Date Fri 14 February 2025
Author Loïc Buckwell
Category Vulnerability

Apple released iOS 18.3.1 (build 22D72) to patch a vulnerability tied to the Accessibility framework and reported by Citizen Lab. Let's analyze it!

Date Tue 11 February 2025
Author Gwaby
Category Exploitation

In this blog post we explain the consequences of asking our R&D boss for a Steam Deck as a Christmas gift. It involves a couple of vulnerabilities, limited primitives, challenging exploitation and a long disclosure process.

Date Tue 21 January 2025
Authors Dahmun Goudarzi, Sebastien Rolland, Ramtine Tofighi Shirazi
Category Software

The OSTIF engaged with Quarkslab to perform a security audit of the Notary project, focused on new features.

Date Fri 25 October 2024
Author Baptiste Boyer
Category Fuzzing

This blog post presents our fuzzer for the Bluetooth Low Energy GATT layer and the related vulnerabilities found with it.

Date Fri 18 October 2024
Author Quarkslab
Category Life at Quarkslab

The internship season is back at Quarkslab! Our internship topics cover a wide range of our expertise and aim at tackling new challenges, namely:

Date Thu 17 October 2024
Author Benoît Forgette
Category Kernel Debugging

Techniques for analyzing binaries or kernel modules that may try to monitor themselves, similar to malware behavior. To avoid detection during analysis, one approach is to use an hypervisor like QEMU to conduct research within a virtualized environment. Although the target may realize it is running in a virtual machine, this usually does not trigger suspicion, as hypervisors are common in modern environments. This method allows for detailed analysis while maintaining stealth, making it effective in scenarios where the target must not detect the monitoring.

Date Tue 15 October 2024
Authors Maxime Rossi Bellom, Raphaël Neveu
Category Android

We discovered several vulnerabilities impacting the boot chain of several Samsung devices. Chained together, they allow us to execute code in the bootloader, get root access on Android with persistency, and finally leak anything from the Secure World's memory including the Android Keystore keys.

Date Thu 10 October 2024
Author Mathieu Farrell
Category Pentest

The following article explains how during an audit we took a look at Apache Superset and found bypasses (by reading the PostgreSQL documentation) for the security measures implemented.

Date Tue 08 October 2024
Author Mathieu Farrell
Category Pentest

The following article explains how during a Purple Team engagement we were able to identify a vulnerability in Microsoft Teams on macOS allowing us to access a user's camera and microphone.

Date Thu 03 October 2024
Author Célian Glénaz
Category Cryptography

Following a brief introduction to differential fuzzing, this blog post reviews the leading tools that leverage it for testing cryptographic primitives. In the second half, we present a method for creating a differential fuzzer along with the results we obtained.