Identifying Vulnerabilities in Software and Hardware

I’ve discovered a significant vulnerability in the Arm® TrustZone® CryptoCell 310 AES-128 hardware engine within the Nordic Semiconductor nRF52840 SoC, which has been acknowledged in the Nordic Security Advisory SA-2025-380-v1.0. By inducing precisely timed voltage fault injection, I was able to bypass the AES encryption and recover plaintext in ECB, CBC, and CTR modes. This vulnerability exposes sensitive data, making cryptographic methods like key rotation and CBC initialization vectors ineffective. Additionally, observed error byte diffusion under fault conditions could be potentially exploited for Differential Fault Analysis (DFA), particularly in ECB mode. This is a hardware vulnerability that cannot be patched easily without a redesign of the silicon. However, I proposed several firmware-level countermeasures to mitigate the attack's impact. These techniques, while effective, come with performance trade-offs and should be evaluated based on the specific use case. The attack was performed using my custom low-cost voltage fault injection tool based on the crowbar technique. As physical access is required for such attacks, minor hardware modifications like capacitor removal are not a significant barrier. Still, I achieved successful results without needing to remove any capacitors, demonstrating the practicality and repeatability of this approach. Discovery Reported to Nordic Semiconductor ASA on Nov 13, 2024. Public Disclosure Coordinated with Vendor on Apr 11, 2025. Full Research: https://lnkd.in/dZuMmp2C Nordic Security Advisory: SA-2025-380-v1.0 https://lnkd.in/dNCrabzK Sharing this to inform and support the embedded and hardware security community. #cybersecurity #infosecurity #hardwaresecurity #penetrationtesting #cyberdefense #cyberattack #redteam #redteaming #vulnerabilities #cryptography #hardwaredesign #hardwareengineering #softwareengineering #iotdevices #iotsecurity #hardware #development #communication #embeddedsystems #embeddedsoftware #iot

Multiple Vulnerabilities . ZKTeco Inc WL2 Biometric Attendance Systems 📅 January 2025 → August 2025 🔹This journey started with a chip-off analysis, where I desoldered the NAND flash and extracted the Firmware for a deep-dive. After rigorous Reverse Engineering, I even re-soldered the chip back and validated the findings directly on the hardware with testing probes ensuring every vulnerability was not only theoretical but practically verifiable. 🔹But what made this disclosure special was the step-by-step firmware evolution. Each version showed progress, yet critical gaps remained until the final advisory. 🔄 Firmware Evolution Across the Journey: 🔹FIRST Firmware 🧱 Contained cleartext Wi-Fi configuration, hardcoded superuser credentials, private key exposure, and embedded MQTT secrets. 🔓 High risk of unauthorized access and device compromise. 🔹Second Firmware 📦 Vendor patched plaintext credential storage and removed some MQTT broker details. ✅ Security improved, but private keys and Wi-Fi data were still exposed. 🔹Final Assessment 🔐 Despite repeated improvements, hardcoded private keys and cleartext Wi-Fi storage remained unresolved. 📢 Disclosure escalated to CERT-In , leading to official advisory: https://lnkd.in/dZU97ibv 🔍 Vulnerabilities Disclosed (ZKTECO Device) 🔹Cleartext Storage Vulnerability (CVE-2025-54464) 🔹Hard-coded Credentials Vulnerability (CVE-2025-54465) 🔹Hard-coded Private Key Vulnerability (CVE-2025-55279) 🔹Information Disclosure Vulnerability (CVE-2025-55280) 🤝Collaboration NOTE 🔹The vendor remained supportive and engaged throughout the disclosure journey providing firmware updates, assisting in validation, and coordinating on fixes. At times, the impact was understandably downplayed as being “less likely in real-world use” since these devices are often deployed indoors or within offices. 🔹Nevertheless, their cooperation, combined with CERT-In’s guidance, ensured that the vulnerabilities were formally addressed and responsibly disclosed. 📢 Official Disclosure: 🔗 CERT-In Advisory: CIVN-2025-0172 https://lnkd.in/dZU97ibv 🗓️ Published: August 2025 🔐 This journey is a reminder that securing IoT/biometric devices requires layered protection, removing hardcoded secrets, encrypting sensitive configs, and hardening firmware protection. #ZKTeco #IoTSecurity #FirmwareSecurity #ChipOff #CERTIn #ResponsibleDisclosure #VulnerabilityResearch #CyberSecurity #HardwareHacking #EmbeddedSecurity #CVEs #BugBounty #HackerNews #InfosecCommunity #ExploitDev #MalwareResearch #RedTeam #BlueTeam #ZeroDay

I am glad to share our upcoming HOST-2025 paper on DOME, an ML-based tool for finding system side channels in hardware and software. DOME is a highly effective framework for detecting side-channel vulnerabilities in security-sensitive systems. It works by systematically refining secret inputs and analyzing performance monitoring unit (PMU) event traces using unsupervised ML to find pairs of inputs that produce measurably different behaviors—clear evidence of secret-dependent execution and thus, side-channel leakage. One of DOME’s strongest advantages is that its findings are highly actionable: when it discovers a vulnerability, it also identifies two specific inputs that facilitate debugging and patching. In practical use, DOME evaluated several cryptographic libraries and found multiple side-channel vulnerabilities in LIBGCRYPT, including four new ones in the latest version (1.11.0) affecting the RSA, DSA, and ElGamal algorithms. These were responsibly disclosed and subsequently verified as fixed by the LIBGCRYPT developers. You can read the DOME paper here: https://lnkd.in/dpsVC-a7 We will be releasing DOME soon, please watch here for updates. #security #privacy #computerarchitecture #hardwaresecurity

Product security is approaching structural discontinuity. We’re operating in an agentic-speed SDLC. Code is no longer authored exclusively by humans bounded by sprint cycles and manual review. AI agents now generate features, refactor services, upgrade dependencies, write tests, and submit pull requests autonomously. In several enterprise environments, 20–60% of net-new code is AI produced. CI/CD throughput has multiplied. Yet most AppSec programs are still calibrated for a human-paced model: static SAST, signature-based SCA, and quarterly CVE backlog reporting. That control architecture collapses at machine velocity. The economics of vulnerability discovery are shifting. Advanced LLM-driven reasoning systems now combine semantic code analysis, data-flow modeling, symbolic execution hints, and historical commit inference to surface multi-step exploit chains broken authorization flows, unsafe object rehydration paths, race conditions in async microservices that pattern-matching scanners routinely miss. These systems do not merely flag risks; they simulate exploitability, generate PoC payloads, and propose minimal, regression-safe patch diffs within hours. When discovery becomes cheap and automated, the bottleneck moves upstream. Tracking millions of findings is meaningless if you cannot differentiate reachable, exploitable vulnerabilities from theoretical ones in real time. AppSec must pivot to exploitability-aware triage correlating static signals with runtime reachability, privilege context, traffic exposure, and dependency graph criticality. Security decisions must be probabilistic and context-aware, not signature-driven. Second, advisory models are insufficient. Security teams need controlled commit authority. AI-assisted remediation engines should draft policy-constrained, test-validated patches that integrate seamlessly into CI pipelines. No PR spam. No destabilizing upgrades. Deterministic, minimal diffs aligned with architectural invariants. Finally, the strategic shift is prevention-centric. Instead of detecting violations post-commit, embed machine-readable security policies directly into AI coding agents. Constrain generation with architectural guardrails, privilege boundaries, and trust-zone semantics. Secure-by-construction becomes feasible when agents accept deterministic guidance. (keep all the solutions short and simple and technical with points) And the true frontier is business logic integrity. CVEs are table stakes. What breaches enterprises are flawed authorization models, transaction sequencing errors, and systemic trust violations—failures of intent, not syntax. The future AppSec function operates as a continuous, autonomous validation fabric embedded within CI/CD exploitability-aware, AI-augmented, prevention-first. In an agentic-speed SDLC, security must actively govern and control autonomous code in real time.

Just finished a deep dive into the new GPUHammer research, and it's a striking, real-world demonstration of the hardware attack vectors we break down in my book, Red Teaming AI. For anyone building, securing, or red-teaming AI, this isn't just an interesting paper—it's a practical warning. Here are three key takeaways: 1. Hardware Is the New Software Attack Surface. We traditionally hunt for vulnerabilities in code. GPUHammer bypasses this entirely. By hammering physical memory cells on a GPU, the attack creates electrical interference that flips bits in adjacent cells (a Rowhammer attack). This is a core concept in the Hardware Attacks chapter of my book: the AI threat landscape extends down to the silicon. Your red team playbooks must now include scenarios that test for physical-layer manipulation, not just logical code exploits. 2. Attacks Can Be Silent and Logical, Not Just Loud Crashes. The most dangerous part of this attack is that it doesn’t cause a crash. It introduces subtle logical corruption, degrading a model's accuracy from 90% to 10% silently. This highlights a critical challenge for security teams: monitoring for a gradual loss of integrity is much harder than detecting a system failure. It forces us to move from binary (up/down) monitoring to sophisticated behavioral analysis. 3. Proximity Is the New Privilege. A classic Rowhammer attack doesn't require root access; it requires running code on the same physical hardware. In a multi-tenant cloud or edge environment, this means a low-privilege application could potentially corrupt a high-security model running on the same GPU. This completely re-frames threat modeling—physical proximity becomes a critical vulnerability, independent of traditional software permissions. Why this matters When we red team AI systems, we often focus on abstract data poisoning or evasion. But when the hardware itself can be made to lie, the integrity of every single inference is at risk. This isn't just about model accuracy; it's about the trustworthiness of financial reports, medical diagnostics, or autonomous vehicle decisions. These findings translate directly into unexplainable data corruption and a total failure of model governance. How I’m using this next week ➵ Expanding the "Hardware Fault Injection" scenarios in our AI red team templates to simulate GPUHammer-style logical corruption. ➵ Updating our testing methodology to include monitoring for silent integrity degradation in long-running inference workloads. ➵ Using this paper as a case study with clients to demonstrate why red teaming the full stack—from the application down to the physical layer—is non-negotiable. If you're grappling with how to model and test for these deeper hardware threats against your AI systems, let's connect. Always happy to swap lessons learned from the field. See link to paper in first comment. #AIRedTeam #HardwareSecurity #GPUHammer #AISecurity #Vulnerability #CyberSecurity #MachineLearning #RedTeamingAI

While writing a material on Exploit Development and analyzing research from colleagues and friends, I noticed that each person follows a different methodology to reach a conclusion. However, they all start by achieving the minimum before reaching the expected impact. When we look for a vulnerability, we immediately want the greatest possible impact, however, noting the modus operandi of other researchers, we can notice a methodology that involves several steps before reaching the final objective. 1) What type of vulnerability and technologies are involved? Before anything else, it is essential to understand what type of vulnerability we are investigating. - What technologies does the service use? - How does it interact with other systems? - Are there any dependencies that could be exploited? 2) How does the system react to the first exploitation attempt? - Does it crash? - Does it return a useful stack trace? - Is there a flow control deviation? - Does it return sensitive data that can be exploited? - Is there a security mechanism blocking the exploitation? These questions can help define the approach to explore the vulnerability. 3) Gather detailed information before attempting a more aggressive exploitation. Many times, a methodical approach is more effective than trying an RCE or privilege escalation right away. Before escalating the exploitation, consider: - The software and operating system version. - The service permissions. - Specific configurations that may affect the vulnerability. 4) Bypass security controls one by one. If you are exploring a buffer overflow, you may encounter protections such as: - DEP - ASLR - CFI Therefore, understanding and implementing bypasses for these mechanisms is crucial. Additionally, research from other professionals can be extremely useful in helping bypass these protections. 5) Building the Proof of Concept (PoC) and testing. - Start simple. - Try a basic exploitation, such as printing a message on the system. - Gradually evolve until you reach the main goal. - Test in different environments to measure the success rate of the exploitation. These are the key points for effective research. I also remembered a tool called Exploit Pack, which follows this methodology and brings together a set of tools to identify vulnerabilities and build custom exploits all in one place. For those who can afford it, it might be an interesting tool. Link: https://exploitpack.com/ #redteam #cybersecurity #exploitdevelopment #vulnerabilityresearch

🔒 Understanding Speculative Execution, the Spectre Attack, and the Role of Static Verification🔒 🚀 Modern processors use speculative execution to boost performance, but this optimization comes with risks. One of the most notable vulnerabilities, Spectre 🕵️♂️, was discovered in January 2018 and exploits speculative execution and branch prediction logic to access sensitive data.  Here’s a quick breakdown:  1️⃣ Speculative Execution 🧠: Processors predict and execute instructions ahead of time to enhance performance. If predictions are correct, results are committed; if not, they’re discarded.  2️⃣ Branch Prediction Logic🔀: Tracks patterns in branch instructions to improve accuracy but can be manipulated.  3️⃣ Spectre Attack ⚠️: Attackers trick processors into executing instructions that reveal secrets—such as accessing out-of-bounds array elements—to cache memory. Even discarded speculative results leave traces in the cache, exposing sensitive data.  🔍 The Exploit: 💡 Attackers influence speculative paths, loading sensitive data into the cache.   ⏱️ By measuring cache access times, they infer which data is present.  💡 Static Verification as a Solution 🛠️:   Static verification tools can detect speculative execution vulnerabilities during development. 🛡️ By identifying unsafe memory access patterns and side-channel risks early, developers can fix issues before deployment, reducing the likelihood of exploits.  Static verification can provide an "absence of bugs" guarantee, ensuring that speculative execution doesn’t inadvertently expose sensitive data. Static technologies help identify potential security issues within the architecture itself, reducing the risk of such attacks. 🌟 Key Takeaway: Spectre is a stark reminder of the trade-offs between performance and security. Integrating tools like static verification can help balance these needs and safeguard systems from such vulnerabilities.  What are your thoughts on balancing ⚙️ performance and 🛡️ security in system design? Let’s discuss below! ⬇️  #CyberSecurity #SecureSystems #SpeculativeExecution #SpectreAttack #StaticVerification #TechInnovation 💻🔐  

🔐 Comprehensive Pentesting Tools for Cybersecurity Professionals As cybersecurity professionals, we rely heavily on various tools to perform security testing, assess vulnerabilities, and ensure systems are fortified against potential threats. Below is a well-organized toolkit to help you navigate different areas of pentesting. 🚀 🛠 1. Web Application Pentesting Web apps are frequent targets for attacks. These tools help identify vulnerabilities such as XSS, SQL injection, and more: 🔹 Burp Suite Pro 🔹 OWASP ZAP 🔹 Nikto 🔹 Acunetix 🔹 SQLMap 🔹 Amass 🔹 Fortify-WebInspect 📱 2. Mobile Application Pentesting As mobile apps grow in popularity, securing them becomes critical. These tools help assess both Android and iOS applications: Android: 🔹 MobSF, Frida, APKTool, JADX, Drozer, Magisk Root, APXK AndroidStudio/Genymotion, mitmproxy, Objection, adb iOS: 🔹 MobSF, Frida, Burp Suite Mobile Assistant, Needle 2, iMazing 🔐 3. API Pentesting APIs are essential for web and mobile applications but also present security risks. These tools help you ensure API security: 🔹 Postman, Insomnia ,Burp Suite Pro, OWASP Amass, 42Crunch API Security, Swagger Inspector, Kite Runner 🔍 4. Secure Code Review Code reviews are crucial for identifying vulnerabilities before deployment. These tools assist in static analysis: 🔹 SonarQube, Snyk, Semgrep ,Checkmarx, Veracode, FortifyWorkbenchAudit , CodeQL, Bandit, FindSecBugs 🖥 5. Thick Client Pentesting For applications with thick (desktop) clients, the following tools help analyze them for security flaws: 🔹 Fiddler, Burp Suite Pro dnSpy, IDA Pro, Ghidra ,Process Explorer, CFF Explorer 🌐 6. Network Pentesting Identifying vulnerabilities in network infrastructure is a key step in securing systems: 🔹 Nmap, Wireshark, Metasploit Framework ,Nessus, OpenVAS, Responder BloodHound, CrackMapExec, Netcat, Bettercap ☁️ 7. Cloud Security As cloud infrastructure becomes more widespread, securing it is a top priority: 🔹 Prowler, ScoutSuite, CloudSploit ,Pacu, Steampipe, CloudMapper 🐳 8. Container Security With the increasing adoption of containers, tools like the following help assess their security: 🔹 Trivy, Aqua Microscanner, Clair ,Anchore, Docker Bench, Kube-bench, Falco 🧷 Harun Seker, CISSP #Cybersecurity #PenetrationTesting #PentestingTools #NetworkSecurity #CloudSecurity #MobileSecurity #API #DevSecOps