QR Fuzzing Fun
QR codes [1] have become quite popular due to their fast readability and large storage capacity to send information. It is very easy to find QR codes anywhere these days with encoded information such as a URL, phone number, vCard information, etc. There exist tons of apps on smartphones that are able to read / scan QR codes. The table below shows some of the most common apps and libraries for the major mobile platforms – keep in mind that there are many more apps than listed here….
ST19XL18P – K5F0A Teardown
4 Metal, 350 nanometer fabrication process, EAL4+ smart card. A device fabricated in 2002 and yet, today the latest ST19W/N series only main differences are the ROM data bus output width into the decrypt block and the fabrication process (180nm and 150nm shrink). The device was dipped into a HydroFluoric (HF) bath until the active shielding fell off. The result of this saved about 10 minutes of polishing to remove the surface oxide and Metal 4 (M4). This also helps begin the polishing process on the lower layers fairly evenly….
#HITB2012AMS: Security Bigwigs and Hacker Crème de la Crème Converge in Amsterdam Next Week
Hi guys! We’re less than a week away from #HITB2012AMSand we’re super excited to welcome you there! HITBSecConf2012 – Amsterdam, our third annual outing in Europe will be at the prestigious Hotel Okura Amsterdam and this year marks our first ever week-long event with what we think is a simply awesome line-up of trainings, speakers, contests and hands-on showcase activities. There should be pretty much something to…
Enter the Dragon(Book), Pt 2
Nobody has been able to find this backdoor to date (one reason I’m talking about it). While the C specification defines many requirements, it also permits a considerable amount of implementation-defined behavior (even though it later struck me as odd that many compilers could be coerced into generating this backdoor in an identical way). From the C specification; Environmental Considerations, Section 5.2—in particular section 5.2.4.1 (Translation limits)—seems to offer the most relevant discussion on the topic. Here’s a concise/complete example: typedef struct _copper { char field1[0x7fffffff];…
Hackito Ergo Sum: Not Just Another Conference
My name is Jonathan Brossard, but you may know me under the nic Endrazine. Or maybe as the CEO of Toucan System.. Nevermind: I’m a hacker. Probably like yourself, if you’re reading this blog post. Along with my friends Matthieu Suiche and Philippe Langlois,—with the invaluable help of a large community worldwide—we’re trying to build a conference like no other: Hackito Ergo Sum. First, a bit of background on conferences as I have discovered them: I remember really well the first conference I attended almost a…
Atmel AT90SC3232CS Smartcard Destruction
Having heard that Atmel actually produced three variants of the AT90SC3232 device, we did some digging and found some of this previously never-seen-by-Flylogic AT90SC3232CS. We had already several AT90SC3232 and AT90SC3232C. We assumed that the CS was just a 3232C with an extra IO pad. Well, one should never ass-u-me anything! The AT90SC3232CS is a completely new design based on the larger AT90SC6464C device. Decapsulation revealed that Atmel actually did place an active shielding over the surface of the device. A 350nm, 4 metal process was used on the AT90SC3232CS…
3 Metal 350nm teardown explination
Real quick image as posted on Facebook tech .at. flylogic.net profile. A Total of 4 overlayed images of a small section of an NEC upd78F9210 MCU. A FlipFlop and a few AND’s were quickly spotted. Can you find them?
Enter the Dragon(Book), Part 1
This is a fairly large topic; I’ve summarized and written in a somewhat narrative/blog friendly way here. A few years ago I was reading a blog about STL memory allocators (http://blogs.msdn.com/b/vcblog/archive/2008/08/28/the-mallocator.aspx), memory allocators being a source of extreme security risk, I took the author’s statement, “I’ve carefully implemented all of the integer overflow checks and so forth that would be required in real production code.” as a bit of a challenge. After playing with permutations of the code I was able to get…
IOActive’s IOAsis at RSA 2012
This is not a technical post as usual. This is an invitation for an important event if you are going to RSA 2012 and want to escape the chaos and experience the luxury at IOAsis while enjoying great technical talks and meeting with industry experts. If you want to feel like a VIP and have great time then don’t miss this opportunity! We have scheduled some really interesting talks such as: Firmware analysis of Industrial Devices with IOActive researcher Ruben Santamarta Mobile Security in the Enterprise with IOActive VP, David Baker…
Estimating Password and Token Entropy (Randomness) in Web Applications
Entropy “In information theory, entropy is a measure of the uncertainty associated with a random variable. In this context, the term usually refers to the Shannon entropy, which quantifies the expected value of the information contained in a message, usually in units such as bits. In this context, a ‘message’ means a specific realization of the random variable.” [1] 1. http://en.wikipedia.org/wiki/Entropy_%28information_theory%29 I find myself analyzing password and token entropy quite frequently and I’ve come to rely upon Wolfram Alpha and Burp Suite Pro to get my estimates for these values. It’s…