Category Archives: Security

Some notes on the Monotonic Counter in Intel SGX and ME

Posted on November 10, 2017 by

SGX sealing is vulnerable to rollback attacks as the enclave is not able to tell if the sealed data is the latest or a old copy. To mitigate this attack, monotonic counter (MC) has been introduced in Intel SGX SDK … Continue reading →

Posted in Security | Tagged , , , | 12 Comments

A PoC of DoS attack in Elixir Actor Model

Posted on September 29, 2017 by

The naive way of using the Actor model in Elixir is using “receive” in a loop, which is then “spawn”d as a Erlang process. Unfortunately, a potential DoS attack could happen if the pattern matching is not coded carefully with … Continue reading →

Posted in Programming, Security, Static Code Analysis | Tagged , , , , | Leave a comment

Understanding kcov – play with -fsanitize-coverage=trace-pc from the user space

Posted on June 1, 2017 by

kcov is a kernel feature used to support syzkaller[1]. To provide the code coverage information from the kernel itself, the GCC compiler was patched to instrument the kernel image[2]. The kernel itself was also patched to enable this feature where … Continue reading →

Posted in OS, Security, Stuff about Compiler | Tagged , , | Leave a comment

SGX Bug SKL012 and CHIPSEC

Posted on December 16, 2016 by

Intel SGX CPU (staring from Skylake) has been there for while. The good news is that there is still no known exploitation against SGX self yet, though there are some exploitations in the enclave code and Intel SGX SDK. In … Continue reading →

Posted in Security | Tagged , , , , , , | Leave a comment

Making USB Great Again with USBFILTER – a USB layer firewall in the Linux kernel

Posted on August 4, 2016 by

Our paper “Making USB Great Again with USBFILTER” has been accepted by USENIX Security’16. This post provides a summary of usbfilter. For details, please read the damn paper or download the presentation video/slides from USENIX website. I will head to … Continue reading →

Posted in Dave's Tools, OS, Security | Tagged , , , , , , , , , , , | Leave a comment

Malware Reverse Engineering – Part II

Posted on July 17, 2016 by

While most tools for MRE are staightforward, some of them require time, patience, and skills to show the full power. For static analysis, this means IDA; for dynamic analysis, it is OllyDbg (and WinDbg for Windows kernel debugging). In this … Continue reading →

Posted in Security, Static Code Analysis | Tagged , , , , , , , , , | Leave a comment

Malware Reverse Engineering – Part I

Posted on July 17, 2016 by

I took a “Malware Reverse Engineering (MRE)” class last semeter and it was fun to me, partially because I was not a Windows person, though I am still not. What seems ridiculous to me is how trivial one can write … Continue reading →

Posted in Security, Static Code Analysis | Tagged , , , , , , , , , | Leave a comment