ceax

embedded systems, ICS, IoT...

[ceax @_ceax]

[Tool] Ghidralligator: Emulate and fuzz code running on various CPU architectures (ARM, MIPS, PPC, x86, Apple Silicon M1/M2...)
Based on #GHIDRA (libsla C++).
#AFLplusplus, snapshot fuzzing, code coverage, ASAN

https://t.co/k63EyL2fCe
https://t.co/qw5VCFCAft
@HomardBoy

[Ledger Donjon @DonjonLedger]

Last week, we presented our research on Intel Wi-Fi chips at @sstic. Our talk and our slides are now available: https://t.co/NdZ4qGmqzb. It features a demo of a DMA attack from the Wi-Fi chip! We also published our tools to interact with some Intel chips: https://t.co/r292EKA90p

[Silent Signal @SilentSignalHU]

We wanted to create snapshot fuzzing demo. We also like challenges. So we chose a browser as the target :) You can find out what can go wrong from our latest blog post:

Fuzzy Snapshots of Firefox IPC -https://t.co/kybAR1px0J

[Unicorn Engine @unicorn_engine]

Super excited to release Unicorn2 beta to public!

Important features:

- Backward compatible with Unicorn 1.0.3
- Support latest instruction set of all existing archs
- Add 2 new archs in PPC & RISCV
- More optimization

More info at https://t.co/oeiKH0HMKf

[Cyber Saiyan | RomHack Conference, Training, Camp @cybersaiyanIT]

Nicolas Delhaye @_Homeostasie_ & Flavian Dola @_ceax
"Making your own Stuxnet: Exploiting New Vulnerabilities and Voodooing PLCs"

🎞️ https://t.co/VdD8A9dfEb
📜 https://t.co/neuWpqRElq (2.6MB)
💥 demos https://t.co/w0r0ztkXBr (32.6MB)

[Jens Wiesner ([email protected]) @jensweidraussen]

Kudos to @_ceax & @_Homeostasie_ from @AirbusCyber for showing that #Stuxnet is still possible by "Exploiting New Vulnerabilities and Voodooing PLCs" [#RomHack2021]. You put impressive work into that. https://t.co/OBcrEj4yfC

[Airbus Defence and Space Cyber @AirbusCyber]

Remote Code Execution (RCE) on the ABB #ICS system: “System 800xA SoftController” (CVE-2020-24672). This vulnerability could allow attackers to take remote control of the ABB engineering station. Details by @_ceax & @_Homeostasie_ at 3:40pm: https://t.co/4VprjIQXnl

[Airbus Defence and Space Cyber @AirbusCyber]

At #RomHack2021, @_ceax & @_Homeostasie_ will demonstrate how one can gain remote control over some industrial devices exploiting several new #CVEs they discovered. They will explain how to reproduce key stages of a #Stuxnet -like attack. Live stream ➡️ https://t.co/pnTAhC9Ze8

[Nicolas D @_Homeostasie_]

Happy to present with my workmate @_ceax our vulnerability research around #ICS at the #RomHack2021 conference on September 25th. 🙂

"Making your own Stuxnet: Exploiting New Vulnerabilities and Voodooing PLCs"
➡️ https://t.co/JV2VQtRV62

[Airbus Security Lab @AirbusSecLab]

You liked Stéphane's blog posts on QEMU? (https://t.co/TQkrGwtHP7)
Join him tomorrow for this free @hardwear_io Webinar.

[Airbus Defence and Space Cyber @AirbusCyber]

Présentation par @_ceax de l’outil https://t.co/78xyt4j42K permettant de fuzzer des binaires via AFL++ et l’émulateur de #Ghidra. Projet visant à être une alternative à afl_unicorn pour les architectures #CPU non supportées (Xtensa, ppc…): https://t.co/GSMMW8yITG

[ceax @_ceax]

@daveaitel @axcheron @kmkz_security It could be a good idea to integrate such functionality into the GUI. Maybe someday.
Currently, you have to build your own ghidra script using the lib provided, and define all the emulation parameters (registers value, pc, and memory values..). The examples can help you a lot ;-)

[ceax @_ceax]

@guedou Hi Guillaume. No, I didn't try Ghidra libsla.a yet.
Thanks to pointing this out. It could be a way to improve performance for sure.
I will have a closer look to your work around this topic.
Did you notice performance improvement between Ghidra emulation and libsla.a emulation?

[ceax @_ceax]

[Tool] Fuzz exotic arch with AFL using Ghidra emulator with code coverage
Ex: Fuzzing Xtensa binary code (#esp32)

Blog: https://t.co/FN6d4AZJTO
Github: https://t.co/QYr2OgTIPY
#GHIDRA #AFLplusplus

[Alexa Chenowith @AlexaChenowith]

Inside SimpliSafe Alarm System https://t.co/MWLxUHV1xE

[Nicolas Krassas @Dinosn]

Reverse Engineering Testo Saveris2 firmware
https://t.co/y0fTpQBeY8

[h0mbre @h0mbre_]

i tried to make a beginner-friendly post about some of the basics related to code coverage in fuzzing, just going over terminology, common strats, and some tooling. hopefully this will be useful for some! https://t.co/Tu0eZep5rC

[ceax @_ceax]

[New Post] Here is my write-up on my RCE affecting Schneider Electric ControlExpert by chaining 3 #0day: #CVE-2020-28211 CVE-2020-28212 CVE-2020-28213
Find out how to bypass project protection, hijacking UMAS session, and inject bytecode into PLC simulator
https://t.co/4gq3x7Mm3X

[Airbus Defence and Space Cyber @AirbusCyber]

LIVE TODAY AT 2PM CET: @_Homeostasie_ & @_ceax, #Vulnerability Researchers, will present at #GreHack20. Livestream available at https://t.co/agmPawMcgP
w/ @GrehackConf

[ceax @_ceax]

Fixes available for my RCE on Schneider Electric EcoStruxure Control Expert
(CVE-2020-28211, CVE-2020-28212, CVE-2020-28213).
More details in my blog post will be coming soon...
https://t.co/OiVpVRuKK1
https://t.co/kgYag7Rost