starlabs

@starlabs_sg

A Singapore company that discovers vulnerabilities to help customers mitigate the risks of cyber attacks. Organisers of @offbyoneconf

Singapore

Joined September 2018

21Following

9KFollowers

starlabs@starlabs_sg · Jul 18

Proud of our team’s Top 100 achievement! Kudos to @cplearns2h4ck & @KaligulaSec for their contributions and dedication to responsible disclosure. 88 is a pretty auspicious number too. 🥳

SSecurity Response@msftsecresponse · Jul 17

Our previously published Most Valuable Researchers (MVR) leaderboard contained inaccuracies due to technical issues on our end. We apologize for the error and have since resolved the issue. We’re now sharing a fully refreshed and accurate leaderboard. The Microsoft Researcher…

5.0K

starlabs@starlabs_sg · Jul 16

CASE CLOSED: CVE-2025-29824 0 public samples, 0 information Suspect: Windows CLFS driver Crime: UAF leading to Privilege Escalation Status: ACTIVELY EXPLOITED ITW Investigation: Debugged and documented Case files: starlabs.sg/blog/2025/07-m… Done by our intern, Ong How Chong

starlabs_sg's tweet card. In April 2025, Microsoft patched a vulnerability that had become a key component in sophisticated ransomware attack chains. CVE-2025-29824, an use-after-free bug in the Windows Common Log File System...

162

16.0K

starlabs@starlabs_sg · Jul 10

One of our current intern, @goatmilkkk shared his Chrome-atic escape adventure using CVE-2024-30088 Epic obstacles documented in it too! starlabs.sg/blog/2025/07-f…

starlabs_sg's tweet card. For my internship, I was tasked by my mentor Le Qi to analyze CVE-2024-30088, a double-fetch race condition bug in the Windows Kernel Image ntoskrnl.exe. A public POC demonstrating EoP from Medium...

193

24.0K

starlabs@starlabs_sg · Jul 9

Our researchers, @KaligulaSec & @cplearns2h4ck were credited for 4 vulnerabilities in Microsoft this month. Huge congratulations to both of them for their exceptional work. 👏 msrc.microsoft.com/update-guide/v… msrc.microsoft.com/update-guide/v… msrc.microsoft.com/update-guide/v… msrc.microsoft.com/update-guide/v…

8.0K

starlabs Retweeted

Off-By-One Conference@offbyoneconf · Jun 16

@offbyoneconf 2025 Day 2 presentation videos are now available on our official YouTube channel! Subscribe, like 👍 and comment! lnkd.in/geDcTSsr

7.0K

starlabs@starlabs_sg · Jun 16

The Day 2 videos are finally out 🥳🥳

OOff-By-One Conference@offbyoneconf · Jun 16

@offbyoneconf 2025 Day 2 presentation videos are now available on our official YouTube channel! Subscribe, like 👍 and comment! lnkd.in/geDcTSsr

2.0K

starlabs Retweeted

Off-By-One Conference@offbyoneconf · Jun 16

@offbyoneconf 2025 Day 1 presentation videos are now available on our official YouTube channel! Subscribe, like 👍 and comment! lnkd.in/gi5jQBi4

6.0K

starlabs@starlabs_sg · Jun 16

The Day 1 videos are finally out 🥳🥳

OOff-By-One Conference@offbyoneconf · Jun 16

@offbyoneconf 2025 Day 1 presentation videos are now available on our official YouTube channel! Subscribe, like 👍 and comment! lnkd.in/gi5jQBi4

2.0K

starlabs@starlabs_sg · Jun 5

When life gives you tangerines🍊 Intern Lin Ze Wei's task: Port a 2-bug exploit to Pixel 6 Pro Problem: One bug "doesn't work" Solution: Make it work with 1 bug Sometimes the best research comes from working with what you think you have starlabs.sg/blog/2025/06-s…

starlabs_sg's tweet card. During my internship I was tasked to analyze a Mali GPU exploit on Pixel 7/8 devices and adapt it to make it work on another device: the Pixel 6 Pro. While the exploit process itself is relatively...

143

15.0K

starlabs@starlabs_sg · Jun 4

After almost 8 months of coordinated disclosure, vulnerabilities in Trend Micro Apex Central discovered by our former colleague @Chocologicall have been resolved! ZDI advisories: ZDI-25-295, ZDI-25-296, ZDI-25-297, ZDI-25-236, ZDI-25-237

4.0K

starlabs@starlabs_sg · Jun 3

After 6 months of responsible disclosure, proud to announce our team discovered 13 (mostly exploitable) vulnerabilities in Samsung Exynos processors! Kudos to @st424204, @n0psledbyte, @Peterpan980927 & @rainbowpigeon_ CVE-2025-23095 to CVE-2025-23107 📍 semiconductor.samsung.com/support/qualit…

156

20.0K

starlabs@starlabs_sg · May 30

"Why is my exploit taking 10 minutes?" *checks logs* *sees 10,000 kernel warnings* "...oh" 💡 Fresh Friday night read: our intern, Tan Ze Jian, on Mali exploitation - sometimes the fix is simpler than you think! starlabs.sg/blog/2025/05-g…

starlabs_sg's tweet card. As part of my internship at STAR Labs, I was tasked to conduct N-day analysis of CVE-2023-6241. The original PoC can be found here, along with the accompanying write-up. In this blog post, I will...

114

6.0K

starlabs Retweeted

Trend Zero Day Initiative@thezdi · May 17

Pwn2Own Berlin 2025 comes to a close. We awarded $1,078,750 for 28 unique 0-days. Congrats to @starlabs_sg for winning Master of Pwn with $320,000. Thanks to @offensive_con for hosting, and thanks to all who participated. Can't wait to see you next year! #Pwn2Own #P2OBerlin

219

30.0K

starlabs Retweeted

Jacob Soo@_jsoo_ · May 17

Big shoutout to @hi_im_d4rkn3ss & @gerrard_tai for flying over & represent us To our 1st-timers Gerrard @cplearns2h4ck @MochiNishimiya for the awesome work To @n0psledbyte & @st424204 for guiding the next gen & @_piers2 @bruce30262 who are part of it Lets continue trying #Pwn2Own

5.0K

starlabs Retweeted

Trend Zero Day Initiative@thezdi · May 17

Confirmed!! Dung and Nguyen (@MochiNishimiya) of STARLabs used a TOCTOU race condition to escape the VM and an Improper Validation of Array Index for the Windows privilege escalation. They earn $70,000 and 9 Master of Pwn points. #Pwn2Own

111

9.0K

starlabs Retweeted

Trend Zero Day Initiative@thezdi · May 16

Confirmed! Gerrard Tai of STAR Labs SG Pte. Ltd used a Use-After-Free bug to escalate privileges on Red Hat Enterprise Linux. Their third-round win earns them $10,000 and 2 Master of Pwn points.

100

9.0K

starlabs Retweeted

Trend Zero Day Initiative@thezdi · May 16

Outstanding! Nguyen Hoang Thach (@hi_im_d4rkn3ss) of STARLabs SG used a single integer overflow to exploit #VMware ESXi - a first in #Pwn2Own history. He earns $150,000 and 15 Master of Pwn points. #P2OBerlin

273

22.0K

starlabs Retweeted

Trend Zero Day Initiative@thezdi · May 15

Nicely done! Billy (@st424204) and Ramdhan (@n0psledbyte) of STAR Labs used a UAF in the Linux kernel to perform their Docker Desktop escape and execute code on the underlying OS. They earn $60,000 and 6 Master of Pwn Points.

2.0K

starlabs Retweeted

Trend Zero Day Initiative@thezdi · May 15

Confirmed! Chen Le Qi (@cplearns2h4ck) of STARLabs SG combined a UAF and an integer overflow to escalate to SYSTEM on #Windows 11. He earns $30,000 and 3 Master of Pwn points. #Pwn2Own #P2OBerlin

9.0K

starlabs@starlabs_sg · May 14

Just dropped a blog post on a fun bug that our (former since it's reported long long time ago) intern, Devesh Logendran found in Visual Studio Code <= 1.89+ We hope you will have fun reading it. starlabs.sg/blog/2025/05-b…

starlabs_sg's tweet card. In April 2024, I discovered a high-severity vulnerability in Visual Studio Code (VS Code <= 1.89.1) that allows attackers to escalate a Cross-Site Scripting (XSS) bug into full Remote Code Execution...

8.0K