Author: hucktech

Bochspwn Reloaded

~ hucktech ~ Leave a comment

Bochspwn Reloaded is an instrumentation module for the Bochs IA-32 emulator, similar to the original Bochspwn project from 2013. It performs taint tracking of the kernel address space of the guest operating systems, to detect the disclosure of uninitialized kernel stack/heap memory to user-mode and other data sinks. It helped us identify over 70 bugs in the Windows kernel, and more than 10 lesser bugs in Linux in 2017 and early 2018.

https://github.com/google/bochspwn

https://github.com/google/bochspwn-reloaded

x41-smartcard-fuzzing and qsym

~ hucktech ~ Leave a comment

Two new fuzzers, one with more symbolic execution features!

https://github.com/x41sec/x41-smartcard-fuzzing

 

https://github.com/sslab-gatech/qsym/

USBHarpoon Is a BadUSB Attack with A Twist

~ hucktech ~ Leave a comment

https://vincentyiu.co.uk/usbharpoon/

http://mg.lol/blog/badusb-cables/

https://www.bleepingcomputer.com/news/security/usbharpoon-is-a-badusb-attack-with-a-twist/

 

 

Intel-microcode has license that prevents redistribution

~ hucktech ~ Leave a comment

In case technical issues weren’t enough, the lawyers at Intel have apparently made it more difficult for some open source operating systems to use the latest Intel microcode.

https://twitter.com/stevelord/status/1031819787431804928

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=906158

https://bugs.gentoo.org/664134

PS: AMD is apparently still blocked at technical issues:

https://github.com/pcengines/apu2-documentation/issues/75

_Three_ Lenovo rootkit variants?

~ hucktech ~ Leave a comment

https://tcsltesting.blogspot.com/2018/08/three-lenovo-rootkit-versions.html

From Thompson Cyber Security Labs: https://armor.ai/

Manufacturers analyzed: {‘Toshiba’, ‘Acer’, ‘Lenovo’, ‘Asrock’, ‘Desenvolvida por Positivo Informatica SA’, ‘Razer’, ‘Clevo’, ‘American Megatrends Inc./Advantech’, ‘American Megatrends Inc.’, ‘LG Electronics’, ‘Dell’, ‘ASUSTeK’, ‘Gygabyte’, ‘Intel’, ‘Sony’, ‘Hewlett-Packard’, ‘Apple Inc.’}

Total firmware analyzed: 550

Total firmware with portable executables analyzed: 515

Total portable executables analyzed: 131289

Total portable executables triggering one heuristic: 20964

Total portable executables triggering more than one heuristic: 3178

Average portable executables per ROM: 254

Average portable executables triggering heuristic per ROM: 40

Average portable executables triggering more than one heuristic per ROM: 6

barbie’s notes – Firmware 101: Extracting the Firmware

~ hucktech ~ Leave a comment

https://twitter.com/barbieauglend/status/1030868222701174784

Extracting the Firmware

In the last post, we discussed how to find important information about how to communicate with the device’s. In this post, we are going to describe the standard approch of getting the code we want to reverse and use the information we collected before.[…]

https://barbieauglend.github.io/2018-07-23-hardware_101/

https://barbieauglend.github.io/2018-08-03-firmware_101/

Dependencies – An open-source modern Dependency Walker for Windows

~ hucktech ~ Leave a comment

A rewrite of the old legacy software “depends.exe” in C# for Windows devs to troubleshoot dll load dependencies issues.
Usage Exemple

Haven and evil maids

~ hucktech ~ Leave a comment

https://github.com/guardianproject/haven

https://play.google.com/store/apps/details?id=org.havenapp.main

https://guardianproject.github.io/haven/

https://irishtechnews.ie/dealing-with-evil-maid-exploits-and-how-to-protect-your-company/

Dealing with Evil Maid exploits and how to protect your company.
Giulio D’Agostino
August 18, 2018
CyberSecurityMalwareSecurity

An Evil Maid assault is when a device has physically tampered without the device owner’s knowledge. Evil Maid attacks where a bootloader has been installed onto the victim’s computer which defeats full disk encryption. Now, however, thanks to solutions like Edward Snowden’s new Android program, which is called Haven, people can help prevent Evil Maid strikes and protect their devices from physical tampering while they’re not present.[…]This program is vital for those that have sensitive information on their devices and need extra protection against Evil Maid attacks. […]

Seealso: YONTMA and DoNotDisturb

DoNotDisturb: now with email support (and YONTMA)

SpeculationControl: PowerShell script

~ hucktech ~ Leave a comment

SpeculationControl is a PowerShell script that summarizes the state of configurable Windows mitigations for various speculative execution side channel vulnerabilities, such as CVE-2017-5715 (Spectre variant 2) and CVE-2017-5754 (Meltdown). For an explanation on how to interpret the output of this tool, please see Understanding Get-SpeculationControlSettings PowerShell script output.[…]

https://github.com/Microsoft/SpeculationControl

https://support.microsoft.com/en-us/help/4074629/understanding-the-output-of-get-speculationcontrolsettings-powershell

NVMe Firmware: I Need Your Data

~ hucktech ~ Leave a comment

 

[…]The NVMe ecosystem is pretty new, and things like “what version number firmware am I running now” and “is this firmware OEM firmware or retail firmware” are still queried using vendor-specific extensions. I only have two devices to test with (Lenovo P50 and Dell XPS 13) and so I’m asking for some help with data collection. Primarily I’m trying to find out what NMVe hardware people are actually using, so I can approach the most popular vendors first (via the existing OEMs). I’m also going to be looking at the firmware revision string that each vendor sets to find quirks we need — for instance, Toshiba encodes MODEL VENDOR, and everyone else specifies VENDOR MODEL.[…]

NVMe Firmware: I Need Your Data

https://plus.google.com/+RichardHughes/posts/Wqqtots46aA