Research is at the core of who we are and everything we do. Public output from the team: vulnerabilities we’ve disclosed, talks we’ve given and tools we’ve released, with the bigger bodies of work collected as projects.
project
Microsoft’s Offensive Research and Security Engineering team engaged us to evaluate the security of the top three fingerprint sensors embedded in laptops and used for Windows Hello. Extensive …
1 talk1 post3 advisories Jesse D'Aguanno, Timo Teräs
last: Oct 2024
post
While performing a security audit, I discovered a file format vulnerability that took me down an unexpected rabbit hole. The bug was fairly straightforward but what made it interesting was its origin …
Franco Belman
post
TL;DR In this post, I introduce a new tool called heapster that allows you to play with macOS libmalloc. I walk you through how to use this tool and a couple strange things I found along the way.
Josh Pitts
post
TL;DR Microsoft’s Offensive Research and Security Engineering (MORSE) asked us to evaluate the security of the top three fingerprint sensors embedded in laptops and used for Windows Hello fingerprint …
Jesse D'Aguanno, Timo Teräs
last: Oct 2023
talk
Microsoft engaged us to evaluate the security of the top fingerprint sensors used for Windows biometric authentication. This presentation details our vulnerability research process, which entailed …
talk
XNU, the OS X kernel, is made up of a somewhat unholy marriage of the monolithic BSD kernel and the CMU mach microkernel. Because of this marriage, in addition to BSD syscalls, XNU provides additional …
video Jesse D'Aguanno
talk
Eddie Lee presents NFCProxy, a proof-of-concept tool that demonstrates insecurities in near field communication and contactless credit cards. The tool is also useful for NFC protocol analysis in …
last: Jan 2024
tool
A tool for exploring the macOS libmalloc heap from LLDB: zones, magazines, free lists and the state of individual allocations, introduced in our libmalloc post.
tool
A Binary Ninja binary view for iBoot, SecureROM and similar Apple boot firmware. Point it at a raw image and it identifies the firmware, finds the load address and rebases the binary so analysis is …
source Jesse D'Aguanno
tool
An Android app that proxies NFC transactions between a contactless card and a reader, for demonstrating relay attacks and analysing NFC protocols. Presented at DEF CON 20.