BootStomp – Find Android Bootloader Vulnerabilities

Keep on Guard!


BootStomp is a Python-based tool, with Docker support that helps you find two different classes of Android bootloader vulnerabilities and bugs. It looks for memory corruption and state storage vulnerabilities.

BootStomp - Find Bootloader Vulnerabilities


Note that BootStomp works with boot-loaders compiled for ARM architectures (32 and 64 bits both) and that results might slightly vary depending on angr and Z3’s versions. This is because of the time angr takes to analyze basic blocks and to Z3’s expression concretization results.

How does BootStomp find Android Bootloader Vulnerabilities?

BootStomp implements a multi-tag taint analysis resulting from a novel combination of static analyses and dynamic symbolic execution, designed to locate problematic areas where input from an attacker in control of the OS can compromise the bootloader’s execution or its security features.

Using the tool the team found six previously-unknown vulnerabilities (of which five have been confirmed by the respective vendors), as well as rediscovered one that had been previously reported. Some of these vulnerabilities would allow an attacker to execute arbitrary code as part of the bootloader (thus compromising the entire chain of trust), or to perform permanent denial-of-service attacks.

The vulnerabilities impact the Trusted Boot or Verified Boot mechanisms implemented by vendors to establish a Chain of Trust (CoT). The team using BootStomp discovered vulnerabilities in the bootloaders used by Huawei, Qualcomm, MediaTek, and NVIDIA.

The team analyzed bootloader implementations in many platforms, including Huawei P8 ALE-L23 (Huawei / HiSilicon chipset), Sony Xperia XA (MediaTek chipset), Nexus 9 (NVIDIA Tegra chipset), and two versions of the LK-based bootloader (Qualcomm).


How to use BootStomp

The easiest way to use BootStomp is to run it in a docker container. The folder docker contains an appropriate Dockerfile, these are the commands to use it:

For Android related security you can also check out:

Androguard – Reverse Engineering & Malware Analysis For Android

You can download BootStomp here:

BootStomp-master.zip

Or read more here.


Topic: Hacking Tools

Google Chrome Marking ALL Non-HTTPS Sites Insecure July 2018

Outsmart Malicious Hackers


Google is ramping up its campaign against HTTP only sites and is going to mark ALL Non-HTTPS sites insecure in July 2018 with the release of Chrome 68. It’s a pretty strong move, but Google and the Internet, in general, has been moving in this direction for a while.

Google Chrome Marking ALL Non-HTTPS Sites Insecure July 2018


It started with suggestions, then forced SSL on all sites behind logins, then mixed-content warnings, then showing HTTP sites are not-secured and now it’s going to be outright marked as insecure.

Three years ago, Google’s search engine began favouring in its results websites that use encrypted HTTPS connections.

Sites that secure their content get a boost over websites that used plain-old boring insecure HTTP. In a “carrot and stick” model, that’s the carrot: rewarding security with greater search visibility.

Later this year comes the stick. This summer, Google will mark non-HTTPS websites as insecure in its Chrome browser, fulfilling a plan rolled out in September 2016.

Starting with Chrome 68, due to hit the stable distribution channel on July 2018, visiting a website using an HTTP connection will prompt the message “Not secure” in the browser’s omnibox – the display and input field that accepts both URLs and search queries.

“Chrome’s new interface will help users understand that all HTTP sites are not secure, and continue to move the web toward a secure HTTPS web by default,”


I’m glad I updated this site to SSL before it became absolutely critical, and to be honest with Google Cloud, Amazon AWS and Lets Encrypt offering SSL termination for free, there’s no real excuse not to be on SSL anymore.

Introducing managed SSL for Google App Engine
New – AWS Certificate Manager – Deploy SSL/TLS-Based Apps on AWS
Getting Started – Let’s Encrypt – Free SSL/TLS Certificates

Because Chrome holds something like 56 percent of the global browser market share across mobile and desktop platforms, Google’s name-and-shame label is likely to be noticed by a great many Chrome users and by any websites those fans no longer visit due to security concerns.

While many websites will be affected, plenty are already in compliance. According to Google, 81 of the top 100 websites use HTTPS by default, over 68 percent of Chrome traffic on Android and Windows occurs over HTTPS, and over 78 percent of Chrome traffic on Chrome OS and macOS and iOS travels securely.

Google offers a free security auditing tool called Lighthouse that can help developers identify which website resources still load using insecure HTTP.

The Chocolate Factory’s shunning scheme follows a similar tack the company has taken to issue warnings to websites that rely on dodgy Symantec digital certificates.

I would imagine similar standards are going to be pushed out across the other browsers given the time and the fact Google is still the biggest search engine, they define how the web reacts.

Make sure your SSL install is secure using these:

TLSSLed v1.2 – Evaluate The Security Of A Target SSL Or TLS (HTTPS) Web Server Implementation
sslscan Download – Detect SSL Versions & Cipher Suites (Including TLS)

The official blog by Google on this is here:

A secure web is here to stay

I personally think this is a step in the right direction and wonder why only 81 of the top 100 sites are on SSL.

Source: The Register


Topic: Countermeasures

altdns – Subdomain Recon Tool With Permutation Generation

Outsmart Malicious Hackers


Altdns is a Subdomain Recon Tool in Python that allows for the discovery of subdomains that conform to patterns. The tool takes in words that could be present in subdomains under a domain (such as test, dev, staging) as well as takes in a list of subdomains that you know of.

altdns - Subdomain Recon Tool With Permutation Generation


From these two lists that are provided as input to altdns, the tool then generates a massive output of “altered” or “mutated” potential subdomains that could be present. It saves this output so that it can then be used by your favourite DNS brute-forcing tool such as:

SubBrute – Subdomain Brute-forcing Tool
Bluto – DNS Recon, Zone Transfer & Brute Forcer

Features of altdns Subdomain Enumeration Tool

Alternatively, the -r flag can be passed to altdns so that once this output is generated, the tool can then resolve these subdomains (multi-threaded) and save the results to a file.

Altdns works best with large datasets. Having an initial dataset of 200 or more subdomains should churn out some valid subdomains via the alterations generated.

altdns Subdomain Recon Tool Usage

You can download altdns here:

altdns-master.zip

Or read more here.


Topic: Hacking Tools

0-Day Flash Vulnerability Exploited In The Wild

Keep on Guard!


So another 0-Day Flash Vulnerability is being exploited in the Wild, a previously unknown flaw which has been labelled CVE-2018-4878 and it affects 28.0.0.137 and earlier versions for both Windows and Mac (the desktop runtime) and for basically everything in the Chrome Flash Player (Windows, Mac, Linux and Chrome OS).

0-Day Flash Vulnerability Exploited In The Wild


The full Adobe Security Advisory can be found here:

Security Advisory for Flash Player | APSA18-01

Adobe warned on Thursday that attackers are exploiting a previously unknown security hole in its Flash Player software to break into Microsoft Windows computers. Adobe said it plans to issue a fix for the flaw in the next few days, but now might be a good time to check your exposure to this still-ubiquitous program and harden your defenses.

Adobe said a critical vulnerability (CVE-2018-4878) exists in Adobe Flash Player 28.0.0.137 and earlier versions. Successful exploitation could allow an attacker to take control of the affected system.

The software company warns that an exploit for the flaw is being used in the wild, and that so far the attacks leverage Microsoft Office documents with embedded malicious Flash content. Adobe said it plans to address this vulnerability in a release planned for the week of February 5.

According to Adobe’s advisory, beginning with Flash Player 27, administrators have the ability to change Flash Player’s behavior when running on Internet Explorer on Windows 7 and below by prompting the user before playing Flash content. A guide on how to do that is here (PDF). Administrators may also consider implementing Protected View for Office. Protected View opens a file marked as potentially unsafe in Read-only mode.


The wild usage of the exploit seems to be in the Korean context with North Korean hackers using it against South Korean targets and apparently they have been using it since November 2017.

It’s a fairly complex attack chain so I’m surprised if it’s a very reliable exploit as it targets Flash content embedded in Microsoft Office documents.

Hopefully, most readers here have taken my longstanding advice to disable or at least hobble Flash, a buggy and insecure component that nonetheless ships by default with Google Chrome and Internet Explorer. More on that approach (as well as slightly less radical solutions) can be found in A Month Without Adobe Flash Player. The short version is that you can probably get by without Flash installed and not miss it at all.

For readers still unwilling to cut the Flash cord, there are half-measures that work almost as well. Fortunately, disabling Flash in Chrome is simple enough. Paste “chrome://settings/content” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.

By default, Mozilla Firefox on Windows computers with Flash installed runs Flash in a “protected mode,” which prompts the user to decide if they want to enable the plugin before Flash content runs on a Web site.

Another, perhaps less elegant, alternative to wholesale kicking Flash to the curb is to keeping it installed in a browser that you don’t normally use, and then only using that browser on sites that require Flash.

Most browsers of the current generation have either no Flash support at all, or make it “ask-first” when Flash content attempts to display. I would hazard a guess that this is why the attackers chose to target Flash embedded in Microsoft Office documents as it’s such ubiquitous software and not so regularly updated or patched by individuals or organsations.

It’s not the first Flash zero-day and it won’t be the last, we’ve reported on a few before, I think the impact should get less and less as more sites phase out Flash and move to native HTML5.

Source: Krebs


Topic: Hacking News
dorkbot - Command-Line Tool For Google Dorking

dorkbot – Command-Line Tool For Google Dorking

dorkbot is a modular command-line tool for Google dorking, which is performing vulnerability scans against a set of web pages returned by Google search queries in a given Google Custom Search Engine. How dorkbot works It is broken up into two sets of modules: Indexers – modules that issue a search query and return the […]

Topic: Hacking Tools
USBPcap - USB Packet Capture For Windows

USBPcap – USB Packet Capture For Windows

USBPcap is an open-source USB Packet Capture tool for Windows that can be used together with Wireshark in order to analyse USB traffic without using a Virtual Machine. Currently, the live capture can be done on “standard input” capture basis: you write a magic command in cmd.exe and you get the Wireshark to capture raw […]

Topic: Hacking Tools