Knock Knock! Who's There? - An NSA VM

Back in 2017 (feels like ages ago) I decided to take a peek into the ShadowBrokers leaks and reverse some of the tools. I started on dewdrop simply because it had a macOS version. I made local presentations at 0xOpoSec and BSidesLisbon but those slides were never published for obvious reasons (aka live implants all over the Internet). Significant time has passed and everyone went crazy last week with the beautiful NSO exploit VM published by Project Zero, so why not ride the wave and present a simple NSA BPF VM. It is still an interesting work and you have to admire the great engineering that goes behind this code. It鈥檚 not everyday that you can take a peek at code developed by a well funded state actor. This post is only going to focus on the BPF part of the implant so you will have to fill in the blanks about everything else. ...

December 17, 2021 路 27 min 路 5571 words

The Italian morons are back! What are they up to this time?

Nothing 馃槂. HackingTeam was deeply hacked in July 2015 and most of their data was spilled into public hands, including source code for all their sofware and also some 0day exploits. This was an epic hack that shown us their crap internal security but more important than that, their was of doing things and internal and external discussions, since using PGP was too much of an annoyance for these guys (Human biases are a royal pain in the ass, I know!...

February 29, 2016 路 12 min 路 2378 words

London and Asia EFI monsters tour!

Finally back home from China and Japan tour, so it鈥檚 time to finally release the updated slides about EFI Monsters. After Secuinside I updated them a bit, fixing stuff I wasn鈥檛 happy with and adding some new content. The updated version was first presented at 44CON London. I had serious reservations about going to the UK (not even in transit!) but Steve Lord and Adrian charm convinced me to give it a try....

November 6, 2015 路 3 min 路 498 words

How to fix rootpipe in Mavericks and call Apple鈥檚 bullshit bluff about rootpipe fixes

The rootpipe vulnerability was finally fully disclosed last week after a couple of months of expectation since its first announcement. It was disclosed as a hidden backdoor but it鈥檚 really something more related to access control and crap design than a backdoor. Although keep in mind that good backdoors should be hard to distinguish from simple errors. In this case there are a lot of services using this feature so it鈥檚 hardly a hidden backdoor that just sits there waiting for some evil purpose....

April 13, 2015 路 17 min 路 3458 words

BadXNU, a rotten apple! 鈥 CodeBlue 2014, SyScan 2015 slides and source code

The last SyScan is almost here so it鈥檚 time to get again into a plane and travel to Singapore. This means that the slides and source code can finally be released. Below you can find the archive with both presentations slides (they are slightly different, SyScan version fixes/upgrades a few things) and full source code for both rootkit/kext loaders. I hope you enjoy them; they are quite fun techniques, in particular the second one which now I sort of regret to disclose because it鈥檚 so cool....

March 19, 2015 路 2 min 路 214 words