Allen Own (@allenown) header
Allen Own (@allenown) profile picture

Hacking at DEVCORE. https://teapawt.net/t.co/TDINu5cwGW @d3vc0r3

Taiwan
Joined June 2007
Photo by Allen Own (@allenown)Photo by Allen Own (@allenown)Photo by Allen Own (@allenown)Photo by Allen Own (@allenown)Photo by Allen Own (@allenown)Photo by Allen Own (@allenown)Photo by Allen Own (@allenown)Photo by Allen Own (@allenown)Photo by Allen Own (@allenown)Photo by Allen Own (@allenown)
Allen Own retweeted
Our researchers HexRabbit(@h3xr4bb1t) and NiNi(@terrynini38514) are speaking at #POC2026: “Obvious Was Only the Beginning: A WebKit Exploit Chain for #Pwn2Own” With LLMs advancing this fast, where does AI have the edge, and where do humans still lead? powerofcommunity.net/talk/20…
17
83
4,175
Allen Own retweeted
[VXCON 2026] Celebrating 16 Years of Hacking: Deep-Dive into Exclusive Offensive Security & AI Tracks (Register Now!) Dear Cybersecurity Professional, The wait is over. VXCON is returning for its landmark 10th Anniversary edition this November 28–29, 2026, in Hong Kong. Since our journey began in 2010, VXCON has dedicated the last 16 years to building an elite community of white-hat hackers, malware analysts, reverse engineers, and offensive security researchers. To celebrate this milestone, we are bringing together global trail-blazers who frequently speak at Black Hat, DEF CON, and HITCON. They will break down live vulnerabilities, exploit pathways, and hardware weaknesses you won’t see anywhere else. Secure your seat today to learn from the best in the industry: vxcon.hk Featured Keynotes & Technical Briefings Our 2026 lineup features exclusive research spanning OS kernels, automated AI hacking agents, automotive systems, and critical infrastructure. 🛡️ Windows Kernel & Browser Exploitation • Angelboy (MSRC Top 100) covers cross-component vulnerabilities in the Windows Ancillary Function Driver (AFD), detailing transport-layer gadgets and sandbox escapes via Zoom. • MinJeong Kim explores variant hunting in WebKit by tracing patches to root causes and introduces the AI-driven WebKit Weekly framework. 🤖 The Frontier of AI & Automation in Security • Wonyoung Jung debuts a hybrid LLM and program analysis framework to automate patch diffing and N-day PoC generation. • Donghyeon Kim & Prof. Insu Yun (KAIST Hacking Lab) break down an autonomous agent that tackled CODEGATE 2026 challenges. 🚗 Automotive, Hardware, & Infrastructure (OT) Security • Dr. Camille Gay & Alina present exclusive car hacking and vehicle network research. • Edward Lee (OPCIA) demonstrates how to extract operational tags from proprietary OT traffic and detect unauthorized PLC modifications. • Iceman dives into signaling vulnerabilities, RFID exploitation, and new analysis hardware. Day 2: Hands-On Interactive Workshops • Bootrom Dumping: xenocidewiki (Secret Club) leads a hardware workshop on dumping encrypted pet firmware from a Tamagotchi Paradise via UART/SWD analysis. • Hardware & RFID: Led by Iceman. • Car Hacking: Led by Dr. Camille Gay & Alina. Event Logistics & Venues • Day 1 (Nov 28, 2026): Main Briefings at Marco Polo Hongkong Hotel (google.com/search?kgmid=%2Fg…) (Centenary Room II-III), including a network buffet lunch. • Day 2 (Nov 29, 2026): Workshops & Village (10:00 - 18:00) at JobsDB by SEEK (google.com/search?kgmid=%2Fg…), PCCW Tower, Quarry Bay. Registration Details Seating is limited. Secure your pass at vxcon.hk. For inquiries, contact [email protected]
1
7
1
10
1,105
Allen Own retweeted
The Last Proof of Human Craft by Orange Tsai 🍊 (@orange_8361)
1
27
9
350
31,599
Allen Own retweeted
Orange Tsai (@orange_8361) is taking the #HEXACON2026 stage on Oct 16 in Paris with the logic-only Microsoft Edge full chain he used at #Pwn2Own Berlin 2026.🍊🏆 Five logic bugs, chained. No renderer bugs, no memory corruption, no AI, no collisions.
3
36
3
284
9,076
Allen Own retweeted
DEVCORE CONFERENCE 2027 | CFP is open #Redteam, #VulnerabilityDiscovery, #Physicalsecurity, firmware and hardware RE, #AI attack surfaces. Bring the research that starts from a hacker's view. Deadline: Oct 11, 2026, 23:59 GMT+8 sessionize.com/devcoreconfer…
8
1
27
5,507
My third @PwnieAwards trophy! Thanks all, and to my friends who grabbed it on stage for me! 🦄🏆
9
40
621
31,953
Allen Own retweeted
今年的 Pwn2Own Berlin,報名爆滿到有人準備好了漏洞,卻連正式賽程都進不去。 但這些沒能在賽場公開的研究,並沒有就此消失。 其中兩組研究團隊,直接把原本準備好的攻擊鏈帶來 HITCON。再加上 Orange 正式參賽並協助 DEVCORE 拿下 Master of Pwn 的成果,今年一次可以看到三場與 Pwn2Own Berlin 密切相關的議程。 【Orange:不用 AI,四個邏輯漏洞逃出 Edge 沙箱】 🍊 ↖乂古法挖洞乂↘ ~~ 純邏輯 Microsoft Edge 零點擊沙箱逃逸鏈 ~~ 講者:Orange Tsai 這是三場中唯一正式登上 Pwn2Own Berlin 2026 賽場的研究。 沒有 AI,也沒有 Memory Corruption。Orange 串起四個邏輯漏洞,完成 Microsoft Edge 0-Click 沙箱逃逸。 這是十年來第一個在 Pwn2Own 挑戰成功的 Chromium-Based Full Chain,也是該屆唯一成功的瀏覽器項目。相關漏洞揭露後,微軟在 24 小時內完成修復。 【KVM:準備好 Full-Chain,卻擠不進正式賽程】 🖥 Pwn2OwNothing: When a KVM Full-Chain Escapes to Emptiness 講者:Bruce Chen、Pan Zhenpeng、Weiming Shi、Jheng Bing Jhong 團隊原本鎖定 Pwn2Own Berlin 的 RHEL QEMU-KVM 目標,卻因報名爆滿、名額有限,最後未能進入正式賽程。 這次,他們將在 HITCON 公開這條原本為比賽準備的攻擊鏈,說明如何從虛擬機內部突破隔離,進一步達成跨租戶程式碼執行(Cross-Tenant Code Execution)。 【Agent2Shell:Prompt 還沒送進模型,RCE 就先發生】 🤖 [UnPwn2Own Berlin 2026 / $70,000] Agent2Shell: Pre-Prompt RCEs in Claude Code, Cursor, and Gemini 講者:Satoki Tsuji Guardrail 擋得住送進模型的內容,但如果 Payload 根本不必經過模型呢? 使用者只要開啟攻擊者準備的 Repo,甚至雙擊一個檔案,就可能在完整更新的 Windows 上觸發 RCE。 這套研究原本是為價值 70,000 美元的 Pwn2Own Berlin 目標準備,最後未能進入正式賽程,並以「UnPwn2Own」之名公開。 Satoki Tsuji 將在 HITCON 拆解 Claude Code、Cursor 與 Gemini 的 Pre-Prompt 攻擊面,帶大家理解 0-click、1-click 漏洞如何一路串成 RCE。 一場正式拿下 Pwn2Own,兩場準備好漏洞卻沒能進場。 賽場排不下的攻擊鏈,HITCON 接著講。 你最想先聽哪一場? 📅 HITCON 2026:8 月 21 日- 8 月 22 日 🔎 完整議程:hitcon.org/2026/zh-TW/agenda… 🎫 購票連結:hitcon.kktix.cc/events/hitco… #HITCON2026 #HITCON #Pwn2Own #漏洞研究 #AISecurity
15
8
2
101
12,132
Allen Own retweeted
My #BHUSA 2026 slides are online! It was an honor to share our AFD research and how a different perspective led to 30+ Windows kernel vulnerabilities. Blog post coming soon — check out the slides here: i.blackhat.com/BH-USA-26/Pre…
4
147
6
519
72,973
We're excited to highlight 2026 Microsoft Most Valuable Researcher Angelboy (@scwuaptx), who presented at Black Hat USA this week. Drawing on years of Windows security research, Angelboy shared how vulnerabilities can emerge from unexpected interactions between drivers, transports, and system components, even within attack surfaces that have been studied extensively. His talk discussed a new way of thinking about vulnerability discovery, demonstrating how researchers can uncover overlooked paths to privilege escalation and sandbox escape by examining systems across layers rather than in isolation.
1
15
88
8,039
Allen Own retweeted
Two of our researchers hit the #BHUSA stage for the first time. Angelboy(@scwuaptx ) shares how a different angle on AFD led to 30+ new #Windows kernel vulnerabilities. Splitline(@_splitline_ ) exposes backdoor risks in Go, Python & Flutter pipelines. #VulnerabilityResearch
1
10
86
3,961
That's a wrap on Pwn2Own Berlin 2026! 🏆 $1,298,250 awarded. 47 unique 0-days. 3 days of absolute chaos. And talk about main character energy - congrats to DEVCORE for claiming Master of Pwn with 50.5 points and $505,000 - they never slowed down. See you next year! #Pwn2Own #P2OBerlin
22
92
16
668
88,279
Aaaand it's official! Orange Tsai (@orange_8361) of DEVCORE Research Team chained 3 bugs to achieve Remote Code Execution as SYSTEM on Microsoft Exchange, earning a whooping $200,000 and 20 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
26
174
60
1,543
287,480
What an exciting Day! After Day One, we awarded $523,000 for 24 unique 0-days! DEVCORE (@d3vc0r3) is currently in the lead for Master of Pwn, but a pack of teams are right on their heels. Stay tuned tomorrow for more results and surprises. #Pwn2Own #P2OBerlin
3
20
1
156
10,385
That's my chain — a full chain w/ logic bugs only! No memory corruption, no AI, and of course no collisions at all 😉
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
108
361
41
2,580
225,116
DEVCORE is having a day! Confirmed: Angelboy (@scwuaptx) & TwinkleStar03 (@_twinklestar03) of DEVCORE Research Team used an Improper Access Control bug to escalate privileges on Microsoft Windows 11, earning $30,000 and 3 Master of Pwn points. Full win, let's go! 🔥 #Pwn2Own #P2OBerlin
23
1
176
11,386
Confirmed! Orange Tsai (@orange_8361) of DEVCORE Research Team (@d3vc0r3) chained 4 logic bugs to achieve a sandbox escape on Microsoft Edge, earning $175,000 and 17.5 Master of Pwn points. Full win! #Pwn2Own #P2OBerlin
30
157
24
1,183
242,076
Allen Own retweeted
🎃Chih-Yen Chang(@u1f383) - Modern Android Kernel Exploitation Through a Mali Driver Vulnerability
20
147
8,259
Allen Own retweeted
DEVCORE CONFERENCE 2026 wrapped. From PhaaS to React2Shell, we shared offense-driven security insights with the community. Big shoutout to all speakers for the incredible talks! @Se7en_5_Sec @xiaobye_tw @_splitline_ @joeychennoGG @_twinklestar03 @aszx87410 @g1n04h @maple3142
4
18
1,397
Allen Own retweeted
DEVCORE CONFERENCE 2026 is this Saturday! We’re ready to welcome everyone as we dive into offensive techniques, exploring the latest vulnerability research and real-world red team assessment cases. View the agenda and our speaker lineup: conf.devco.re/2026/en/agenda… #redteam
2
20
1,427