Bechir Bouali

low-level security researcher | RE bootloaders and hypervisors | Fault Injection and Fuzzing

[Bechir Bouali @b3ch1r]

1/7
3 CVEs in QNAP NAS firmware (QTS/QuTS hero).
3 different bug classes, each surfaced with a different technique.

Smooth process with QNAP PSIRT. Short thread on how I found each one ↓

[Bechir Bouali @b3ch1r]

@stratosberry Not much but enough to cover the devices I bought for testing, so it paid for itself :)

[Bechir Bouali @b3ch1r]

1/7
3 CVEs in QNAP NAS firmware (QTS/QuTS hero).
3 different bug classes, each surfaced with a different technique.

Smooth process with QNAP PSIRT. Short thread on how I found each one ↓

[Bechir Bouali @b3ch1r]

7/7
QNAP Advisory:
https://t.co/4zo78Tim6c

CVE records:
https://t.co/cXsw8kqxIl
https://t.co/fd2XxM97GF
https://t.co/us5vOO7b3M

[Bechir Bouali @b3ch1r]

6/7
CVE-2025-66281: NULL-ptr dereference (CVSS 6.9), pre-auth
Technique: static analysis

Endpoint calls strtol(getenv("CONTENT_LENGTH")) with no NULL check. Drop the Content-Length header → getenv returns NULL → strtol derefs it → segfault.

[Bechir Bouali @b3ch1r]

✍️

[hypr @hyprdude]

major progress on the emulated mt7622 project -- network transport, interrupts, DMA scatter, and a lil injector script to emulate a STA with real 80211 frames. good enough to trigger one of the over-the-air bugs in the wifi driver ;)

[Ahmad @TheAhmadOsman]

MASSIVE NEWS

Teamed up with NVIDIA to make Local AI The Default

[Bechir Bouali @b3ch1r]

I believe validating and parsing SSL certificates on embedded systems is still challenging. Enabling MITM would open up more attack vectors. I came across this nice blog post that highlights a vulnerability in Nintendo Switch’s SSL certificate validation.
https://t.co/lzMukLdceR

[Bechir Bouali @b3ch1r]

@tdinh_me Thank you for sharing honest and transparent feedback of your journey. Typically people don’t mention that preparation phase ( 7 + 2 ) just show the end result to public which quite misleading 🙂

[Bechir Bouali @b3ch1r]

Straight to the point tips to develop efficient fuzzing harness.
I think one of the key aspects is to make sure that cleanup is done properly between runs. For in-process binary mode, an extra care to reset CPU state should be made.
https://t.co/aM5W4ledXA

[Bechir Bouali @b3ch1r]

Another LibAFL feature that I find particularly useful is the possibility to add custom modules when initializing QEMU. It is a clean way to add syscalls hooking intrinsically to emulator and avoid playing with LD_PRELOAD.

Paper: https://t.co/SYwVoW7bsU

[Bechir Bouali @b3ch1r]

How to get ready for your weekend hiking?
+ Select trail and prepare your backpack
+ Prepare LibAFL template and scale it over multiple targets and cores
I’ve been using LibAFL for fuzzing some IoT firmwares and I am quite amazed by how much you can customise your fuzzer 🤯

[Bechir Bouali @b3ch1r]

One of the many advantages of LibAFL is the ability to create parametrized harness module to be able to scale. I highly recommend to check the paper and talk
paper: https://t.co/e7kBkG6GEh
talk: https://t.co/GDWpj7rJ7A

[Bechir Bouali @b3ch1r]

Another cool challenge from @Raspberry_Pi and @hextreeio , the focus this time is SCA . The news after first edition gave me the impression that the AES will be hardware-based engine but it is SW implementation, maybe for 3rd edition!

[hextree.io @hextreeio]

The new @Raspberry_Pi RP2350 Hacking Challenge: Second Edition just went live!

The first one was a huge success, with amazing attacks on the OTP secrets!

Now we want to see your side-channel attacks: Can you break the new, hardened AES implementation?

https://t.co/FBZKQmGLq6

[Bechir Bouali @b3ch1r]

It ended up with nice surprise during the hike 👀, hopefully “Lough” of crashes as well
🇮🇪 ☘️

[Bechir Bouali @b3ch1r]

@Sakana_Walnut Yes, it depends to the method you’re using to run your client! If you are using Launcher module, you can specify the number of cores as shown below.
LibAFL examples are handy: https://t.co/a8yRdsMKYc

[Bechir Bouali @b3ch1r]

@Kurnalsalts P3: is it kind of mesh/shield covering the die?