not.
snf.github.io/2019/02/13/sha…
Too many people using weak analogies and comparing apples to oranges while blaming 7702.
The hackers would have achieved the same by draining the 8 top tokens using a bundle and people would be blaming flashbots for facilitating the attack?
Sebastian Fernandez retweeted
Android's openness distinguished it from iPhone for 17 years. Google is now requiring mandatory developer registration for all apps, including those distributed outside the Play Store. keepandroidopen.org #KeepAndroidOpen
Sebastian Fernandez retweeted
Phishing Dojo v3 beta is live: phishingdojo.com 🚀
Free training sessions showcase just a few of our many simulators, built for @ekoparty and @thedaofund.
Found an issue? Report it, feedback is welcome 🙏
Orgs interested in an enterprise trial: [email protected]
I gave Codex access to an old Android phone with ADB over WIFI to build and debug a Wireguard + STUN app to connect to my home network without a public IP.
My only involvement were a few design decisions and changing the phone networks three times.
App happily sideloaded in my phone now.
WYSIWYS?
1/2 ⚠️ One action displayed. 257 authorized ⚠️
Our full write up is live: Signature overflow attacks on Ledger.
A Clear Signing bug broke a critical security property: What you see is what you sign.
🔎 Technical details + PoC:
bitfinding.com/blog/signatur…
This weekend was one of the recent 24 hour periods where I didn't see any reorg in Ethereum which is good but the streak broke after 26 hours 43 minutes.
I've been looking a lot into these and, without spoiling the research, there's so much happening before blocks get finalized.
We kept this vulnerability under embargo for over 6 months! We’re giving users a few more days to update before publishing a POC.
1/2 We helped Ledger identify and fix a High-severity Clear Signing vulnerability.
Ethereum app 1.19.0–1.22.2 is affected. Update to 1.22.3+.
Our advisory:
bitfinding.github.io/publica…
We kept this vulnerability under embargo for over 6 months! We’re giving users a few more days to update before publishing a PoC.
1/2 We helped Ledger identify and fix a High-severity Clear Signing vulnerability.
Ethereum app 1.19.0–1.22.2 is affected. Update to 1.22.3+.
Our advisory:
bitfinding.github.io/publica…
Sebastian Fernandez retweeted
If you use Ledger for Ethereum, please update the Ethereum-app to v1.22.3. This is a new release.
Go update your Ledger. Again.
Sebastian Fernandez retweeted
This exploit is similar to our not-WYSIWYS attack reported in March. We followed responsible disclosure and are waiting for the fix to be widely adopted before dropping the POC
Sebastian Fernandez retweeted
Research update: we’ve been heads down on several projects we’ll be sharing soon. One is our investigation into reorgs, orphans, and cross-chain execution triggered before confirmation. Several bridges are in scope, and we’re sharing findings with their teams privately.
Just declared attention bankruptcy on most coding agent sessions.
Good times when it's so easy to start over with plans, specs and debugging docs.
Feels like closing all the browser tabs once in a while.
Sebastian Fernandez retweeted
The latest Giveth newsletter is out 💜
Inside:
🛡️ @thedaofund Ethereum Security QF Round results and 638 ETH+ distributed
📊 A new dashboard to explore the round data
🤝 GIVfriend of the month: @wintermute_t
🙌 Featured project: @BitFinding
🏆 Newly verified projects: @walnut_dev, @dedaub
and much more
Sebastian Fernandez retweeted
Huge thanks to @giveth and everyone involved to make this happen.
Thanks to this initiative we can spend more time in public good projects that benefit the whole ecosystem.
TheDAO's Ethereum Security QF Round matching funds have officially been distributed 🛡️
What started as a 500 ETH matching pool from @thedaofund ultimately grew to 638 ETH+ thanks to support from across the ecosystem.
134 projects have now received funding to continue their work strengthening Ethereum security.
A huge thank you to every donor, contributor, and project that made this round possible.
Today is the last day of @giveth QF! In addition my previous donations, I added some projects that I found interesting with diverse solutions for fuzzing, blind signing, education, ops and consensus