https://blackwinghq.com/research/Blackwing Intelligence research: projects, vulnerability advisories, conference talks and open-source tools from our hardware, platform and product security work.enTue, 02 Jan 2024 00:00:00 +0000https://blackwinghq.com/research/tools/heapster/Tue, 02 Jan 2024 00:00:00 +0000https://blackwinghq.com/research/tools/heapster/A tool for exploring the macOS libmalloc heap from LLDB: zones, magazines, free lists and the state of individual allocations, introduced in our libmalloc post.https://blackwinghq.com/research/projects/a-touch-of-pwn/Tue, 21 Nov 2023 00:00:00 +0000https://blackwinghq.com/research/projects/a-touch-of-pwn/Microsoft's Offensive Research and Security Engineering team asked us to evaluate the top three fingerprint sensors used for Windows Hello. We bypassed fingerprint authentication on all three laptops. The BlueHat talk and the write-up.https://blackwinghq.com/research/talks/a-touch-of-pwn/Wed, 11 Oct 2023 00:00:00 +0000https://blackwinghq.com/research/talks/a-touch-of-pwn/Microsoft engaged us to evaluate the security of the top fingerprint sensors used for Windows biometric authentication. This presentation details our vulnerability research process, which entailed extensive reverse engineering of software and hardware, breaking cryptographic implementation flaws in a custom TLS, and deciphering and reimplementing proprietary protocols, to go from very little knowledge about biometric authentication to a full bypass of Windows Hello authentication on all three of our research targets.https://blackwinghq.com/research/tools/iboot64binja/Thu, 01 Oct 2020 00:00:00 +0000https://blackwinghq.com/research/tools/iboot64binja/A Binary Ninja binary view for iBoot, SecureROM and similar Apple boot firmware. Point it at a raw image and it identifies the firmware, finds the load address and rebases the binary so analysis is accurate, then restores a set of useful symbols from heuristics, so you start from a mapped, partly labelled image instead of a blob at address zero. Inspired by argp’s iBoot64helper loader for IDA Pro.https://blackwinghq.com/research/tools/nfcproxy/Sat, 28 Jul 2012 00:00:00 +0000https://blackwinghq.com/research/tools/nfcproxy/An Android app that proxies NFC transactions between a contactless card and a reader, for demonstrating relay attacks and analysing NFC protocols. Presented at DEF CON 20.https://blackwinghq.com/research/talks/nfc-hacking-the-easy-way/Sat, 28 Jul 2012 00:00:00 +0000https://blackwinghq.com/research/talks/nfc-hacking-the-easy-way/Eddie Lee presents NFCProxy, a proof-of-concept tool that demonstrates insecurities in near field communication and contactless credit cards. The tool is also useful for NFC protocol analysis in further research.https://blackwinghq.com/research/talks/irk-osx-kernel-rootkits/Thu, 07 Aug 2008 00:00:00 +0000https://blackwinghq.com/research/talks/irk-osx-kernel-rootkits/Apple’s OS X operating system has been gaining in popularity. This presentation details how to manipulate the OS X kernel in order to hide an attacker’s activities and maintain access.https://blackwinghq.com/research/talks/mach-shellcode-osx-rootkits/Sat, 14 Jun 2008 00:00:00 +0000https://blackwinghq.com/research/talks/mach-shellcode-osx-rootkits/Using the Mach interfaces in the OS X kernel to manipulate the kernel from user space, i.e. from shellcode, to alter kernel structures. Example shellcodes are included.https://blackwinghq.com/research/talks/blackjacking/Sat, 05 Aug 2006 00:00:00 +0000https://blackwinghq.com/research/talks/blackjacking/Jesse D’Aguanno demonstrated using the trust relationship between the BlackBerry Enterprise Server infrastructure and the handhelds to bypass perimeter controls and compromise an internal corporate network.