About me
I am Björn Ruytenberg, MSc student in Computer Science and Engineering at TU/e and RU. Being a technology enthusiast, I hold a BSc in Electrical Engineering as well as Computer Science (cum laude). Currently, I am writing my MSc thesis, which will include my work on Thunderspy. Aside from my studies, I enjoy participating in bug bounty programs. My vulnerability research mainly focuses on hardware and firmware security, as well as sandboxing technology and input validation in widely deployed enterprise products. Previously, I have been a teaching assistant for Parallelization, Compilers and Platforms (5LIM0) and Networks and Security (3USU0).
You can get in touch with me by email at bjorn bjornweb nl (PGP), Twitter (@0Xiphorus), and Freenode IRC (Xiphorus).
Blog
My blog is a collection of articles. Here are the most recent entries:
- Playing in the Remote Sandbox: Adobe Flash Windows User Credentials Disclosure Vulnerability (CVE-2017-3085)
- Adobe Flash: Bypassing the local sandbox to exfiltrate data, obtain Windows user credentials (CVE-2016-4271)
- Foxit Reader: Bypassing the Safe Mode sandbox to execute arbitrary code, exfiltrate data (ZDI-16-395)
Security vulnerabilities
I report security vulnerabilities whenever I find them. Some are listed below:
- CVE-2018-12402 - Mozilla Firefox WebBrowserPersist uses incorrect origin information
- CVE-2017-4939 - VMware Workstation DLL Hijacking Arbitrary Code Execution
- SSD-3463 - Microsoft Office Host Machine Information and Windows User Credentials Disclosure
- CVE-2017-3085 - Adobe Flash Remote Sandbox Windows User Credentials Disclosure
- CVE-2016-4271 - Adobe Flash Local Data Exfiltration and Windows User Credentials Disclosure
- ZDI-16-395 - Foxit Reader Arbitrary Code Execution and Information Disclosure
Talks
- When
Lightning Strikes Thrice: Breaking Thunderbolt 3 Security
Peer-reviewed conference talk at Black Hat USA (08/2020) - Slides - Playing in the Sandbox:
Adobe Flash Exploitation Tales (updated)
Peer-reviewed conference talk at CONFidence, Krakow (06/2019) - Slides - Playing
in the Sandbox: Adobe Flash Exploitation Tales
Peer-reviewed conference talk at AsiaSecWest, Hong Kong (06/2018) - On
the Spectre of Meltdown: Analysing the Attacks and Mitigations
Seminar talk at department of Mathematics and Computer Science, TU/e (05/2018) - Slides
Guest lecture for Embedded Systems graduate course on Parallelization, Compilers and Platforms, TU/e (03/2018) - Playing in the Sandbox:
Bypassing Adobe Flash Input Validation
Invited talk at OWASP Netherlands Chapter Meeting, Radboud University Nijmegen (10/2017) - Slides - Scribbles:
Dissecting the Vault7 Office Tracker Implant
Information Security seminar, Eindhoven University of Technology (06/2017) - Slides