The Shadow File

Several weeks ago Jeff Moss, founder of DEF CON, reposted a link to this article into my Mastodon timeline: The Second Derivative: Why No One Understands the AI Boom.

A few weeks ago Forrester Research, who would not normally be on my radar, posted a very concise “Project Glasswing: The 10 Consequences Nobody’s Writing About Yet.”

What follows is a writeup of the kernel bugs NSO Group’s Pegasus spyware exploited in iOS 9, specifically versions 9.3.4 and earlier.

Whether you’re developing a kernel extension, doing vulnerability research, or you have some other need to spelunk into the macOS/iOS kernel, XNU, sometimes you need to attach a debugger.

In previous posts, I described some advanced uses of the macOS defaults(1) command, including adding arbitrarily complex data structures to defaults dictionaries.

I wrote a tool that sniffs changes to macOS defaults as they change and autogenerates the defaults incantation to set those preferences.

Want to change Finder’s preferred view to column view from the command line?

In the previous post, we walked through building a stage 1 firmware image that can be flashed to the Netgear R6200 by exploiting the hidden SetFirmware SOAP action in upnpd.

In the first twelve parts of this series, we identified an unauthenticated firmware update feature in the Netgear R6200 wireless router.

In the previous part, I described how to strip out all but the most essential services and libraries in the stock firmware in order to get the firmware image down to under 4MB.

In the previous part, we moved away from emulation to working with physical hardware.

Debugging and De-bricking the Netgear R6200 via UART Update: I forgot to credit my former colleague, Tim (@bjt2n3904), for helping me locate the UART header.

In the previous part, we switched gears back to the Netgear R6200 upnpd after spending some time analyzing httpd.

In the previous few posts, we spent time reversing how the Netgear R6200’s HTTP daemon parses a firmware header before writing the firmware image to flash.

We’re about halfway through the Broken, Abandoned series, so this is a good time to pause for a minute and take stock.

In the previous post, I finished discussing the abCheckBoardID() function.

Note: It is assumed that the reader is debugging the processes described in this and the next several posts using emulation and IDA Pro.

In previous installments I shared proof-of-concept code that would exercise the Netgear R6200’s hidden (and badly broken) SetFirmware SOAP action.

In the last post, I described how upnpd’s sa_parseRcvCmd() function finds the body of a SOAP request and how it parses that SOAP request.

In the previous posts, I talked about the hidden “SetFirmware” SOAP action in the Netgear R6200’s UPnP daemon, and the weird timing games we have play to deal with UPnP daemon’s broken networking code.

In the part 1, I showed how the Netgear R6200’s upnpd binary contains what appears to be a hidden SOAP action related to the string “SetFirmware”.

Introduction This series of posts describes how abandoned, partially implemented functionality can be exploited to gain complete, persistent control of Netgear wireless routers.

A Secret Passage to Persistant SOHO Router Pwnage Almost two years ago plus a house selling, a cross-country move, a house buying, a job change, and a wedding, I downloaded and unpacked the firmware for Netgear’s then-new R6200 wireless router.

Need to reverse engineer or exploit a file upload vulnerability in an embedded web server?

Previously I posted about running and remotely debugging a Netgear UPnP daemon using QEMU and IDA Pro.

It’s often the case, when analyzing an embedded device’s firmware, that static analysis isn’t enough.

A few years ago, when I worked for my previous employer, I put together a proof-of-concept that was to be part of a client demo.

Here are some additional resources I may have mentioned in my Infiltrate 2014 presentation.

A grad student emailed me in response to my Netgear auth bypass post.

For my presentation at BayThreat, entitled “BT Wireless Routers: Adventures in Reversing and Exploiting”, rather than have one or two or three slides packed with hard to read URLs, I included a single slide with a link to this post.

At the end of my post on the Netgear wndr3700v4’s authentication bugs, I said to expect followup posts.

UPDATE: Turns out, Jacob Holocomb (@rootHak42 on Twitter) of Independent Security Evaluators found this bug back in April on a different device, the WNDR4700.

I’ve just added a module to Bowcaster that I think is cool.

Update December 2014: 44CON has posted the videos from all 2013 talks online.

Note: I have a great job at a company called Tactical Network Solutions, based in Columbia, MD.

Sometimes I need a MIPS Linux system that I can use for development and testing.

Nothing original here, but this is a great tip, so I want to share it.

In previous parts of the Bowcaster tutorial, I showed how to construct your buffer overflow using the OverflowBuffer class.

In part 1 of the Bowcaster tutorial I showed how to generate an overflow string with the OverflowBuffer class.

Crossbow has been renamed to Bowcaster.

This is the third part in a multi part tutorial on using the Bowcaster exploit development framework to build a buffer overflow exploit.

This is the second in a multi-part tutorial on developing a buffer overflow exploit using Bowcaster.

This is the first in a multi-part tutorial on developing a buffer overflow exploit using Crossbow (now called Bowcaster), which I released earlier today.

UPDATE: Crossbow has been renamed to Bowcaster.

I love hacking.

With all the excitement regarding UPnP vulnerabilities lately, I though I’d write up this one I found a few weeks back.

Update: I received a personal communication from Mr.

[NOTE: This was going to be a post about how to relocate a shared library that is loaded using LD_PRELOAD such that a program’s linked libraries get loaded at their normal addresses.

I decided to POP out all my Yahoo mail into my Google Apps account so I could stop paying for Yahoo’s “premium” service (WTF, it’s 2012, and POP is a paid feature–and there’s no IMAP?).

Here are some long-form articles I’ve enjoyed this year.