This post discusses a technique in Linux using mount namespaces to conceal files and processes from all users, including root. It explains how to create a 'stashspace' using tmpfs to hide artifacts and perform process masquerading...
About:
Haxrob is interested in mobile security and UNIX systems, documenting side projects on haxrob.net.
Website:
Specializations:
Interests:
Subscribe to RSS:
The BPFDoor malware has been in the media spotlight again, with recent variants evading existing detections. This text provides a detailed analysis of the changes in the malware, including detection evasion improvements, file desc...
The text discusses the BPFDoor malware, its origins, and evolution. It compares it to an earlier program called sniffdoor, and explores the changes and improvements made in BPFDoor over time. It also delves into the potential deve...
0FASTCash for Linux
2024-10-13 •
This post analyzes a newly identified variant of FASTCash 'payment switch' malware which specifically targets the Linux operating system. The term 'FASTCash' is used to refer to the DPRK attributed malware that is installed on pay...
The post details a defence evasion technique that overcomes a pitfall on Solaris and the BSDs, discussed in part 1. The technique is extended to Linux with additional anti-forensic behaviours to provide additional stealth, such as...
The post explores the defence evasion technique of dynamically modifying process names in UNIX-like systems. It discusses the history of the technique, its use by threat actors, and various ways to 'process masquerade' or 'process...
The post discusses the class action lawsuit against Meta, claiming that Facebook intercepted user's encrypted HTTPS traffic using a MITM attack. It provides a technical summary of the Onavo Protect Android app and how it intercept...
GTPDOOR is a Linux-based malware designed to be deployed on telco networks adjacent to the GRX with the feature of communicating C2 traffic over GTP-C signalling messages. It can blend in with normal traffic and reuse already perm...
0Gamified tooth brushing
2024-02-10 •
The text is an investigation into the data a connected toothbrush app was sending out to the Internet. The author found that the app was well-behaved and did not send out sensitive data, but it did share data with third parties. T...
The text discusses a specific issue with AFL++ and how to solve it by setting LD_BIND_LAZY=1 when running afl-fuzz. It explains the dynamic linking process and how to avoid runtime linking errors. The author also provides backgrou...
This post is a continuation of the research into the BM2 Battery Monitor product which was found to be covertly collecting a significant amount of location data. In this post we will look at two ways of obtaining the firmware from...
The investigation was done live over X / Twitter to find out what changes had been made after the expose on a popular car battery monitor. The developer removed the 3rd party library that was siphoning up cell tower and Wi-Fi data...
The text is about a smart Wi-Fi plug that has some security issues and almost killed the author. The author explores the plug and discovers that it leaks Wi-Fi access point SSID directly from the device. The plug also requests loc...
The post is a series of tweets from Twitter / X where the author live tweeted the activity of finding out why a connected lightbulb app was asking for location permissions. The author discovered that the app opportunistically siph...
The text is about reversing the BLE protocol of the BM2 Battery Monitor. It explores the Bluetooth Low Energy implementation of the BM2 application, decryption of characteristics messages, and the anti-piracy feature. It also disc...
The post provides an analysis of the AMap mobile location services SDK, including its functionality, network traffic, encryption, and outbound traffic. It discusses the process of collecting and encrypting location information, th...
The text discusses the discovery of a Bluetooth enabled battery monitor that covertly tracks users' physical location, collecting GPS coordinates, cell phone tower data, and nearby Wifi beacons. The data is sent to servers in Hong...
The post documents a method to extract the firmware from a TP-Link VR1600 router. It discusses the hidden super user account, the possibility to connect to the serial/UART of the Broadcom SoC, and the process of dumping the flash ...