Latest news

The Pedersen hash function has gained popularity due to its efficiency in the arithmetic circuits used in zero-knowledge proof systems. Hash functions are a crucial primitive in cryptography, and zero-knowledge proof systems often make heavy use of them, for example when computing Merkle tree roots and paths. Instead of being based on complex bit-fiddling operations … Continue reading Breaking Pedersen Hashes in Practice →

About four months ago, in October 2022, I was idly poking around the “ICE TEA” leak. This leak was of particular interest to me, because it happened to expose the source code for Intel’s Alder Lake platform BIOS. It’s always fun to finally get to see the code for modules that you previously reverse engineered. … Continue reading A Race to Report a TOCTOU: Analysis of a Bug Collision in Intel SMM →

We are delighted to be supporting #CYBERUK once again as their Technical Masterclass sponsor for 2023. Find out more here https://t.co/gWezCYtiKT

The Cisco AnyConnect client has received a fair amount of scrutiny from the security community over the years, with a particular focus on leveraging the vpnagent.exe service for privilege escalation. A while ago, we started to look at whether AnyConnect could be used to deliver payloads during red team engagements and having used the technique … Continue reading Making New Connections – Leveraging Cisco AnyConnect Client to Drop and Run Payloads →

We’re delighted to join the Cloud Security Alliance (@cloudsa) and look forward to increasing awareness of the cloud specific security challenges organisations face. Find out more on our newsroom. https://t.co/PQmgKNIy3D

There is a specific type of cryptographic transformation that arises in storage-oriented blockchains. The transformation is a “slowable” 1-1 mapping which does not involve any secrets and is tradeoff-resistant in the following sense: it should not be possible to partially compute the function, store a fraction of the function’s state and then resume and finish … Continue reading A Primer On Slowable Encoders →

This publication is part of our Annual Threat Monitor report that was released on the 8th of Febuary 2023. The Annual threat Monitor report can be found here. Authored by Alberto Segura Introduction Hydra, also known as BianLian, has been one of the most active mobile banking malware families in 2022, alongside Sharkbot and Flubot … Continue reading Threat Spotlight – Hydra →

This is a four part blog post series that starts with Rustproofing Linux (Part 1/4 Leaking Addresses). Shared memory is often used to share data without the performance hit of copying. Whenever a shared resource is consumed by one component while being modified by another component, there is potential for Time-Of-Check-Time-Of-Use (TOCTOU) or Double Fetch … Continue reading Rustproofing Linux (Part 4/4 Shared Memory) →

This is a four part blog post series that starts with Rustproofing Linux (Part 1/4 Leaking Addresses). In the C programming language, integer types can be a bit confusing. Portability issues can arise when the same code is used in multiple hardware architectures or operating systems. For example, int is usually 32-bit, but could also … Continue reading Rustproofing Linux (Part 3/4 Integer Overflows) →