Synacktiv, a French offensive security firm, publishes technical write-ups on exploits, iOS and macOS internals, rootkits and CI attacks.
HN commenters cite its posts as detailed references on eBPF rootkits, Safari and iOS exploitation, router bugs and the Dependabot pull_request_target attack.
GrapheneOS provides massive security improvements over Android. You should read https://grapheneos.org/features#exploit-protection for an overview. Cellebrite quite clearly puts substantial effort into targeting GrapheneOS, much more than they do into targeting variants of Google Mobile Services Android across devices. Cellebrite provides much more detailed information and comparisons for GrapheneOS than any other variant of Android. One of the biggest security improvements for exploitation is GrapheneOS using hardware memory tagging (ARM MTE) in the main kernel and userspace allocators for all of the base OS.
GrapheneOS nearly entirely eliminates the attack vector used by Cellebrite Premium by default via software and hardware blocking of new USB connections while locked along with hardware-level disabling of USB data if there are no existing USB connections. Cellebrite's recent documentation shows they can't currently exploit an unlocked GrapheneOS device when the password is obtain from the user which shows that it's not all about the USB protection at all. They were unable to exploit GrapheneOS prior to the replacement of software blocking of new USB peripherals with the much more complete current implementation of USB attack surface reduction blocking USB peripherals, USB gadgets and USB-C alternate modes at both the software and hardware level along with disabling USB data at a hardware level. They were last able to exploit locked GrapheneOS devices in 2022, possibly…
Christmas CTF https://twitter.com/sudosev/status/1075213434273320960
https://pastebin.com/raw/7VL6usg6
https://pastebin.com/raw/Sm9PCxWv
https://twitter.com/sudosev/status/1079069504498556930
HACKvent 2018 https://hackvent.hacking-lab.com
SANS Holiday Hack Challenge 2018 https://www.holidayhackchallenge.com/2018
GreHack 2018 https://2018.challenge.grehack.fr
writeup https://www.synacktiv.com/posts/challenges/grehack-2018-qualification-challenge.html
CSAW Red Team Competition 2018 https://red.csaw.io/challenges
Hacktober.org https://hacktober.org
Advent Calendar of Advanced Cyber Fun 2018 https://xmas.rip
repository https://github.com/takeshixx/advent-calendar-2018
writeup https://gist.githubusercontent.com/BenGardiner/03e2a7edeb7643ff1004e89f12f68792/raw/e7a1b696b1de79245c8df7d4a1c4738110e938a2/Advent%2520Calendar%2520of%2520Advanced%2520Cyber%2520Fun%25202018%2520Writeup.md
writeup https://emanuelduss.ch/2018/12/advent-calendar-of-advanced-cyber-fun-2018-write-up
OverTheWire Advent Bonanza 2018 https://advent2018.overthewire.org
writeup https://ctftime.org/event/721/tasks
35C3 https://archive.aachen.ccc.de/35c3ctf.ccc.ac/challenges/index.html
writeup https://ctftime.org/event/718/tasks
HITB-XCTF Dubai CTF 2018 https://ctftime.org/event/720
Synacktiv | System engineer, Pentester, Reverser and more | Paris, Toulouse, Lyon - France | ONSITE or REMOTE | https://www.synacktiv.com/en/
Synacktiv is an IT security company, founded in 2012 by consultants with more than 13 years of experience in security consulting and auditing, with a real passion for IT security.
We are actually looking for growing our technical teams (system engineer, pentester, reverser) and are ready to onboard on one of our office located in France (HQ - Paris, Lyon or Toulouse). Some remote position could be allowed.
Apply here apply@synacktiv.com or reach me directly using my profile contact information if you need more information.
But then you could compromise the GPU, probably :)
Look at the bootloader, can you open a console?
If not, can you desolder the flash and read the key?
If not, can you access the bootloader when the flash is not detected anymore?
...
Can you solder off the capacitors and glitch the power line, to do a [Voltage Fault Injection](https://www.synacktiv.com/en/publications/how-to-voltage-fault-injection)?
Can you solder a shunt resistor to the power line, observe the fluctuations and do [Power analysis](https://en.wikipedia.org/wiki/Power_analysis)?
There are a lot of doors and every time someone closes them a window remains tilted.
TL;DR background for this one: there existed a zero day bug in iOS 11 related to how the kernel processed the lio_listio call. Apple fixed it then but introduced a memory leak. In iOS 13 Apple fixed the memory leak but reintroduced the vulnerability. The regression was found and packaged in a obfuscated jailbreaking tool (unc0ver); this post explains how the tool was deobfuscated. This resulted in an "emergency" iOS 13.5.1 update to fix the issue. Interestingly this fix still does not fully fix the memory leak: https://www.synacktiv.com/posts/exploit/the-fix-for-cve-2020-9859-and-the-lightspeed-vulnerability.html
The folks at Synaktiv had a nice detailed blog post on this same vector last year[1].
The bottom line with these kinds of things is that virtually nobody should be using `pull_request_target`, even with “trusted” machine actors like Dependabot. It’s a pretty terrible footgun.
[1]: https://www.synacktiv.com/en/publications/github-actions-exploitation-dependabot