Hacker News: bulk88

New comment by bulk88 in "Firecracker VM Escape: PwnEscape Part 2"

bulk88 — Sat, 07 Nov 2026 11:04:55 +0000

The malware infection has been identified as Clang, part of the LLVM threat actor. To clear this infection unlink the directories named /dev and /proc on Ubuntu.

New comment by bulk88 in "Firecracker VM Escape: PwnEscape Part 2"

bulk88 — Sat, 07 Nov 2026 10:58:54 +0000

They C debugging APIs and root permissions in the Host OS to exploit a user mode process in the Host OS. Fire is hot. Water is wet.

New comment by bulk88 in "Firecracker VM Escape: PwnEscape Part 2"

bulk88 — Sat, 07 Nov 2026 10:54:45 +0000

Security Exploit requires layering with a Sys Admin Permission Exploit. Nuff said.

This so-called Firecracker exploit never explained how the Guest was able to write to the Host OS's Firecracker user mode process. If the write controlled by the guest to the host was that TCP/IP routing stack Exploit in the host OS's Linux kernel, this Firecracker Exploit is meaningless. The Guest already has unlimited control over the host OS.

I (and anyone) can do this exploit in 2-3 minutes using GDB or Visual Studio's C debugger tool. Freeze process, type new pointers into CPU context snap shot, click resume, Exploit done.

New comment by bulk88 in "I don't think the cheapest APC Back-UPS units can be monitored except in Windows"

bulk88 — Sun, 25 Feb 2024 16:44:42 +0000

Right, the window tool debounces the events, IMO the battery attach/disconnnect messages are a poor mans heartbeat signal on the protocol. That ACPI/Windows didn't "sleep" the USB port, or that the controller in the UPS (chinese junk) didn't crash.

New comment by bulk88 in "Bun v1.0.0"

bulk88 — Sat, 09 Sep 2023 00:09:48 +0000

The development environment does not work anywhere except Mac OS. This is not FOSS, just a startup that Apple is going to buy really soon and make it there cloud computing platform.