shadow v2 public release

About four months ago (April 2017), Vasilis Tsaousoglou and myself presented our work on exploiting Android's libc allocator at the 2017 INFILTRATE conference (Miami, Florida). Since version 5.0, Android has adopted the jemalloc allocator as its default libc malloc(3) implementation. For our talk we extended our previously released jemalloc heap exploration and exploitation tool called 'shadow' to support Android (both ARM32 and ARM64), and demonstrated its use on understanding the impact of libc heap corruption vulnerabilities. We also presented new jemalloc/Android-specific exploitation techniques for double free and arbitrary free vulnerabilities.

Lure10: Exploiting Windows Automatic Association Algorithm

Lure10 is a novel technique presented at the Hack-in-the-Box 2017 conference in Amsterdam that enables an attacker to automatically achieve a man-in-the-middle position against wireless devices running the Windows operating system. The attack requires no user interaction and exploits the "Wi-Fi Sense" feature found in recent versions of the Microsoft Windows platform.

Choronzon public release

Hello readers of the CENSUS blog, my name is Zisis Sialveras and I am happy to announce today the public release of our evolutionary knowledge-based fuzzer, Choronzon.

Getting the most out of Evil Twin with wifiphisher — BSides Athens 2016

My last year’s talk at BSides London introduced to the public Wifiphisher, a security tool that mounts the Evil Twin attack against Wi-Fi networks. The tool has since seen some heavy use by the wireless hacking community which has inspired further research into ways of making the Evil Twin attack more effective. This year, I was happy to discuss the results of this research in another BSides event which was held, for the first time, in my hometown — BSides Athens!