https://blackwinghq.com/people/jesse-daguanno/Blackwing Intelligence provides high-end security engineering, analysis, and research services for engineering focused organizationsenTue, 21 Nov 2023 00:00:00 +0000https://blackwinghq.com/research/projects/a-touch-of-pwn/Tue, 21 Nov 2023 00:00:00 +0000https://blackwinghq.com/research/projects/a-touch-of-pwn/Microsoft's Offensive Research and Security Engineering team asked us to evaluate the top three fingerprint sensors used for Windows Hello. We bypassed fingerprint authentication on all three laptops. The BlueHat talk and the write-up.https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/Tue, 21 Nov 2023 00:00:00 +0000https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/How we bypassed Windows Hello fingerprint authentication on three laptops: reverse engineering the sensors, breaking a custom TLS, and defeating Microsoft's SDCP protocol.https://blackwinghq.com/research/talks/a-touch-of-pwn/Wed, 11 Oct 2023 00:00:00 +0000https://blackwinghq.com/research/talks/a-touch-of-pwn/Microsoft engaged us to evaluate the security of the top fingerprint sensors used for Windows biometric authentication. This presentation details our vulnerability research process, which entailed extensive reverse engineering of software and hardware, breaking cryptographic implementation flaws in a custom TLS, and deciphering and reimplementing proprietary protocols, to go from very little knowledge about biometric authentication to a full bypass of Windows Hello authentication on all three of our research targets.https://blackwinghq.com/research/tools/iboot64binja/Thu, 01 Oct 2020 00:00:00 +0000https://blackwinghq.com/research/tools/iboot64binja/A Binary Ninja binary view for iBoot, SecureROM and similar Apple boot firmware. Point it at a raw image and it identifies the firmware, finds the load address and rebases the binary so analysis is accurate, then restores a set of useful symbols from heuristics, so you start from a mapped, partly labelled image instead of a blob at address zero. Inspired by argp’s iBoot64helper loader for IDA Pro.https://blackwinghq.com/blog/posts/dissecting-cve-2013-1899/Sun, 04 Aug 2013 00:00:00 +0000https://blackwinghq.com/blog/posts/dissecting-cve-2013-1899/Turning PostgreSQL's CVE-2013-1899 command-line-flag injection from a denial of service into remote code execution.https://blackwinghq.com/research/talks/irk-osx-kernel-rootkits/Thu, 07 Aug 2008 00:00:00 +0000https://blackwinghq.com/research/talks/irk-osx-kernel-rootkits/Apple’s OS X operating system has been gaining in popularity. This presentation details how to manipulate the OS X kernel in order to hide an attacker’s activities and maintain access.https://blackwinghq.com/research/talks/mach-shellcode-osx-rootkits/Sat, 14 Jun 2008 00:00:00 +0000https://blackwinghq.com/research/talks/mach-shellcode-osx-rootkits/Using the Mach interfaces in the OS X kernel to manipulate the kernel from user space, i.e. from shellcode, to alter kernel structures. Example shellcodes are included.https://blackwinghq.com/research/talks/blackjacking/Sat, 05 Aug 2006 00:00:00 +0000https://blackwinghq.com/research/talks/blackjacking/Jesse D’Aguanno demonstrated using the trust relationship between the BlackBerry Enterprise Server infrastructure and the handhelds to bypass perimeter controls and compromise an internal corporate network.