Synacktiv

Another favorite, https://www.synacktiv.com/publications/cool-vulns-dont-live-long-netge… the router sniffed plaintext http to grab HTTP User agents to put them into a curl bash command line string. Nice RCE from the browser.

There are some kinds of heap isolation worth doing, eg some mentioned in https://www.synacktiv.com/sites/default/files/2022-10/attacking_safari… But the good ones rely on PAC (pointer signing), which comes from CHERI and x86 doesn't have it.

Look up "eBPF rootkits" This is a good article about one found in the wild: https://www.synacktiv.com/en/publications/linkpro-ebpf-rootkit-analysi…

The folks at Synaktiv had a nice detailed blog post on this same vector last year[1]. The bottom line with these kinds of things is that virtually nobody should be using `pull_request_target`, even with “trusted” machine actors like Dependabot. It’s a pretty terrible footgun. [1]: https://www.synacktiv.com/en/publications/github-actions-exploitation-…

Fixed link: https://www.synacktiv.com/en/publications/github-actions-exploitation-…

But then you could compromise the GPU, probably :) Look at the bootloader, can you open a console? If not, can you desolder the flash and read the key? If not, can you access the bootloader when the flash is not detected anymore? ... Can you solder off the capacitors and glitch the power line, to do a [Voltage Fault Injection](https://www.synacktiv.com/en/publications/how-to-voltage-fault-injecti… Can you solder a shunt resistor to the power line, observe the fluctuations and do [Power analysis](https://en.wikipedia.org/wiki/Power_analysis)? There are a lot of doors and every time someone closes them a window remains tilted.

For those looking for more info: https://blog.grimm-co.com/2020/07/dji-privacy-analysis-validation.html https://www.synacktiv.com/en/publications/dji-pilot-android-applicatio… https://www.nytimes.com/2020/07/23/us/politics/dji-drones-security-vul…

Some encodings add a prefix, which then get sanitised by the liberal base64_decode. https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it…

There's a detailed writeup mentioned in the post https://www.synacktiv.com/sites/default/files/2023-01/sudo-CVE-2023-22…

The linked URL is incomplete, this is probably the correct one: https://www.synacktiv.com/en/publications/dumping-the-sonos-one-smart-…

>DJI Android GO 4 application security analysis https://www.synacktiv.com/en/publications/dji-android-go-4-application… >DJI Privacy Analysis Validation https://blog.grimm-co.com/2020/07/dji-privacy-analysis-validation.html

TL;DR background for this one: there existed a zero day bug in iOS 11 related to how the kernel processed the lio_listio call. Apple fixed it then but introduced a memory leak. In iOS 13 Apple fixed the memory leak but reintroduced the vulnerability. The regression was found and packaged in a obfuscated jailbreaking tool (unc0ver); this post explains how the tool was deobfuscated. This resulted in an "emergency" iOS 13.5.1 update to fix the issue. Interestingly this fix still does not fully fix the memory leak: https://www.synacktiv.com/posts/exploit/the-fix-for-cve-2020-9859-and-…

Two related links previously on HN (no comments): Introducing the Memory Process File System for PCILeech http://blog.frizk.net/2018/03/memory-process-file-system.html Using your BMC as a DMA device: Plugging PCILeech to HPE ILO 4 https://www.synacktiv.com/posts/exploit/using-your-bmc-as-a-dma-device…

Synacktiv | System engineer, Pentester, Reverser and more | Paris, Toulouse, Lyon - France | ONSITE or REMOTE | https://www.synacktiv.com/en/ Synacktiv is an IT security company, founded in 2012 by consultants with more than 13 years of experience in security consulting and auditing, with a real passion for IT security. We are actually looking for growing our technical teams (system engineer, pentester, reverser) and are ready to onboard on one of our office located in France (HQ - Paris, Lyon or Toulouse). Some remote position could be allowed. Apply here [email protected] or reach me directly using my profile contact information if you need more information.

GrapheneOS provides massive security improvements over Android. You should read https://grapheneos.org/features#exploit-protection for an overview. Cellebrite quite clearly puts substantial effort into targeting GrapheneOS, much more than they do into targeting variants of Google Mobile Services Android across devices. Cellebrite provides much more detailed information and comparisons for GrapheneOS than any other variant of Android. One of the biggest security improvements for exploitation is GrapheneOS using hardware memory tagging (ARM MTE) in the main kernel and userspace allocators for all of the base OS. GrapheneOS nearly entirely eliminates the attack vector used by Cellebrite Premium by default via software and hardware blocking of new USB connections while locked along with hardware-level disabling of USB data if there are no existing USB connections. Cellebrite's recent documentation shows they can't currently exploit an unlocked GrapheneOS device when the password is obtain from the user which shows that it's not all about the USB protection at all. They were unable to exploit GrapheneOS prior to the replacement of software blocking of new USB peripherals with the much more complete current implementation of USB attack surface reduction blocking USB peripherals, USB gadgets and USB-C alternate modes at both the software and hardware level along with disabling USB data at a hardware level. They were last able to exploit locked GrapheneOS devices in 2022, possibly…

Christmas CTF https://twitter.com/sudosev/status/1075213434273320960 https://pastebin.com/raw/7VL6usg6 https://pastebin.com/raw/Sm9PCxWv https://twitter.com/sudosev/status/1079069504498556930 HACKvent 2018 https://hackvent.hacking-lab.com SANS Holiday Hack Challenge 2018 https://www.holidayhackchallenge.com/2018 GreHack 2018 https://2018.challenge.grehack.fr writeup https://www.synacktiv.com/posts/challenges/grehack-2018-qualification-… CSAW Red Team Competition 2018 https://red.csaw.io/challenges Hacktober.org https://hacktober.org Advent Calendar of Advanced Cyber Fun 2018 https://xmas.rip repository https://github.com/takeshixx/advent-calendar-2018 writeup https://gist.githubusercontent.com/BenGardiner/03e2a7edeb7643ff1004e89… writeup https://emanuelduss.ch/2018/12/advent-calendar-of-advanced-cyber-fun-2… OverTheWire Advent Bonanza 2018 https://advent2018.overthewire.org writeup https://ctftime.org/event/721/tasks 35C3 https://archive.aachen.ccc.de/35c3ctf.ccc.ac/challenges/index.html writeup https://ctftime.org/event/718/tasks HITB-XCTF Dubai CTF 2018 https://ctftime.org/event/720