Aleph Security
alephsecurity.com · Company blog · on HN since 2017
Aleph Security is a security research group publishing exploit write-ups on Android, Qualcomm firmware, Linux, and running iOS under QEMU.
What HN saysHN links it for its Nexus 6 boot and Qualcomm EDL findings and the XNU-on-QEMU work; one commenter compares the Nexus 6 flaw to older Motorola issues.
29HN people shared it
12linked it in comments
17stories submitted
128story points
8 months agolast shared
2017people per year2026
Most-shared posts
- 1Overcoming (some) Spectre browser mitigations5 people · 8 points · first shared 2018 · discussion on HN
- 2Xnu qemu arm64 15 people · first shared 2019
- 3Accelerating iOS on QEMU with hardware virtualization (KVM)4 people · 22 points · first shared 2020 · 5 comments on HN
- 4Running iOS in QEMU to an interactive bash shell3 people · 11 points · first shared 2019 · discussion on HN
- 5Attacking Nexus 9 with Malicious Headphones3 people · 9 points · first shared 2017 · discussion on HN
- 6Exploiting Qualcomm EDL Programmer Tools (1): Gaining Access and PBL Internals3 people · 3 points · first shared 2018 · discussion on HN
- 7Exploiting crash handlers: LPE on Ubuntu2 people · 4 points · first shared 2021 · discussion on HN
- 8Bypassing Nexus 6 Secure Boot Through Kernel Command-Line Injection2 people · 2 points · first shared 2017 · discussion on HN
- 9SuDump: Exploiting suid binaries through the kernel1 people · 62 points · first shared 2021 · 1 comments on HN
- 10Untethered initroot CVE-2016-102771 people · 3 points · first shared 2017 · discussion on HN
- 11Exploiting Qualcomm EDL Programmers1 people · 2 points · first shared 2018 · discussion on HN
- 12All OnePlus Devices Are Vulnerable to Downgrade Attacks1 people · 2 points · first shared 2017 · discussion on HN
What HN people wrote when they linked it
tripdout · 2026-03-15
Is Qualcomm serious? The kernel commandline parameter injection is basically the same thing from a decade ago on Motorola phones [0].
0: https://alephsecurity.com/2017/05/23/nexus6-initroot/
samueldr · 2021-09-16
Short answer "not really".
While it could be used to recover the phone, it requires a "programmer" program, which is signed by the vendor (Google, here) that hasn't been leaked.
Or, really, I should say that these programs should be made available as "software rights to repair".
---
Some reading:
https://alephsecurity.com/2018/01/22/qualcomm-edl-1/
A more up-to-date open source tool:
https://github.com/bkerler/edl/
EDIT:
see also this sibling (to you) reply:
- https://news.ycombinator.com/item?id=28545937
trollied · 2021-09-16
Previous thread from 18 months ago: https://news.ycombinator.com/item?id=22870905
Latest blog post: https://alephsecurity.com/2020/07/19/xnu-qemu-kvm/
zamadatix · 2021-09-16
The "this blogpost" link about KVM has the wrong domain, https://alephsecurity.com/2020/07/19/xnu-qemu-kvm/ for the post.
my123 · 2020-11-18
It's possible to get macOS arm64 working on Arm hardware (except Rosetta on Arm cores that don't implement TSO/SC, or you're stuck with a single core). However, Arm macOS assumes an Armv8.3-A architecture baseline. Patching at runtime from Armv8.3-A to v8.2-A is quite feasible, to 8.0-A like an RPi4 is another matter.
Of course, this will apply to VMs only (for now at least). https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/ was a good starting point for me.
qiqitori · 2020-11-12
Somewhat related (KVM for iPhone processors): https://alephsecurity.com/2020/07/19/xnu-qemu-kvm/
xvilka · 2020-07-11
There is a project [1][2] to emulate iOS in QEMU. You can find more details about installation process and research itself in their articles [3][4].
[1] https://github.com/alephsecurity/xnu-qemu-arm64
[2] https://github.com/alephsecurity/xnu-qemu-arm64-tools
[3] https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/
[4] https://alephsecurity.com/2019/06/25/xnu-qemu-arm64-2/
saagarjha · 2020-05-25
I just realized that my comment made it appear as if you can get a high-resolution timer without SharedArrayBuffer; I don't know of anyone who has done that yet. But people have made exploits that don't rely on it: https://alephsecurity.com/2018/06/26/spectre-browser-query-cache/
sanlyx · 2020-04-19
Not that I've heard of. Recently I stumbled upon this guy trying to get it to work in QEMU: https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/
albertzeyer · 2020-04-14
Probably the blog posts are a better starting point:
- https://alephsecurity.com/2019/06/25/xnu-qemu-arm64-2/
- https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/
- Here some more recent screenshots: https://twitter.com/JonathanAfek/status/1221719094661197825
MiroF · 2019-11-14
Here's an example of post-mitigation reading of protected memory using Javascript and Spectre https://alephsecurity.com/2018/06/26/spectre-browser-query-cache/
I think it's just silly that you would rely on browser mitigations like disabling high precision timers when that's obviously just a hack.
rgovostes · 2019-06-25
The Raspberry Pi has an ARM processor, while macOS requires an x86_64 processor, so you could not build a Hackintosh. One could conceivably run iOS, as enough is understood to emulate the OS on similar hardware (see https://alephsecurity.com/2019/06/17/xnu-qemu-arm64-1/).