BLOG

shadow v2 public release

About four months ago (April 2017), Vasilis Tsaousoglou and myself presented our work on exploiting Android's libc allocator at the 2017 INFILTRATE conference (Miami, Florida). Since version 5.0, Android has adopted the jemalloc allocator as its default libc malloc(3) implementation. For our talk we extended our previously released jemalloc heap exploration and exploitation tool called 'shadow' to support Android (both ARM32 and ARM64), and demonstrated its use on understanding the impact of libc heap corruption vulnerabilities. We also presented new jemalloc/Android-specific exploitation techniques for double free and arbitrary free vulnerabilities.

Lure10: Exploiting Windows Automatic Association Algorithm

Lure10 is a novel technique presented at the Hack-in-the-Box 2017 conference in Amsterdam that enables an attacker to automatically achieve a man-in-the-middle position against wireless devices running the Windows operating system. The attack requires no user interaction and exploits the "Wi-Fi Sense" feature found in recent versions of the Microsoft Windows platform.

Welcome to the jungle of mobile apps - Mobile Apps Panorama 2016

On September 23rd 2016 I did a 15' presentation on Mobile App Security at the Mobile Apps Panorama 2016 conference, which was held at the Maroussi Plaza venue in Athens, Greece. The title of the presentation was "Welcome to the Jungle (of Mobile Apps)".

Choronzon public release

Hello readers of the CENSUS blog, my name is Zisis Sialveras and I am happy to announce today the public release of our evolutionary knowledge-based fuzzer, Choronzon.