← Feed

Posts

• Post #4501624

  Everything about Android's hardware attestation... and how to bypass it. Blog post and code by Eric Le Guevel https://blog.quarkslab.com/bypassing-android-hardware-attestation.html

• Post #4206765

  "How does it even work?" The question that keeps hackers' hearts pumping, blood pressure rising, and curiosity growing. This is @virtualabs's reverse engineering journey into a cheap smartwatch that measures at least one of those. https://blog.quarkslab.com/nerd-life-weeks-firmware-teardown-we-were-right.html

• Post #4206764

  "Intego X9: Never trust my updates" Read @coiffeur0x90's research showing how XPC interprocess communications and the update mechanism of the Intego antivirus for MacOS can be abused for local privilege escalation. https://blog.quarkslab.com/intego_lpe_macos_3.html

• Post #4206763

  Rule 1️⃣ : "In WAF we (should not) trust" Your WAF is doing its best. That's just not enough 😮‍💨 A deep dive into Web Application Firewall bypass techniques, discovering why blocked ⛔ doesn't always mean safe. https://blog.quarkslab.com/in-waf-we-should-not-trust.html

• Post #4206762

  The dragon has a VM. Of course it does. Our latest blog walks through the analysis of a complex C++ binary hiding behind a virtual machine, themed as a classic RPG fight. QBDI & TritonDSE are your weapons of choice. The dragon doesn't stand a chance. 🐉 🔗 https://blog.quarkslab.com/qbdi-vs-tritondse-against-a-vm-who-will-be-the-fastest.html

• Post #4206761

  After @coiffeur0x90 found 3 LPEs in Intego antivirus for macOS, @kaluche_ had to check the Windows version too. Spoiler: it was vulnerable. Here's the full write up of a symlink attack to achieve Local Privilege Escalation👇 https://blog.quarkslab.com/milking-the-last-drop-of-intego-time-for-windows-to-get-its-lpe.html

• Post #4206760

  🤔Ever wondered how your favorite tools work under the hood? During our work on SightHouse, we dug into BSIM, Ghidra's Binary function SIMilarity engine. Many tools have been built around it, yet its internals remained undocumented. Until now 👇 https://blog.quarkslab.com/bsim-explained-once-and-for-all.html

• Post #4206759

  Obfuscation vs The Optimizer: A Battle in LLVM Middle End. @yates82 shows us how the continuous improvement of the LLVM optimizer defeats naive code obfuscation, and how the obfuscator can fight back. An eternal fight in which all victories are ephemeral https://blog.quarkslab.com/obfuscation-vs-the-optimizer-an-llvm-middle-end-arms-race.html

• Post #4206758

  Do you know how Entra ID applications work? What about the security mess they can bring and what they can quietly break? New blog post on Entra ID application permissions, the audit nightmare they create, and QAZPT, the open-source tool we built to actually make sense of it. https://blog.quarkslab.com/auditing-application-permissions-in-microsoft-entra-id-hidden-risks-pitfalls-and-quarkslabs-qazpt-tool.html

• Post #4206757

  Paramiko is a pure-Python implementation of SSHv2. Recently, we worked with the Paramiko team on a security audit sponsored by @ostifofficial 🙏 Read a summary of our findings and find the full report here: https://blog.quarkslab.com/paramiko-security-audit.html

• Post #4206756

  A hands-on look at Microsoft’s Independent Guest Virtual Machine (IGVM) format inside OpenHCL’s `openhcl.bin`. We unpack the fixed header, variable headers, data layout, and how IGVM measurement supports Confidential Computing with SEV-SNP and TDX. 🔗 https://blog.quarkslab.com/the-igvm-file-format.html

• Post #4206755

  Did you hear about Optical Line Terminals? ISPs rely on them to build their service networks, but what if they are vulnerable? Here @coiffeur0x90 shows how attackers could compromise entire ISPs by exploiting them and cloud-based fleet management software https://blog.quarkslab.com/how-olts-may-have-exposed-entire-isp-networks.html

• Post #4206754

  What happens when reverse engineers spend weeks digging into a Scala 3 codebase? 🔍 From code review to fuzzing, our assessment helped strengthen Scala's security and identify areas for improvement. We're happy to share the results of our audit, conducted in collaboration with @ostifofficial https://blog.quarkslab.com/scala-security-audit.html

• Post #4206753

  Practical Android Software Protection in the Wild: An Appetizer In which @farenain analyzes 2.5 million Android apps to identify and classify the obfuscators, packers and code protectors they use: https://blog.quarkslab.com/practical-android-software-protection-in-the-wild-an-appetizer.html

• Post #4206752

  From prompt 😃to pwned 😢: Implementing an LLM in your org? Useful. Trusting its output? That's how a low-priv user became admin. Ship the feature, don't extend it your trust. https://blog.quarkslab.com/from-prompt-to-pwned-chaining-llm-and-web-bugs-to-admin.html

• Post #4206751

  BOLT is a static analysis tool, part of the LLVM compiler infrastructure, used to verify that compiler security hardening options have been applied on a binary. Thanks to @ostifofficial we've worked since November 2025 to improve it. Check our progress here: https://blog.quarkslab.com/extending-llvms-bolt-based-binary-analyser-to-validate-stack-variable-initialisation.html

• Post #4206750

  Obscure Element: Reverse engineering Xiaomi's MJA1 secure chip. Mengsi Wu's journey starts here: https://blog.quarkslab.com/black-box-probing-a-security-analysis-of-xiaomis-mja1-secure-chip.html

• Post #3631376

  Cortex is a long-term, multi-tenant scalable open source storage for Prometheus and OpenTelemetry. Earlier this year we conducted a security audit sponsored by @ostifofficial@fosstodon.org Check our report here: https://blog.quarkslab.com/cortex-security-audit.html

• Post #1804796

  Reverse engineers often spend a lot of time deciphering third-party firmware libraries. At RE//verse 2026 (Fri, 5 PM), Benoit & Sami will introduce SightHouse, an open-source tool to automatically identify third-party functions and speed up analysis. Join us!

• Post #1800975

  Finding a buggy driver is one thing, abusing it is another🧠 In his latest blog post, Luis Casvella shows you how BYOVD can be used as a Reflective Rootkit Loader ! 🚀 ➡️ https://blog.quarkslab.com/exploiting-lenovo-driver-cve-2025-8061_part2.html

• Post #1157677

  🚗 We traced a car’s life from China to Poland. By analyzing a BYD Telematic Control Unit, Romain Marchand reconstructed its journey and identified a real-world event from GPS logs alone. Embedded forensics + OSINT = real stories hidden in data. 👉 https://blog.quarkslab.com/tearing-down-a-car-telematic-unit-and-finding-an-accident-on-facebook.html

• Post #938397

  Tired of reversing the same libc for the 100th time? 👀 Meet SightHouse, our open-source tool that automatically detects third-party library functions in binaries. High-confidence function mapping. Works with any disassembler. By @Mad5quirrel & Sami. 🔗 https://blog.quarkslab.com/sighthouse-automated-function-identification.html