Threat Hunting (Recherche de compromissions)

Threat Hunting (Recherche de compromissions)

Présentation de l'activité de recherche de compromissions du CERT AMOSSYS.

more ...

BreizhCTF 2k18 Write-Ups

BreizhCTF 2k18 Write-Ups

Amossys was a sponsor of the BreizhCTF 2k18, a French hacking competition over a single night (April 20-21th). Many challenges were proposed in a wide range of topics (Web, Reverse, Cryptography, etc). For this occasion, a team was created among our employees (Los Pedrolitos). Here are some write-ups of the solved challenges. And thanks to the organization team for this excellent event in Rennes!

more ...

BADFLICK is not so bad!

We present here an in-depth analysis of the BADFLICK backdoor, which is used by the TEMP.Periscope group also known as "Leviathan".

more ...

The Windows 10 TH2 INT 2E mystery

The Windows 10 TH2 INT 2E mystery

Since Windows 10 TH2, NTDLL's syscall routines have changed: syscalls can now be performed with the SYSCALL instruction, and with the INT 2E old one. We say "old" because, until this change, this method had not been supported on x64 architectures since Windows 8. So why such a change? Let's try to find out.

more ...

DIMCT

DIMCT

We developped a small tool, "DIMCT" which simply allows tracing inter module calls, without a too big overhead.

more ...

Teampass < 2.1.27.9 multiple vulnerabilities

Teampass < 2.1.27.9 multiple vulnerabilities

As part of its evaluation centre work, Amossys led a security review of Teampass 2.1.27.8. Multiple security vulnerabilities were found, and here are the CVE publications.

more ...

BreizhCTF 2k17 Write-Ups

BreizhCTF 2k17 Write-Ups

Amossys was a sponsor of the BreizhCTF 2k17, a French hacking competition over a single night (April 28-29th). Many challenges were proposed in a wide range of topics (Web, Reverse, Cryptography, etc). For this occasion, three teams were created among our employees. Here are some write-ups of the solved challenges. And thanks to the organization team for this excellent event in Rennes!

more ...

Virtualization Based Security - Part 2: kernel communications

Virtualization Based Security - Part 2: kernel communications

This blog post is a second article covering Virtualization Based Security and Device Guard features. In the first part, we covered the system boot process, from the Windows bootloader to the VTL0 startup. In this part, we explain how kernel communications between VTL0 and VTL1 actually work. As they use hypercalls to communicate, we will first describe the Hyper-V hypercalls implementation, then how the kernels use them to communicate. To finish with, we list all the different hypercalls and secure service calls we have identified during this work.

more ...

Virtualization Based Security - Part 1: The boot process

Virtualization Based Security - Part 1: The boot process

This blog post is the first part of a collection of articles covering Virtualization Based Security and Device Guard features. The objectives of these articles is to share a better understanding of these features from a technical point of view. This first article will cover the system boot process, from the Windows bootloader to the VTL0 startup.

more ...

An introduction of Use-After-Free detection in binary code by static analysis

An introduction of Use-After-Free detection in binary code by static analysis

Use-After-Free is a well-known class of vulnerabilities that is commonly used by modern exploits (cf. Pwn2own 2016). In the research project AnaStaSec, AMOSSYS works on how to statically detect such vulnerabilities in binary codes. In this blog post, we explain how the scientific community suggests detecting such type of vulnerabilities. The goal of this state of the art is to define a global methodology that will then let us build a proof of concept tool that satisfies our needs.

more ...