Clik here to view.
Forensics on Android phones and security measures
iPhone forensics has been well studied by lots of security people (and our team). Android is less looked at probably because there is less challenge for hackers (because of openness) and also because...
View ArticleClik here to view.
Low-level iOS forensics
iOS filesystem encryption and data protection mechanisms are now well documented and supported by many forensics tools. iOS devices use NAND flash memory as their main storage area, but physical...
View ArticleRecon2012
For the third year we had the chance to participate to REcon 2012.Here is a summary of the most intelligible talks.The case for semantics-based methods in reverse engineeringRolf Rolles started the...
View ArticlePresence at hack.lu 2012
Just a quick post to let you know that, as some people may already have noticed, we will be present at hack.lu 2012!In this talk, we will talk about GSM Protocol Stack and techniques we usually use to...
View ArticleInternships 2013
We have 3 open positions for internships:Mobile phone bootloader analysis: this internship aims to evaluate the security of existing bootloaders used in smartphones by developing a bootloader debugger...
View ArticleClik here to view.
And the winner is... KECCAK !
On November 2006, NIST (National Institute of Standards and Technology) announced a public competition for developing a new cryptographic hash algorithm which would become SHA-3. The submission...
View ArticlePresence at hack.lu 2013
As some people may have already noticed, we will be present at hack.lu 2013!There has been extensive research and attacks on iPhone bootloaders but the Android world is quite large with multiple...
View ArticleInternships 2014
We have 4 open positions for internships:Assessment of tools detecting APTBinary instrumentationAnalysis of a virtualization platformElectronic Control Units (ECU) analysisInternship 1: Assessment of...
View ArticleClik here to view.
A quick security review of the Uhuru Mobile demo ROM
IntroductionFrom February 23 to February 28, we had the opportunity to look at the demo ROMof Uhuru Mobile. Uhuru Mobile is supposed to be a secure Mobile DevicesManagement solution, including its own...
View ArticleClik here to view.
Exploiting a vulnerability in HTC One bootloader and bruteforcing the...
TL;DRThis article deals with the presence of the "read_mmc" command in the HTC One phone. Our target phone had Android 4.2.2 and HBOOT 1.54.0000. This vulnerability has been reported to HTC in February...
View ArticleInternships 2015
This year, we have 4 open positions for internships:Analysis of a virtualization platformBinary instrumentationBootkit UEFIIndicator Of Compromise (IOC) recovery toolInternship 1: Analysis of a...
View ArticleClik here to view.
SMM unchecked pointer vulnerability
TL;DRThis article explains the exploitation of an SMM unchecked pointer vulnerability present in several firmwares. As this vulnerability is a memory corruption, it only applies to firmwares including...
View ArticleClik here to view.
The Story of yet another ransom-fail-ware
TL;DRThis article explains why it is still worth trying to reverse engineer a ransomware in order to retrieve your encrypted files. You may find a tool to decrypt the files modified by this specific...
View ArticleClik here to view.
Deep-Dive in WoW64
IntroWhen working on PythonForWindows, I had multiple encounters with some specificities of WoW64 (Windows 32-bit on Windows 64-bit) and the challenges/opportunities it offers.Few weeks ago, I tried to...
View ArticleInternships 2017
This year we have 5 open positions for internships:Python code obfuscationBootkit TrustZoneMalware hunting in Windows kernelWindows privilege escalationMachine Learning for threat intelligenceDuration...
View ArticleClik here to view.
Bypassing ASLR and DEP on Adobe Reader X
Due to their complexity and their large deployment on users' machines, Adobe products (especially Flash and Reader) have often received a lot of attention from attackers. Being aware of this fact,...
View ArticleAn approach to PDF shielding
In a previous article we showed how one could delve into a document's internals to look for suspicious elements (like JavaScript scripts registered to run at the document opening). This method can give...
View ArticleWebsite 2.0
The Sogeti/ESEC R&D lab is glad to welcome you on this new website.You can now retrieve here everything we did in the past, and what we will continue to do:Our blog.All the services that we provide...
View ArticleInternships
We have 4 open positions for internships:Malicious hardware and USB: the purpose is to study the USB protocol and use it on a device (e.g. FPGA) to compromise a target host (Windows, MacOS X, Linux,...
View ArticleClik here to view.
Hack In The Box 2010 - Malaysia
Jean-Baptiste, Jean and I were giving a talk at the HITB 2010 conference in Kuala Lumpur (KL). Jean-Baptiste was presenting his work on the analysis of DRM systems. Jean and I talked about the...
View ArticleProtecting against the RDS Linux local root exploit with grsec
On october 19h, Dan Rosenberg, a security researcher at Virtual Security Research LLC, disclosed a flaw in the handling of iovec structures by the rds kernel module (original VSR advisory). Due to the...
View Articlehack.lu CTF - Challenge 16 WriteUp
We attended Hack.lu this year in Luxembourg. This security conference is really nice and provides a Capture The Flag (CTF) contest organized by FluxFingers, the CTF Team of Ruhr-Universität Bochum...
View Articlehack.lu CTF - Challenge 21 WriteUp
Guillaume was giving a talk at the Hack.lu 2010 conference in Luxembourg, where we enjoyed to participate to the Capture The Flag. After intense competition against about 70 teams, we finally ended at...
View ArticlePresentation at Hack.lu: Reversing the Broadcom NetExtreme's firmware
I was giving a talk in October during last hack.lu session. The presentation focuses on the roadmap taken to reverse engineer the Broadcom Ethernet NetExtreme firmware family: building a firmware...
View ArticleThank you, Mario, but our printSeps() is in another castle!
This post details the way Adobe patched the printSeps() vulnerability in Adobe Reader (CVE-2010-4091). You'll see that the way Adode fixed the vulnerability is quite surprising...Very lately a...
View Articlehack.lu CTF - Challenge 12 WriteUp
Here is the missing Hack.lu CTF write-up for the "seamonster" challenge. It was a Windows reverse engineering challenge, with a nice anti-debugging trick.The challenge objective is to give "Ring3" the...
View ArticleESET CONFidence 2010 Crackme - WriteUp
ESET proposed a crackme during the CONFidence conference. Challenge started on November, 29th and lasted two days. The goal was to find a valid username/serial combination. Challenge was won by Dmitry...
View ArticleClik here to view.
Padding Oracle attack and its applications on ASP.NET
ASP.NET is a group of Web development technologies created by Microsoft, which offers developers an easy way to create dynamic web sites, web applications, or XML web services. To use it, a compatible...
View ArticleCVE-2010-3830 - iOS < 4.2.1 packet filter local kernel vulnerability
This post will describe a recent iPhone kernel vulnerability discovered by comex and used in the limera1n and Greenpois0n jailbreaking tools. Both tools exploit a BootROM vulnerability found by geohot...
View ArticleMetasm recipes: working with a process image
Today we'll discuss how metasm can be used to work with a process memory dump, and also how to search for gadgets suitable for a short ROP sequence.While working on a vulnerability on a windows server,...
View ArticleTraining at CanSecWest 2011 : Analysis of malicious documents
Jean-Baptiste and Guillaume will give a course about malicious document analysis during the next CanSecWest Dojo session at Vancouver (March 7th/8th).The course deals with two major cases: PDF and...
View ArticleClik here to view.
IIS Backdoor
In this article I will explain how I designed a rootkit for Microsoft Internet Information Services (IIS).The question is: why a backdoor in a web server?First obvious but useless answer: because we...
View ArticleTraining at CanSecWest 2011: Advanced binary deobfuscation
Yoann 'jj' Guillot will also be giving a course about advanced binary deobfuscation, during the next CanSecWest Dojo session in Vancouver (March 7th/8th).The course will teach you how to overcome...
View ArticleSplitting a mercurial repository : HgSplit
Here at the R&D lab we use mercurial for our code versionning.One of the problems we faced was that sometimes we would commit big files like pdfs or raw data into a repository.This is fine, as long...
View ArticleClik here to view.
x64 spoon
While coding and debugging some low-level stuff I sometime need to write a little piece of assembly code to see if i'm right. Until now, I was writing code into a process debugged with OllyDbg, and...
View ArticleSniffing USB traffic with VMWare
VMWare offers the possibility to dump any usb traffic at the lowest level to a dump file.We'll describe here how to activate this feature, and additionally publish a script to convert the dump file to...
View ArticleClik here to view.
Passcode bypass of the HTC Desire Z using an unexpected feature of the...
Android devices are becoming increasingly present everywhere. iPhone security has been analyzed by researchers -- however this is more difficult for Android devices due to the diversity of vendors and...
View ArticleClik here to view.
Origami 1.0 released!
I am pleased to announce the first stable release of Origami, the PDF manipulation framework! A lot of new cool features has been added since the last beta and I consider the framework has become...
View ArticleLinux syscall ABI
A quick post to summarize the linux kernel syscall ABI on i386 architecture.It is hard to come by a short summary of how to do direct syscalls under the linux kernel. This does not intend to be...
View ArticleAnalysis of the jailbreakme v3 font exploit
Two weeks ago, comex released the third version of jailbreakme. Two exploits are used to jailbreak Apple devices by opening a PDF file in the MobileSafari browser: initial code execution is obtained...
View ArticleRushing Recon 2011!!!
Hi everyone,In the beginning of July, several people from our lab were in Montreal for the Recon conference, where we gave four talks. We really enjoyed our time there. The panel of talks was, once...
View ArticleThe undocumented password validation algorithm of Adobe Reader X
Someone recently sent me an email about troubles when opening in Origami encrypted PDF documents produced by Acrobat Pro X. At first I thought it was a bug, but while looking in the data of the...
View ArticleClik here to view.
Hack.lu CTF 2011 Write-up : Romulan Business Network
Once again, we participated in the Capture-The-Flag event organized by the FluxFingers team at Hack.lu. Just like last year's CTF, the challenges were fun and original, and we finished up first after...
View ArticleHack.lu CTF 2011 Write-up : FluxScience
This was probably one of the most entertaining challenges of this CTF.A file data.flux is provided. The goal is to analyze a Windows binary to be ableto decrypt this file.A few informations are given:...
View ArticleHack.lu CTF 2011 Write-up : Scotty's last signal
Another writeup for the excellent Hack.lu 2011 Capture The Flag contest. This one was very unusual, based on a patched NES rom of Super Mario Bros 1. Scotty's last signal You might have heard about...
View ArticleiOS 5 data protection updates
iOS 5 was released this week, and introduced some changes to the data protection features we described at HITB Amsterdam. This post highlights the updates made since iOS 4.LwVM partition schemeThe GPT...
View ArticleRetours sur le 28C3
Voilà un résumé des conférences auxquelles j'ai assisté. Les planches seront rendues disponibles au fur et à mesure. Les conférences sont réparties sur 3 salles en simultané, il a donc fallu faire des...
View ArticleSome feedback from the 28C3 conference
Here is a summary of the talks I attended during CCC. The talks were given in 3 simultaneous tracks, so some choices had to be made. All in all, this is one of the best conferences I attended and I can...
View ArticleClik here to view.
HTC unlock internals
Since the end of 2011, HTC allows unlocking its Smartphones' bootloaders. Before that, HTC controlled every updates and packages that were installed on their devices. Users can now unlock their device...
View ArticleSome feedback from the HITB 2012 conference
Recently, HITB 2012 took place in Amsterdam (Okura Hotel) and some of us attended.Impressed by the quality of the conference, we will try to summarize here all presentations that we attended.Also,...
View Article
