https://blackwinghq.com/Blackwing Intelligence provides high-end security engineering, analysis, and research services for engineering focused organizationsenTue, 15 Oct 2024 00:00:00 +0000https://blackwinghq.com/blog/posts/finding-vulnerability-variants-at-scale/Tue, 15 Oct 2024 00:00:00 +0000https://blackwinghq.com/blog/posts/finding-vulnerability-variants-at-scale/From a JPEG file-format bug in jpeg-recompress to its variants across Chromium, Electron, WINE and more: a method for finding vulnerability variants at scale.https://blackwinghq.com/blog/posts/playing-with-libmalloc/Tue, 02 Jan 2024 00:00:00 +0000https://blackwinghq.com/blog/posts/playing-with-libmalloc/An introduction to macOS libmalloc in 2024 and heapster, a new tool for exploring the heap, plus a few strange things found along the way.https://blackwinghq.com/research/tools/heapster/Tue, 02 Jan 2024 00:00:00 +0000https://blackwinghq.com/research/tools/heapster/A tool for exploring the macOS libmalloc heap from LLDB: zones, magazines, free lists and the state of individual allocations, introduced in our libmalloc post.https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/Tue, 21 Nov 2023 00:00:00 +0000https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/How we bypassed Windows Hello fingerprint authentication on three laptops: reverse engineering the sensors, breaking a custom TLS, and defeating Microsoft's SDCP protocol.https://blackwinghq.com/research/projects/a-touch-of-pwn/Tue, 21 Nov 2023 00:00:00 +0000https://blackwinghq.com/research/projects/a-touch-of-pwn/Microsoft's Offensive Research and Security Engineering team asked us to evaluate the top three fingerprint sensors used for Windows Hello. We bypassed fingerprint authentication on all three laptops. The BlueHat talk and the write-up.https://blackwinghq.com/research/talks/a-touch-of-pwn/Wed, 11 Oct 2023 00:00:00 +0000https://blackwinghq.com/research/talks/a-touch-of-pwn/Microsoft engaged us to evaluate the security of the top fingerprint sensors used for Windows biometric authentication. This presentation details our vulnerability research process, which entailed extensive reverse engineering of software and hardware, breaking cryptographic implementation flaws in a custom TLS, and deciphering and reimplementing proprietary protocols, to go from very little knowledge about biometric authentication to a full bypass of Windows Hello authentication on all three of our research targets.https://blackwinghq.com/research/tools/iboot64binja/Thu, 01 Oct 2020 00:00:00 +0000https://blackwinghq.com/research/tools/iboot64binja/A Binary Ninja binary view for iBoot, SecureROM and similar Apple boot firmware. Point it at a raw image and it identifies the firmware, finds the load address and rebases the binary so analysis is accurate, then restores a set of useful symbols from heuristics, so you start from a mapped, partly labelled image instead of a blob at address zero. Inspired by argp’s iBoot64helper loader for IDA Pro.https://blackwinghq.com/blog/posts/dissecting-cve-2013-1899/Sun, 04 Aug 2013 00:00:00 +0000https://blackwinghq.com/blog/posts/dissecting-cve-2013-1899/Turning PostgreSQL's CVE-2013-1899 command-line-flag injection from a denial of service into remote code execution.https://blackwinghq.com/research/tools/nfcproxy/Sat, 28 Jul 2012 00:00:00 +0000https://blackwinghq.com/research/tools/nfcproxy/An Android app that proxies NFC transactions between a contactless card and a reader, for demonstrating relay attacks and analysing NFC protocols. Presented at DEF CON 20.https://blackwinghq.com/research/talks/nfc-hacking-the-easy-way/Sat, 28 Jul 2012 00:00:00 +0000https://blackwinghq.com/research/talks/nfc-hacking-the-easy-way/Eddie Lee presents NFCProxy, a proof-of-concept tool that demonstrates insecurities in near field communication and contactless credit cards. The tool is also useful for NFC protocol analysis in further research.https://blackwinghq.com/research/talks/irk-osx-kernel-rootkits/Thu, 07 Aug 2008 00:00:00 +0000https://blackwinghq.com/research/talks/irk-osx-kernel-rootkits/Apple’s OS X operating system has been gaining in popularity. This presentation details how to manipulate the OS X kernel in order to hide an attacker’s activities and maintain access.https://blackwinghq.com/research/talks/mach-shellcode-osx-rootkits/Sat, 14 Jun 2008 00:00:00 +0000https://blackwinghq.com/research/talks/mach-shellcode-osx-rootkits/Using the Mach interfaces in the OS X kernel to manipulate the kernel from user space, i.e. from shellcode, to alter kernel structures. Example shellcodes are included.https://blackwinghq.com/research/talks/blackjacking/Sat, 05 Aug 2006 00:00:00 +0000https://blackwinghq.com/research/talks/blackjacking/Jesse D’Aguanno demonstrated using the trust relationship between the BlackBerry Enterprise Server infrastructure and the handhelds to bypass perimeter controls and compromise an internal corporate network.