Author: hucktech

Announcing the pre-release (v0.9) of “AaronLocker:” robust and practical application whitelisting for Windows.

~ hucktech ~ Leave a comment

AaronLocker is designed to make the creation and maintenance of robust, strict, AppLocker-based whitelisting rules as easy and practical as possible. The entire solution involves a small number of PowerShell scripts. You can easily customize rules for your specific requirements with simple text-file edits. AaronLocker includes scripts that document AppLocker policies and capture event data into Excel workbooks that facilitate analysis and policy maintenance.[…]

 

https://msdnshared.blob.core.windows.net/media/2018/06/AaronLocker-v0.9.zip

Howard Oakley: Hidden caches in macOS: where your private data gets stored

~ hucktech ~ Leave a comment

Some time ago, I proposed that macOS 10.14 should be named Gormenghast, to reflect its many concealed and neglected features. These can trip up its own security and the protection of privacy when an old system within macOS is quietly storing sensitive data in an unprotected location. A good example is the latest vulnerability in QuickLook (or Quick Look, as Apple uses both forms).  Here is a brief overview of some of the potentially sensitive information which macOS secretes away in unexpected places. If you’re concerned about protecting the security of your data, these should be places to watch; if you’re a forensic analyst, these are often rewarding places to look.[…]

Hidden caches in macOS: where your private data gets stored

Heather Mahalik: Android and iIOS smartphone acquisition techniques

~ hucktech ~ Leave a comment

Smartphone Acquisition: Adapt, Adjust and Get Smarter!
June 25, 2018 Heather Mahalik Leave a comment

June 25, 2018

I have been recently asked by students for a summary on how to handle smartphone acquisition of iOS and Android devices. I have avoided writing it down, like I would avoid the Plague, because mobile changes so quickly and I don’t want people to read something and live by it. I wrote this on my plane ride to Vancouver, so forgive any typos or briefness in this blog.[…]

https://smarterforensics.com/2018/06/smartphone-acquisition-adapt-adjust-and-get-smarter/

Two more BadUSB-related articles

~ hucktech ~ Leave a comment

http://blog.sevagas.com/?Advanced-USB-key-phishing

https://researchcenter.paloaltonetworks.com/2018/06/unit42-tick-group-weaponized-secure-usb-drives-target-air-gapped-critical-systems/

RISC-V implementations filled with blobs

~ hucktech ~ 2 Comments

Intel, ARM, and especially POWER will be loving this moment:

All this said, note that the HiFive is no more open, today, than your average ARM SOC; and it is much less open than, e.g., Power. I realize there was a lot of hope in the early days that RISC-V implied “openness” but as we can see that is not so. There’s blobs in HiFive.

https://www.phoronix.com/scan.php?page=news_item&px=RISC-V-Not-All-Open-Yet

c2rust.com: C to Rust translator

~ hucktech ~ Leave a comment

Re: https://firmwaresecurity.com/2017/04/08/corrode-rust-to-c-translator/

There’s another C to Rust translator:

https://c2rust.com/

https://github.com/immunant/c2rust/tree/master/examples

International Journal of Proof-of-Concept or Get The F**k Out (PoC||GTFO) issue 0x18 released

~ hucktech ~ Leave a comment

https://www.alchemistowl.org/pocorgtfo/

NVIDIA Graphics Firmware Update Tool for DisplayPort Displays

~ hucktech ~ Leave a comment

This appears to be a new public tool, 1.0 release out this month.

I hope NVIDIA also makes a release for Linux, not just Windows.

To enable the latest DisplayPort 1.3 / 1.4 features, your graphics card may require a firmware update. Without the update, systems that are connected to a DisplayPort 1.3 / 1.4 monitor could experience blank screens on boot until the OS loads, or could experience a hang on boot. The NVIDIA Firmware Updater will detect whether the firmware update is needed, and if needed, will give the user the option to update it. […]

http://www.nvidia.com/object/nv-uefi-update-x86.html

Two Peerlyst firmware security resources

~ hucktech ~ Leave a comment

https://www.peerlyst.com/posts/friday-career-how-to-become-a-firmware-security-specialist-peerlys

https://www.peerlyst.com/posts/the-hardware-security-and-firmware-security-wiki-peerlyst

Mr. Crowbar – framework to reverse binary file formats

~ hucktech ~ Leave a comment

Kindof reminds me of Scapy for binary file formats!

Mr. Crowbar is a Django-esque model framework that makes it super easy to work with proprietary binary formats while reverse engineering. File formats are described with Python classes that allow ORM-like free modification of structures and properties, which in turn can be validated and converted back to the binary equivalent at any time. The eventual goal is to provide a library for storing file format information that retains the readability of a text file, while providing instant read/write support for almost no cost.[…]

 

doc/source/_static/mrcrowbar.png

arm_now: QEMU-based tool to setup VMs for security research

~ hucktech ~ Leave a comment

arm_now is a qemu powered tool that allows instant setup of virtual machines on arm cpu, mips, powerpc, nios2, x86 and more, for reverse, exploit, fuzzing and programming purpose.

https://github.com/nongiach/arm_now

Alt Text

 

RE-Canary: Detecting Reverse Engineering with Canary Tokens

~ hucktech ~ Leave a comment

https://twitter.com/qrs/status/1010259931373633538

https://twitter.com/qrs/status/1010541545638985729

Click to access Detecting_Reverse_Engineering_with_Canaries_CanSecWest2018.pdf

https://www.mulliner.org/blog/blosxom.cgi/security/re_canary.html

http://www.mulliner.org/collin/

hwloc – tool to discover hardware resources

~ hucktech ~ Leave a comment

The OpenMPI project has a tool called hwloc that helps identify hardware, useful beyond parallel/high-performance computing. It even generates ASCII artwork!

http://nitschinger.at/Discovering-Hardware-Topology-in-Rust/

The Hardware Locality (hwloc) software project aims at easing the process of discovering hardware resources in parallel architectures. It offers command-line tools and a C API for consulting these resources, their locality, attributes, and interconnection. hwloc primarily aims at helping high-performance computing (HPC) applications, but is also applicable to any project seeking to exploit code and/or data locality on modern computing platforms.

https://www.open-mpi.org/projects/hwloc/

https://github.com/open-mpi/hwloc

https://www.open-mpi.org/projects/hwloc/doc/v2.0.1/

Sample hwloc output

Quarks In The Shell – Episode IV

~ hucktech ~ Leave a comment

[…]One may need dedicated tools, like a debugger for a firmware or a baseband, or a disassembler to be able to read the instructions properly.[…]

https://blog.quarkslab.com/quarks-in-the-shell-episode-iv.html