Resources

Research, experimentation, and continuous improvement are fundamental to how we operate at elttam. Our consultants spend a significant amount of time exploring new technologies, building tooling, analysing vulnerabilities, and turning interesting problems encountered in the field into deeper technical investigations.
‍

This section brings together that work - from detailed research posts and vulnerability disclosures to tools, publications, and updates from the team. By sharing what we learn, we aim to contribute back to the security community while pushing our own knowledge and capabilities forward.

Sebastien Macke

September 25, 2020

Attacks on GCM with Repeated Nonces

This blog post focuses on AES-GCM and the security impact of using the same IV (nonce) to encrypt data to the users of a web application.

crypto

web

Faraz

September 3, 2020

Simple Bugs With Complex Exploits

This blog post details a root cause analysis for Project Zero Issue 2046 found by Sergey Glazunov.

chrome

turbofan

Brendan Scarvell

July 9, 2020

Lua SUID Shells

This blog post explores how privileged Lua scripts can pop shells without dropping privileges.

lua

privilege escalation

linux

Luke Jahnke

June 24, 2020

Hacking with Environment Variables

A look into how scripting language interpreters can execute arbitrary commands when supplied with malicious environment variables.

environment variables

linux

Mykel Pritchard

January 24, 2019

Are you winning if you're pinning?

This blog post takes a brief look at TLS and certificate pinning, the problem of trust in Certificate Authorities that pinning attempts to address.

mobile

TLS

certificate pinning

Luke Jahnke

November 8, 2018

Ruby 2.x Universal RCE Deserialization Gadget Chain

This blog post details exploitation of arbitrary deserialization for the Ruby programming language and releases the first public universal gadget chain.

ruby

deserialization

Mykel Pritchard

April 24, 2018

Fuze Multi-Card Technology Security Review

Reviewing the security of the Fuze card device revealed no trust boundary between the card and the connecting device, allowing access to stored credit-card information.

mobile

bluetooth

embedded device

reversing

exploitation

Daniel Hodson

December 18, 2017

Remote LD_PRELOAD Exploitation

Analysing a vulnerability in all versions of the GoAhead web server < 3.6.5 that allowed for reliable remote code execution via LD_PRELOAD injection.

exploitation

cve-2017-17562

berne

November 16, 2017

Building Hardened Docker Images from Scratch with Kubler

How to use Kubler to build hardened, minimalistic, Docker Images from scratch for better security.

docker

kubler

devops

Mykel Pritchard

June 15, 2017

Intro to SDR and RF Signal Analysis

We take a brief look into Radio Frequency (RF) theory, Software Defined Radio (SDR), and visual analysis of various RF signal characteristics.

SDR

reversing

hugsy

January 24, 2017

Playing with canaries

Analysis of compiler stack canaries and their implementation across various architectures.

mitigations

reversing

exploitation

Matt Jones

and

Daniel Hodson

August 11, 2016

EFF secure messaging scorecard review

We decided to audit libotr to gauge its general maturity. This post shares some of our work from the audit.

eff

exploitation

Resources

Attacks on GCM with Repeated Nonces

Simple Bugs With Complex Exploits

Lua SUID Shells

Hacking with Environment Variables

Are you winning if you're pinning?

Ruby 2.x Universal RCE Deserialization Gadget Chain

Fuze Multi-Card Technology Security Review

Remote LD_PRELOAD Exploitation

Building Hardened Docker Images from Scratch with Kubler

Intro to SDR and RF Signal Analysis

Playing with canaries

EFF secure messaging scorecard review

In the News

What all the fuss is about