Denis Makrushin
Denis Makrushin
Denis is the Director of Security and Test Technology Center at Huawei, where he leads the team of top-talented experts focused on enabling innovation in trustworthiness for core products and services.
Contribution to Linux kernel: patch to fix fuzzing process with nyx-fuzz and VMware
With the latest Linux kernel, the fuzzing process will be easier not only for our team. Thanks to Denis Valeev, who discovered, prepared, and contributed the patch to kernel v.5.16.5.
The discovered bug breaks nyx-fuzz (also included in AFL++ code base) that uses VMware backdoor as an alternative way for hypercall from guest user-mode. With this bug, a hypercall is interpreted as a GP and leads to process termination. Bug occurs on GP triggered by VMware backdoor when eax value is unaligned. eax alignment check should not be applied to non-SVM instructions because it leads to incorrect omission of the instructions emulation. The solution is to apply alignment check only to SVM instructions.

The paper introduces the case study for attack surface analysis and monitoring with practical application of open-source intelligence (OSINT) methods. The case is based on the perimeters of healthcare organizations and aims to introduce the threat landscape of healthcare industry as well as methods to collect information about entry points and assets on network perimeter. Techniques and tools in this paper are not limited by organization type and can be applied for different network assets to prepare initial information during first stage of penetration testing and red team operations.
Prototype Pollution in “Top 10 Web Hacking Techniques of 2021” nomination
Prototype Pollution research, performed with co-authorship by @_nikitastupin in Advanced Security Research team, is nominated to “Top 10 Web Hacking Techniques of 2021”. The opportunity for bug hunter, who found the research insightful, to support authors: https://t.co/HC1mSKAVk4
— Denis Makrushin (@makrushind) January 12, 2022
Designed the “Application Security Fundamentals” course for Information Security students of my alma mater, I’m giving back and together with my friends from industry cultivate the design thinking of next generation alumni: shift the mindset from problem discovery to solution architecture.
Three years after launching, to increase the impact of this course, we made our lectures open to every Russian-speaking student. Just register yourself using the link from the first comment and wait for the announcement of open lecture tomorrow.
The photo illustrates how a typical class looks like – somewhere with laptop. Grab your device, headset and join!