Security research: malware analysis, reverse engineering, and hardware/IoT teardown.https://haxrob.net/https://haxrob.net/linux-malware/hiding-in-plain-sight-mount-namespaces/https://haxrob.net/linux-malware/hiding-in-plain-sight-mount-namespaces/An exceptionally stealthy technique to hide files and masquerade processes on Linux systemsSun, 13 Jul 2025 05:41:22 GMThttps://haxrob.net/linux-malware/bpfdoor-past-and-present-part-2/https://haxrob.net/linux-malware/bpfdoor-past-and-present-part-2/Mon, 02 Jun 2025 23:36:46 GMThttps://haxrob.net/bpfdoor/bpfdoor-past-and-present-part-1/https://haxrob.net/bpfdoor/bpfdoor-past-and-present-part-1/An exploration into the archeological roots of the BPFDoor Linux malware.Mon, 02 Jun 2025 10:16:14 GMThttps://haxrob.net/linux/fastcash-for-linux/https://haxrob.net/linux/fastcash-for-linux/Analysis of a newly discovered Linux based variant of the DPRK attributed FASTCash malware along with background information on payment switches used in financial networks.Sun, 13 Oct 2024 02:51:35 GMThttps://haxrob.net/linux/hiding-in-plain-sight-part-2/https://haxrob.net/linux/hiding-in-plain-sight-part-2/A stealthy process stomping method compatible with UNIX-like systems with anti-forensic enhancements for Linux.Fri, 02 Aug 2024 07:56:41 GMThttps://haxrob.net/linux/process-name-stomping/https://haxrob.net/linux/process-name-stomping/Exploring ways malware on Linux and other UNIX-like systems can disguise their process names.Sun, 30 Jun 2024 09:49:38 GMThttps://haxrob.net/malware/onavo-facebook-ssl-mitm-technical-analysis/https://haxrob.net/malware/onavo-facebook-ssl-mitm-technical-analysis/A technical investigation into information uncovered in a class action lawsuit that Facebook had intercepted encrypted traffic from user's devices running the Onavo Protect app in order to gain competitive insights. Sun, 14 Apr 2024 07:19:59 GMThttps://haxrob.net/malware/gtpdoor-a-novel-backdoor-tailored-for-covert-access-over-the-roaming-exchange/https://haxrob.net/malware/gtpdoor-a-novel-backdoor-tailored-for-covert-access-over-the-roaming-exchange/Discovery and analysis of a magic packet type implant that communicates C2 traffic over the GTP-C 3GPP protocol.Tue, 27 Feb 2024 00:00:00 GMThttps://haxrob.net/iot/gamified-tooth-brushing/https://haxrob.net/iot/gamified-tooth-brushing/A quick look into a connected toothbrush. Surprisingly this one was rather well behaved.Sat, 10 Feb 2024 15:08:00 GMThttps://haxrob.net/fuzzing/battling-the-dynamic-linker-with-lazy-bindings-and-the-afl-fuzzer/https://haxrob.net/fuzzing/battling-the-dynamic-linker-with-lazy-bindings-and-the-afl-fuzzer/Notes on fuzzing with AFL and shared libraries can't resolve symbolsThu, 31 Aug 2023 00:00:00 GMThttps://haxrob.net/bm2/bm2-dumping-and-modifying-the-battery-monitor-firmware/https://haxrob.net/bm2/bm2-dumping-and-modifying-the-battery-monitor-firmware/Part 4 of the battery monitor series - Two methods to obtain the firmware from the hardware for analysis and modificationTue, 01 Aug 2023 00:00:00 GMThttps://haxrob.net/bm2/that-battery-monitor-what-happened-after-the-post/https://haxrob.net/bm2/that-battery-monitor-what-happened-after-the-post/Sun, 23 Jul 2023 04:18:00 GMThttps://haxrob.net/iot/a-smart-wi-fi-power-plug-that-almost-killed-me-literally/https://haxrob.net/iot/a-smart-wi-fi-power-plug-that-almost-killed-me-literally/Exploring a Smart Wi-Fi plug when something goes very wrong ..Sun, 09 Jul 2023 17:00:00 GMThttps://haxrob.net/iot/your-lightbulb-is-tracking-your-location/https://haxrob.net/iot/your-lightbulb-is-tracking-your-location/Answering a friends question on why his lightbulb app was asking for location permissions. An archive of the "live tweeting" which lead to the answer ...Wed, 05 Jul 2023 12:25:00 GMThttps://haxrob.net/bm2/bm2-reversing-the-ble-protocol-of-the-bm2-battery-monitor/https://haxrob.net/bm2/bm2-reversing-the-ble-protocol-of-the-bm2-battery-monitor/Part 3 of the battery monitor series -Analysing the BLE protocol in a car battery monitor to set the foundations to replace the application which tracks user’s locationTue, 30 May 2023 00:00:00 GMThttps://haxrob.net/bm2/bm2-an-analysis-of-location-tracking-in-the-amap-mobile-sdk/https://haxrob.net/bm2/bm2-an-analysis-of-location-tracking-in-the-amap-mobile-sdk/Part 2 of the battery monitor series - A deep dive into the location tracking functionality of a popular location SDK package.Mon, 22 May 2023 00:00:00 GMThttps://haxrob.net/bm2/discovering-that-your-bluetooth-car-battery-monitor-is-siphoning-up-your-location-data/https://haxrob.net/bm2/discovering-that-your-bluetooth-car-battery-monitor-is-siphoning-up-your-location-data/Reverse engineering an Android app for a Bluetooth connected car battery monitor with some startling discoveries ...Sun, 21 May 2023 00:00:00 GMThttps://haxrob.net/hardware/tp-link-vr1600v2-ac1600-router-firmware-extraction/https://haxrob.net/hardware/tp-link-vr1600v2-ac1600-router-firmware-extraction/Extract firmware out of the TP-Link VR/AC 1600 router with a simple hardare modificationMon, 01 May 2023 07:54:00 GMT