We received a PNG file that got somehow corrupted in transit. Reading the PNG specification and looking at the first couple of bytes in the header we saw that an 0x0d byte was dropped. The file used 89 50 4e 47 0a 1a 0a as header instead of 89 50 …
read more0CTF: treasure
We are told that there's a treasure waiting at treasure.ctf.0ops.sjtu.cn so we have to start digging!
Firing up dig: dig treasure.ctf.0ops.sjtu.cn -t ANY tells us that the target is a IPv6 address.
Let's do a traceroute to that address:
$ traceroute6 treasure.ctf …
read moreReversing JS email malware
Another lazy Sunday (oh well, actually I should be writing papers and grant proposals but we are not talking about that right now) and I'm scrolling through my email when I stumbled upon a "FedEx notice" with your usual "you have not picked up your package" scam and I figured …
read more31c3 - A New Dawn
read moreAnother year, another c3
This year marked my 11th year of congress (and 10th visit with a short hiatus in 2012). Just like all the years before we headed to the conference location a day before the start of the 31c3. After arriving in Hamburg (after a quick detour through …
Ghost in the Shellcode Teaser 2015: Lost To Time
We received a file that looked like it was compressed. Let's just pipe it through xz and see what it really is. Aaah, looks like some old and obscure machine code of a machine that has long since been retired.
The machine code is of the CDC 6600, a very …
read moreOn differences between the CFI, CPS, and CPI properties
At OSDI'14 we published our paper on [1] where we introduce two new security properties that protect programs against control-flow hijack attacks enabled by memory corruption vulnerabilities. The design space in this area is already very cluttered and we use this blog post to highlight the differences between the individual …
read more'sploits or having fun with the heap, stack, and format strings
As part of the weekly CTF meetings we discussed some basic stack-based, heap-based, and format string based exploits. For system security challenges these are bread and butter techniques and rely on a huge amount of pre-existing knowledge about operating systems, kernels, process creation, dynamic loading, C programming, stack layouts, and …
read moreJumping monkeys or how to reach a technical point of contact at an online or tech company
Do you know this situation where you have some domain specific knowledge about a problem but first level support at a company blocks you from getting to a knowledgeable person? An example would be tech support at an internet company where you have already restarted your modem and computer yet …
read moreOn collaborative (remote) paper writing
Writing scientific conference or journal papers is an art by itself. This article is not about writing great papers as there already are many good articles that focus on paper writing itself and cover technical aspects, structural aspects, or writing style aspects. In this article I want to give an …
read moreSyScan, day 2
read moreBreaking Anti-Virus Software: Joxean Koret
Joxean gave a great introduction into worst security practices at anti virus companies. He basically dropped a large amount of 0days on a bunch of AV engines (I liked his opening statement "all bugs are 0days unless otherwise mentioned"). Using dumb fuzzing Joxean found a …