James Forshaw :donor:

Security researcher in Google Project Zero. Author of Attacking Network Protocols. Tweets are my own etc.

Github: https://github.com/tyranid
Blog: https://www.tiraniddo.dev/

Public Key

npub1wp4gyc9xmkjxl0vpxpmv0hmsw25uyhvwnynewn5mrj8s66v8ku6sesejcr

NIP-05 Address

[email protected]

Profile Code

nprofile1qqs8q65zvzndmfr0hkqnqak8mac892wztk8fjfuhf6d3ercddxrmwdgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntnglh89

Publishing to

relay.momostr.pink

Author Public Key

npub1wp4gyc9xmkjxl0vpxpmv0hmsw25uyhvwnynewn5mrj8s66v8ku6sesejcr

Show more details

Last Notes

2026-07-27 17:32:31 GMT

Currently implementing an airgapped network by adding two network cards to a macbook air and turning on IP forwarding.

2026-07-25 18:41:42 GMT

- reply

considering Linus's recent stance on AI, perhaps Debian Hurd is the only option :)

2026-07-20 16:16:50 GMT

- reply

that's because CA is the only state which mandates a hand gun must be dishwasher safe, but due to the gun roster you can only buy 3rd gen so they can't enforce it.

2026-04-07 08:32:00 GMT

I've put up the slides from my Zer0Con 2026 presentation on Administrator Protection. https://github.com/tyranid/infosec-presentations/blob/master/Zer0Con/2026/Protecting%20your%20Administrator.pdf

2026-04-06 19:11:33 GMT

- reply

the real question, is "gib" pronounced with a hard g like gif, or a soft g like gif?

2026-02-26 19:51:32 GMT

My final blog related to admin protection is up. https://projectzero.google/2026/02/gphfh-deep-dive.html I go into a bit of history of the interesting GetProcessHandleFromHwnd API, how it ended up allow you to bypass protected process restrictions and how it's now "fixed".

2026-01-26 18:37:06 GMT

My first blog post on Windows Administrator Protection is out. https://projectzero.google/2026/26/windows-administrator-protection.html probably the most interesting and complex bug out of the 9 I found, but that doesn't mean the rest weren't interesting as well, stay tuned :D

2025-12-16 23:17:22 GMT

Project Zero have finally got around to updating the blog to something less blogger-esc, check it out at https://projectzero.google. To coincide with this momentous occasion I dug out the draft of my blog post about Windows Object Manager performance which became the basis of my article in PoC||GTFO #13 and updated it to see if it still worked in Windows 11. You can read it at https://projectzero.google/2025/12/windows-exploitation-techniques.html

2025-11-23 17:35:50 GMT

- reply

the most concerning part of admin protection's design was just that UI Access seemed to not considered part of the boundary. Of the 9 bugs I reported, 5 were basically ways of getting control over a UI Access process and from there full admin. I think if you're going to break app compat anyway you might as well have done something more than UAC with bells on it.

2025-11-21 20:10:32 GMT

I wasn't imagining things, Administrator Protection has indeed been pulled for now. https://learn.microsoft.com/en-us/windows/security/application-security/application-control/administrator-protection/?tabs=intune#system-requirements

2025-11-12 22:47:01 GMT

Neat!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/539/153/487/976/845/original/2a90f7a4e81197fa.png

2025-10-29 10:17:47 GMT

Administrator Protection has finally been released in KB5067036. This is an optional update, but it does fix 7 of the 9 issues that I reported to MSRC (hopefully the other 2 get fixed next month as security bulletins). I honestly don't know if they've actually fixed the SSPI issues like my Kerberos bypass or not, I'm not inclined to check. People should kick the tyres on it, maybe there's still some bounties to be had :D

2025-10-24 18:48:49 GMT

- reply

unsafe BinaryFormatter usage has been on the shit list for at least a decade, this should have been found in less than a hour with grep. This should never have been in the code so long, it should have been audited out.

2025-10-24 18:32:46 GMT

- reply

honestly, just calling the bug RCE almost undersells the damage this bug can do. Such as stupid bug as well.

2025-10-20 15:10:46 GMT

Honestly, WTF Microsoft. https://hawktrace.com/blog/CVE-2025-59287

2025-10-15 15:20:49 GMT

RE: https://infosec.exchange/@tiraniddo/115295709143228986
Well, Windows Administration Protection still hasn't been released even though technically 25H2 has. So none of those 6 bypasses have been fixed, but then again there's no code to bypass, so.... At least some of them are fun UAC bypasses :)
#note1cqj…0fdz

2025-09-30 22:55:05 GMT

Seems Windows 11 25H2 is finally rolling out, and they're shipping the new Administrator Protection feature. Hopefully MS should have fixed 6 bypasses I found in it during insider preview :D

2025-09-24 06:22:59 GMT

- reply

creative for sure, but I wonder if there's not other places that could force a process to suspend at least if you already have admin access. Ultimately EDR lives and dies by it's ability to catch the malware before it disables the EDR. Not sure how MS would fix this in the OS.

2025-09-17 18:05:01 GMT

- reply

Errata ID [sic] is just too complex for it's own good. It's like they looked at AD, and went "What if more, and harder to reason about", then bolted on on-prem AD connection for good measure.

2025-08-13 11:57:32 GMT

- reply

such a valuable feature then, but I shouldn't need to do stupid approaches to bypass it. Honestly I wouldn't really care if it blocked "adult content" in the feed, as that could always be disabled. But I have no idea what they were thinking when they decided that DMs were needing of age verification.

2025-08-13 11:37:06 GMT

While I've always focussed on using Mastodon I did try and give Bluesky a go, but the community doesn't seem there and I never got much engagement on security topics. Bluesky's decisions regarding the stupid UK's Online Safety Act to make DMs locked behind age verification is the final straw, so I've deactivated the account and maybe it'll get deleted eventually. I'll go back to not posting anything exclusively on here :D

2025-04-25 19:39:08 GMT

- reply

"Gone are the days of trying to memorize and remember file names or exact words. With improved Windows search..." we can shove AI generated garbage straight from Bing to your eyeballs with no way of disabling any of it if all you wanted was finding your own files.

2025-04-22 19:24:48 GMT

- reply

I still can't quite believe _this_ was their fix.

2025-04-17 15:28:47 GMT

- reply

I never managed to the get the updated version working on the ARM CoPilot laptop I bought specifically for that purpose. I don't know of any current write ups other than the puffery from MS.
I'd certainly focus on the encryption, how it ties into Windows Hello, whether there's any obvious bypasses and also whether you can still hoover up the details _if_ the user has unlocked it first (as in how hard is it to access the database once the key is available).

2025-01-30 18:35:20 GMT

The second blog is about an interesting bug class in COM servers that implement IDispatch, which allows you to potentially create other objects in the process. For example every OOP COM server with IDispatch allows you to create a STDFONT object which isn’t really designed to be safely used cross process. To demo its usefulness I then use the trick to get code injection in a Windows-PPL process from where you could open protected LSASS etc. https://googleprojectzero.blogspot.com/2025/01/windows-bug-class-accessing-trapped-com.html

2024-12-12 23:32:48 GMT

A companion blog to my Bluehat 2024 presentation on OleView.NET is up now. https://googleprojectzero.blogspot.com/2024/12/windows-tooling-updates-oleviewnet.html

2024-12-09 14:05:08 GMT

- reply

I had no idea they released Otomedius outside Japan, tis weird, but no less weird and kinky than its Parodius predecessor, especially Sexy Parodius :)

2024-12-02 23:25:29 GMT

- reply

FFS

2024-11-29 16:19:09 GMT

- reply

comical :D

2024-11-29 03:52:28 GMT

- reply

as far as I know mine doesn't crash but it's still yet to capture a single snapshot. I did take a look an the enclave binaries though, first (and minimal) pass seems it's "maybe better", at least no obvious bug assuming they're using it correctly.

2024-11-25 02:46:54 GMT

Awesome that MS are supported and documenting VBS enclaves properly now *apropos of nothing in particular*. https://learn.microsoft.com/en-us/windows/win32/trusted-execution/vbs-enclaves-dev-guide. Also awesome that in the example exported entry point they provide they don't seem to mention how careful you need to be with the input pointer that you don't just read/write enclave memory :)

2024-11-07 21:46:22 GMT

- reply

actually scratch that, it seems that this feature was removed from Windows 11, boo :|

2024-11-07 21:39:46 GMT

- reply

what would be fun is to deploy the undocumented "adminless" mode through a code integrity policy. That basically disables the administrator group SID, so it might look like you're an admin but only SYSTEM is really an admin :D

2024-11-07 15:43:53 GMT

- reply

for now at least you can uninstall notepad (right click the start icon and choose uninstall) and it'll revert to the classic version. How long that lasts I don't know. Also it breaks it being used as a target for opening .txt files as modern explorer is garbage.

2024-10-31 01:39:55 GMT

Put up the slides for my Bluehat 2024 presentation on improvements to OleView.NET https://github.com/tyranid/infosec-presentations/blob/master/Bluehat/2024/DCOM%20Research%20for%20Everyone!.pdf You can also grab v1.15 of OleView.NET from the PS Gallery which has the new features to generate proxy clients on the fly.

2024-10-15 03:47:10 GMT

The new Windows 11 Admin approval mode certainly needs some tweaking. Currently you're required to elevate taskmgr, which only used to be the case if you disabled auto-elevation. Why taskmgr starts elevated is one of Microsoft's many dumb decisions in Windows 10.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/309/383/889/473/450/original/d025c40fa17de73e.png

2024-10-02 09:35:14 GMT

Now this is interesting, Windows 11 24H2 allows you to connect to an SMB server with an arbitrary TCP port. Could come in handy ;-)
https://techcommunity.microsoft.com/t5/storage-at-microsoft/smb-alternative-ports-now-supported-in-windows-insider/ba-p/3974509

2024-09-02 17:36:33 GMT

- reply

from the article "a sentencing hearing was postponed for a 12-year-old boy who admitted taking part in two separate incidents of disorder in Manchester because his mother had gone on holiday to Ibiza". Hmm I wonder what could possibly be the root problem of the boys misdeeds?

2024-06-05 21:05:23 GMT

Damn, I really thought the Recall database security would at least be, you know, secure. Turns out Microsoft did pretty much what I blogged about for WindowsApps, except you need to find a specific WIN://SYSAPPID instead. So to bypass the security just get the token for the AIXHost.exe process, then impersonate that and you can access the database, no admin required. Or, as the files are owned by the user, just grant yourself access using icacls etc :D