OpenSecurityTraining2

📢Call for beta testers!📢 The beta for "Trusted Computing 1102: Intermediate TPM Usage" will start Aug 1st. It will take ~7 hours to complete. If you're interested in participating, please sign up below. (Note: http://ost2.fyi/TC1101 is a prerequisite.) https://lnkd.in/emJ5e6cT Like TC1101, TC1102 has the goal of helping developers get bootstrapped on using TPMs more quickly than if they were to just rely on reading specification or API documents alone. Some people expected Platform Configuration Registers (PCRs) to be covered in TC1101. But that topic was held back for TC1102 so students could also cover not just PCR-based attestation/"quote", but TPM policy as well, and how that can affect PCRs. The topics for TC1102 are:  - Introduction to the Enhanced System API (ESAPI) and the tpm2-tss  - The Endorsement Hierarchy and the Endorsement Key  - Machine identity and TPM based identification  - What are Platform Configuration Registers (PCRs)  - What is attestation and how to use TPM2 Quote  - TPM Policy and extended authorization

🥳Today is OST2's 3rd anniversary!🎉 Buuut...we'll save most of the celebratory noise until next week, since Xeno Kovah just had an appendectomy and isn't in much of a "managing social media" mood ;)

It appears that the Open edX MySQL utf8mb4 incompatibility bug has re-emerged after our recent upgrade. This is causing breakage of the Vulns1001/2 classes which uses emojis in section titles. We're working to resolve this.

#OpenSecurityTraining2's 3rd anniversary since the relaunch is coming up next week! Now's a great time to let people know about all the free classes they could be taking over the summer to level up their security expertise! https://p.ost2.fyi

🔥 Summer's heating up, and so is the learning! VMware Workstation is now free, making it the perfect time to dive into hypervisor-based reverse engineering. Check out the free HyperDbg tutorial at OpenSecurityTraining2: https://ost2.fyi/dbg3301 (preferred) https://lnkd.in/g8ZcKMyY

The YouTube playlist for #OpenSecurityTraining2 “Exploitation 4011: Windows Kernel Exploitation: Race Condition + UAF in KTM” class by Cedric Halbronn is now public for those who like to download videos: https://lnkd.in/eMefSmDc But the best way to learn the material is with the full class at https://ost2.fyi/Exp4011. This class assumes you've already taken "x86-64 OS Internals" https://ost2.fyi/Arch2001, "Windows Kernel Internals 2" https://ost2.fyi/Arch2821, and "Advanced WinDbg" https://ost2.fyi/Dbg3011 This is an advanced level class that teaches you how to exploit a race condition vulnerability leading to a use-after-free in the Kernel Transaction Manager (KTM) component of the Windows kernel. This class is meant to show the approach an exploit developer should take in attacking a previously unknown component in the Windows kernel.

The production #OpenSecurityTraining2 server http://p.ost2.fyi was upgraded yesterday, and we will soon be able to make use of some features which were broken in the previous version of Open edX, such as making classes *public* so there is no need for registration to get to the content. Also manual assignment of completion certificates is once again possible, and therefore students who completed classes during betas will be given their completion certificates with production URLs.

📣Debuggers 1102: Introductory Ghidra released!📣 https://ost2.fyi/Dbg1102 This #OpenSecurityTraining2 class by Erin Cornelius and Xeno Kovah provides students with a hands-on introduction to Ghidra as a debugger, wrapping GDB or WinDbg, thus providing decompilation support. The class is now also incorporated into OST2 assembly classes like https://ost2.fyi/Arch1001 x86-64 Assembly, and https://ost2.fyi/Arch1005 RISC-V Assembly, so that students can do the final binary bomb lab reverse engineering exercise without, and with, decompilation support.

🎉#OpenSecurityTraining2 has reached 20k registered users!🥳 Thanks to all our volunteer instructors, students, and sponsors for their support! If you haven't taken a class yet, go check them out here: https://p.ost2.fyi

The playlist for the #OpenSecurityTraining2 "Architecture 2821: Windows Kernel Internals 2" class by Cedric Halbronn is now public for those who like to download videos. https://lnkd.in/e8c9THtC But as always the best class experience is with the full lab instructions at https://ost2.fyi/Arch2821