haxrob

An exceptionally stealthy technique to hide files and masquerade processes on Linux systems

An exploration into the archeological roots of the BPFDoor Linux malware.

Analysis of a newly discovered Linux based variant of the DPRK attributed FASTCash malware along with background information on payment switches used in financial networks.

A stealthy process stomping method compatible with UNIX-like systems with anti-forensic enhancements for Linux.

Exploring ways malware on Linux and other UNIX-like systems can disguise their process names.

A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights.

Discovery and analysis of a magic packet type implant that communicates C2 traffic over the GTP-C 3GPP protocol.

A quick look into a connected toothbrush. Surprisingly this one was rather well behaved.

Notes on fuzzing with AFL and shared libraries can't resolve symbols

Part 4 of the battery monitor series - Two methods to obtain the firmware from the hardware for analysis and modification

Exploring a Smart Wi-Fi plug when something goes very wrong ..

Answering a friends question on why his lightbulb app was asking for location permissions. An archive of the "live tweeting" which lead to the answer ...

Part 3 of the battery monitor series -Analysing the BLE protocol in a car battery monitor to set the foundations to replace the application which tracks user’s location

Part 2 of the battery monitor series - A deep dive into the location tracking functionality of a popular location SDK package.

Reverse engineering an Android app for a Bluetooth connected car battery monitor with some startling discoveries ...

Extract firmware out of the TP-Link VR/AC 1600 router with a simple hardare modification