163 matches found
Decapping with Dave (chip decapping)
Thought I'd share my first attempt at chip decapping using the @LargeCardinal technique. I found using a gas soldering iron more flexible than a blowtorch. This is attempt number two, this time with an Atmel 328 MCU; this is almost a work of art. Blowtorch decapping try number 3. Firstly an STC M...
CVE-2018-11259
Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and...
Improper access control
Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and...
CVE-2018-11259
This CVE (CVE-2018-11259) concerns Qualcomm Snapdragon devices (Automobile, Mobile, Wear) with NAND-based EFS storage. Root cause: improper access control allows fastboot access to erase the EFS partition, after which the apps processor has non-secure world read/write access to that partition unt...
CVE-2018-11259
Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and...
CVE-2018-11259
Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and...
CVE-2016-10389
In all Qualcomm products with Android releases from CAF using the Linux kernel, there is no size check for the images being flashed onto the NAND memory in their respective partitions, so there is a possibility of writing beyond the intended partition...
Code injection
In all Qualcomm products with Android releases from CAF using the Linux kernel, there is no size check for the images being flashed onto the NAND memory in their respective partitions, so there is a possibility of writing beyond the intended partition...
CVE-2016-10389
Technical details about CVE-2016-10389 are not publicly provided in the supplied documents; no affected product/version or remediation details are specified. Monitor for updates from official sources.
CVE-2016-10389
In all Qualcomm products with Android releases from CAF using the Linux kernel, there is no size check for the images being flashed onto the NAND memory in their respective partitions, so there is a possibility of writing beyond the intended partition...
Rowhammer Attacks Come to MLC NAND Flash Memory
The Rowhammer attacks developed by Google more than two years ago put the focus on hardware front and center. That research allowed attackers to flip dynamic random access memory DRAM bits in order to induce those memory cells to change their state. Google’s research enabled kernel-level privileg...
Researcher Proves Viability of NAND Mirroring to Bypass iPhone Passcode Restrictions
NAND mirroring was outright dismissed by FBI director James Comey as a means of breaking into San Bernardino terrorist Syed Farook’s iPhone 5c during the government’s spat with Apple earlier this year. “It doesn’t work,” Comey said. Well, turns out, it does. Sergei Skorobogatov of the University ...
Instead of spending $1.3 million, FBI could have Hacked iPhone in just $100
Do you remember the infamous encryption fight between the FBI and Apple for unlocking an iPhone 5C belongs to a terrorist? Yes, you got it right, the same Apple vs. FBI case where the FBI paid almost $1.3 Million to a group of hackers to unlock that iPhone. However, if the agency had shown some...
FBI Breaks into Terrorist's Encrypted iPhone
A six-week public standoff between Apple and the FBI ended today when the Department of Justice said it had accessed encrypted data stored on the San Bernardino terrorist’s iPhone. The DOJ said in its motion that it no longer needed Apple’s help as mandated in a Feb. 16 court order and asked that...
Attention Turns to FBI's 'Outside Party'
The FBI’s motion for a continuance in its case against Apple has opened a new avenue in this debate as to the identity and means by which the mystery “outside party” could unlock terrorist Syed Farook’s iPhone. Late yesterday afternoon, the FBI filed a motion to vacate a hearing scheduled for tod...
XADV-2013005 FreeBSD 10 <= nand Driver IOCTL Kernel Memory Leak Bug
XADV-2013005 FreeBSD 10 = nand Driver IOCTL Kernel Memory Leak Bug 1. Overview The nand driver in freebsd = 10 has a vulnerability to leak arbitrary kernel memory to the userspace. It's occured at nandioctl kernel function and because no proper initialize the allocated kernel memory. It's the...
CVE-2013-6832
The nandioctl function in sys/dev/nand/nandgeom.c in the nand driver in the kernel in FreeBSD 10 and earlier does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call...
Design/Logic Flaw
The nandioctl function in sys/dev/nand/nandgeom.c in the nand driver in the kernel in FreeBSD 10 and earlier does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call...
CVE-2013-6832
The nandioctl function in sys/dev/nand/nandgeom.c in the nand driver in the kernel in FreeBSD 10 and earlier does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call...
