# Security Research & Disclosures

> Security research by Steven Foerster: public vulnerability analysis, Windows internals, research methods, and coordinated disclosures.

- Source: https://stevenfoerster.com/research/

Vulnerability research

I study the trust boundaries that privileged software quietly depends on: caller identity, authorization checks, memory ownership, and the assumptions between a public interface and the code that acts with greater authority.

This page contains public research only. Vendor-coordinated findings appear here after the corresponding security update is available; technical details follow the applicable disclosure and patch-adoption window.

Public work

## Methods, internals, and vulnerability analysis

Reproducible lab methods and analysis of already-public vulnerabilities. These pieces show the research process without previewing a finding under coordination.

Vulnerability analysis

### [Copy Fail and Dirty Frag: A Shared-Fragment Invariant](https://stevenfoerster.com/notes/copy-fail-and-dirty-frag-page-ownership-invariant/)

Copy Fail and Dirty Frag, three Linux CVEs in ten days, share one root cause: in-place crypto fast paths that write over paged fragments they do not own.

Pattern analysis of three Linux CVEs found and disclosed by other researchers. These are not my findings.

[Read the analysis](https://stevenfoerster.com/notes/copy-fail-and-dirty-frag-page-ownership-invariant/)

Supply-chain analysis

### [What the xz Backdoor Says About Open Source](https://stevenfoerster.com/notes/open-source-vulnerability-visibility/)

The xz incident shows why inspectability, release provenance, and independent verification matter, not that open source is inherently safer.

[Read the analysis](https://stevenfoerster.com/notes/open-source-vulnerability-visibility/)

Windows internals

### [Windows CFG and Hardware-Enforced Stack Protection (CET)](https://stevenfoerster.com/tutorials/windows-cfg-and-cet-mitigations/)

How Control Flow Guard validates indirect call targets, why it cripples JOP on Windows 8.1+, and how Win11 hardware shadow stacks layer on via Intel CET.

[Read the tutorial](https://stevenfoerster.com/tutorials/windows-cfg-and-cet-mitigations/)

Firmware research

### [Firmware RE with Binwalk and Ghidra](https://stevenfoerster.com/tutorials/firmware-extraction-and-reverse-engineering-with-binwalk-and-ghidra/)

Extract firmware from an IoT update file, unpack the filesystem, identify interesting binaries, and reverse engineer them in Ghidra to find bugs.

[Read the tutorial](https://stevenfoerster.com/tutorials/firmware-extraction-and-reverse-engineering-with-binwalk-and-ghidra/)

Research practice

## Publish the method. Coordinate the finding.

A live vulnerability stays private while the vendor investigates and prepares a fix. Public work during that period is limited to reusable methods that do not identify the affected product or make the finding reversible. After remediation, the public record begins with the vendor advisory and grows into a technical teardown only after the relevant patch-adoption window.

[Contact me about security research](https://stevenfoerster.com/contact/)