Breaking Lock Screens & The Great Vbox Escape

Several lockscreen-related vulnerabilities this week, a cross-site leak,  and the hijacking of all .cd domains.  

One important thing to mention about this weeks episode that was  neglected during the discussion is that the BitLocker Lockscreen Bypass  is a lockscreen bypass. It does not necessarily provide access to data  Bitlocker protects. If Bitlocker is being run in "transparent operation  mode" where the ability to login is all that is necessary to decrypt  data, then this vulnerability can grant access to encrypted data.

[00:00:00] Introduction

https://dayzerosec.com/

[00:00:59] Slayer Labs

https://slayerlabs.com/

[00:12:03] BugTraq Shutdown

https://seclists.org/bugtraq/2021/Jan/0

[00:17:22] Data Security on Mobile Devices

https://securephones.io/

[00:27:08] Running a fake power plant on the internet for a month

https://grimminck.medium.com/running-a-fake-power-plant-on-the-internet-for-a-month-4a624f685aaa

[00:33:43] BitLocker Lockscreen bypass

https://secret.club/2021/01/15/bitlocker-bypass.html

[00:39:30] [Linux Mint] Screensaver lock by-pass via the virtual keyboard

https://github.com/linuxmint/cinnamon-screensaver/issues/354

[00:43:02] [NextCloud] Bypassing Passcode/Device credentials

https://hackerone.com/reports/747726

[00:51:02] How I hijacked the top-level domain of a sovereign state

https://labs.detectify.com/2021/01/15/how-i-hijacked-the-top-level-domain-of-a-sovereign-state/

[01:00:28] Laravel <= v8.4.2 debug mode: Remote code execution

https://www.ambionics.io/blog/laravel-debug-rce

[01:05:47] Leaking silhouettes of cross-origin images

https://blog.mozilla.org/attack-and-defense/2021/01/11/leaking-silhouettes-of-cross-origin-images/

[01:10:36] Escaping VirtualBox 6.1: Part 1

https://secret.club/2021/01/14/vbox-escape.html

[01:17:15] Hunting for Bugs in Windows Mini-Filter Drivers

https://googleprojectzero.blogspot.com/2021/01/hunting-for-bugs-in-windows-mini-filter.html

[01:18:33] Project Zero: Introducing the In-the-Wild Series

https://googleprojectzero.blogspot.com/2021/01/introducing-in-wild-series.html

Watch the DAY[0] podcast live on Twitch (@dayzerosec) every Monday afternoon at 12:00pm PST (3:00pm EST)

Or the video archive on Youtube (@dayzerosec)