https://blackwinghq.com/themes/hardware--firmware/Blackwing Intelligence provides high-end security engineering, analysis, and research services for engineering focused organizationsenTue, 21 Nov 2023 00:00:00 +0000https://blackwinghq.com/research/projects/a-touch-of-pwn/Tue, 21 Nov 2023 00:00:00 +0000https://blackwinghq.com/research/projects/a-touch-of-pwn/Microsoft's Offensive Research and Security Engineering team asked us to evaluate the top three fingerprint sensors used for Windows Hello. We bypassed fingerprint authentication on all three laptops. The BlueHat talk and the write-up.https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/Tue, 21 Nov 2023 00:00:00 +0000https://blackwinghq.com/blog/posts/a-touch-of-pwn-part-i/How we bypassed Windows Hello fingerprint authentication on three laptops: reverse engineering the sensors, breaking a custom TLS, and defeating Microsoft's SDCP protocol.https://blackwinghq.com/research/talks/a-touch-of-pwn/Wed, 11 Oct 2023 00:00:00 +0000https://blackwinghq.com/research/talks/a-touch-of-pwn/Microsoft engaged us to evaluate the security of the top fingerprint sensors used for Windows biometric authentication. This presentation details our vulnerability research process, which entailed extensive reverse engineering of software and hardware, breaking cryptographic implementation flaws in a custom TLS, and deciphering and reimplementing proprietary protocols, to go from very little knowledge about biometric authentication to a full bypass of Windows Hello authentication on all three of our research targets.https://blackwinghq.com/research/tools/iboot64binja/Thu, 01 Oct 2020 00:00:00 +0000https://blackwinghq.com/research/tools/iboot64binja/A Binary Ninja binary view for iBoot, SecureROM and similar Apple boot firmware. Point it at a raw image and it identifies the firmware, finds the load address and rebases the binary so analysis is accurate, then restores a set of useful symbols from heuristics, so you start from a mapped, partly labelled image instead of a blob at address zero. Inspired by argp’s iBoot64helper loader for IDA Pro.https://blackwinghq.com/research/tools/nfcproxy/Sat, 28 Jul 2012 00:00:00 +0000https://blackwinghq.com/research/tools/nfcproxy/An Android app that proxies NFC transactions between a contactless card and a reader, for demonstrating relay attacks and analysing NFC protocols. Presented at DEF CON 20.https://blackwinghq.com/research/talks/nfc-hacking-the-easy-way/Sat, 28 Jul 2012 00:00:00 +0000https://blackwinghq.com/research/talks/nfc-hacking-the-easy-way/Eddie Lee presents NFCProxy, a proof-of-concept tool that demonstrates insecurities in near field communication and contactless credit cards. The tool is also useful for NFC protocol analysis in further research.