Quarkslab

From kernel oops to kernel exploit: How two little bugs (CVE-2025-23330, CVE-2025-23280) in #NVIDIA open GPU #Linux driver can lead to full system compromise.

Full technical breakdown inside, #vmalloc exploitation technique included!

blog.quarkslab.com/nvidia_gpu_k...

Unsigned FTW!

Finding a buggy driver is one thing, abusing it is another🧠
In his latest blog post, Luis Casvella shows you how BYOVD can be used as a Reflective Rootkit Loader ! 🚀

➡️ blog.quarkslab.com/exploiting-l...

Signal: Yo dawg! I heard you liked ratchets, so we added a ratchet to our Double Ratchet.

Quantum computers are not quite here yet, but now's the time to get ready. After updating their protocol in 2023, @signal.org is now proposing a post-quantum version of their Double Ratchet for message encryption.

Let's see what Signal looks like now!
blog.quarkslab.com/triple-threa...

Identifying obfuscated code through graph-based semantic analysis of binary code - Applied Network Science Protecting sensitive program content is a critical concern in various situations, ranging from legitimate use cases to unethical contexts. Obfuscation is one of the most used techniques to ensure such a protection. Consequently, attackers must first detect and characterize obfuscation before launching any attack against it. This paper investigates the problem of function-level obfuscation detection using graph-based approaches, comparing algorithms, from classical baselines to advanced techniques like Graph Neural Networks (GNN), on different feature choices. We consider various obfuscation types and obfuscators, resulting in two complex datasets. Our findings demonstrate that GNNs need meaningful features that capture aspects of function semantics to outperform baselines. Our approach shows satisfactory results, especially in a challenging 11-class classification task and in two practical binary analysis examples. It highlights how much obfuscation and optimization are intertwined in binary code and that a better comprehension of these two principles are fundamental in order to obtain better detection results.

Brand new paper with Roxane Cohen, Robin David (both from @quarkslab.bsky.social ) and Florian Yger on obfuscation detection in binary code doi.org/10.1007/s411... We show that carefully selected features can be leveraged by graph neural networks to outperform classical solutions.

RW physical memory pages with a side of LSTAR MSR overwrite? YOLO!

BYOVD is a well-known technique commonly used by threat actors to kill EDR 🔪
However, with the right primitives, you can do much more.
Find out how Luis Casvella found and exploited 4 vulns (CVE-2025-8061) in a signed Lenovo driver.
👇
blog.quarkslab.com/exploiting-l...

RTFM they say but if you read the manual and copy code examples from it you may inadvertently introduce vulns in your code 🙀
In April we audited the PHP code. Now we followed up with a review of the code snippets in PHP documentation and found 81 issues 👇
blog.quarkslab.com/security-rev...

Yo dawg, I heard you like Improved Bounds Checking So I improved the bound checks of the bound checks

The two bytes that make size matter:
Reverse engineering Apple's iOS 0-click CVE-2025-43300 improved bounds checking fix, by Madimodi Diawara

blog.quarkslab.com/patch-analys...

The Barbhack 2025 logo m000000

Hacking & Barbecue in the south of France. What could possibly be better?
Barbhack starts this Saturday in Toulon and we're giving away a ticket to a student nearby looking to live the experience

Send us a Chat msg with your name and school
We will notify the winner tonight
www.barbhack.fr/2025/fr/

🚀Ever heard of ControlPlane, software to help you automate tasks on macOS? Turns out, it might also help you become root.
Oops! 😱 @coiffeur0x90 found a Local Privilege Escalation vulnerability.
Read before someone automates your admin rights
👉 blog.quarkslab.com/controlplane...

You finally pwned the Holy Confluence server. What now? Create a user? Reset a password?
🚨Best way to trigger an alert
What if you craft your own Personal Access Token 🔑 for the Admin account ?
Find out how in this blog post by Quarkslab's Red Teamer YV
blog.quarkslab.com/a-story-abou...

leHACK 2025 incoming! - leHACK false

The leHack conference (@le-hack.bsky.social) starts tomorrow at the Cité des Sciences et de l’Industrie in Paris.
We will be there to meet with peers and friends.
3 technical talks, a cool challenge & our famous Car in a Box to play with.
Come and say hi at booth 20.

Full program here:
lehack.org

A Go gopher surfing over a Wireshark shark

Are you a network protocol reverse engineer? Tired of writing Wireshark plugins in memory unsafe or esoteric languages named after celestial objects?
Now you can do it in a few lines of Go, Python or Rust with Wirego.
Benoit Girard explains how here:
blog.quarkslab.com/getting-star...

Attention ✨WomenAtSSTIC✨
We meet at 18:00 today at L'Equinoxe:
3 Place des Lices, 35000 Rennes

See you there!
#sstic2025

Are you a cyber professional, or a future one, coming to #sstic2025 next week?

Come to ✨WomenATsstic✨, an informal and unofficial friendly meetup on Wednesday, June 4th at 6 pm.

We will reserve a bar/café near the Halle Martenot. Register here:
framadate.org/hH2t9FcRtgEG...

Good morning Singapore!

The amazing Off by One Conference 2025 starts today.
If you are attending don't miss Fred Raynal's (our fearless CEO) keynote at 9:35am:

"Spyware for rent & the world of offensive cyber"

The full agenda is available here:
offbyone.sg/agenda

Julio Loayza Meneses talking about Crypto Condor at RWC2005 Paris The top bird of crypto implemetation testing

Quarkslab was glad to sponsor the Real World Cryptography Paris Meetup 4 hosted by @Ledger last night.
Julio Loayza Meneses talked about crypto-condor, our open source tool to test cryptography implementations.
You can learn more about it here:
quarkslab.github.io/crypto-condo...

Proxybloby, the read teamer's mascot that will byte your SOCKS if left alone in your internal network

Look at those cute little blobs in your internal network. They look harmless, but how about the one carrying SOCKS?
It's ProxyBlob, a reverse proxy over Azure.

Check out Alexandre Nesic's article on how it came to exist after an assumed breach mission ⤵️
👉 blog.quarkslab.com/proxyblobing...

a TOCTOU bug in Moodle's core

While casually reading Moodle's code Mathieu Farrell found a SSRF bug exploitable by any authenticated user.
Fun twist? This vuln matches exactly the example Orange Tsai presented at Black Hat 2017.
Real life imitates conference slides 😅
Details here:
blog.quarkslab.com/auditing-moo...

We are so excited to announce the publication of our audit of PHP core! This work was made possible through a collaboration between OSTIF, @thephpf.bsky.social, and @quarkslab.bsky.social with funding provided by @sovereign.tech. For the report and further links, check out ostif.org/php-audit-co...

PHP Core Security Audit Results The PHP Foundation — Supporting, Advancing, and Developing the PHP Language

We are pleased to announce the completion of security audit of PHP core!
Executed by @quarkslab.bsky.social in partnership with @ostifofficial.bsky.social and commissioned by the @sovereign.tech.

Learn more: thephp.foundation/blog/2025/04...

Quarkslab audited PHP-SRC, the open source interpreter of PHP.
The security audit, sponsored by @ostifofficial.bsky.social with funding from @sovereign.tech, aimed at strengthening the project's security ahead of the upcoming PHP 8.4 release.
Here's what we found:
blog.quarkslab.com/security-aud...

There is a small bug in the signature verification of OTA packages in the Android Open Source Framework.
Official builds doing normal double verification of packages are not vulnerable but OEMs and third party apps may be.
Jérémy Jourdois explains it here:
blog.quarkslab.com/aosp_ota_sig...

Who let the RATs in? why, CCleaner v1 did.

New GUI or root access? Choose wisely!

Exploiting a Local Privilege Escalation vulnerability in CCleaner version 1 for MacOS, by @Coiffeur0x90

blog.quarkslab.com/ccleaner_lpe...

A CTF challenge in PHP, what could possibly not be a RCE?

Next week at the Hack The Box 0x4d meetup in Lille, France @rayanle.cat will talk about PwnShop, the challenge he prepared for the PwnMe CTF 2025 and how he accidentally discovered a RCE 0day while doing so.

Join him next Monday at Campus Cyber Hauts-the-France:
www.meetup.com/hack-the-box...

Image of the Cryptocondor, the natural predator of cryptobugs. A mighty bird from the Andes mountain range that fiercely preys on bugs with the invaluable aid of DeltAFLy, which provides differential fuzzing superpowers.

The Fifth Element: Using Quarkslab's cryptographic test suite to find bugs in the reference implementation of HQC, the latest algorithm added to the NIST PQC standard.

Here Célian Glénaz, Dahmun Goudarzi and Julio Loayza Meneses tell you how they did it:

blog.quarkslab.com/finding-bugs...

Your OPC vuln research mission is about to crash? Don't worry fuzzysully can land you safely

The Open Platform Communications Unified Architecture (OPC UA) is an open standard for industrial systems.

In 2024 we worked with @anssi-fr.bsky.social to develop fuzzysully, an OPC UA fuzzer.
Today we are glad to announce that this tool is now open source:
github.com/ANSSI-FR/fuz...

Phishing in the Cloud with Diamonds

From classic HTML pages to advanced MFA bypasses, dive in with @atsika.bsky.social in an exploration of phishing techniques 🎣.

Learn some infrastructure tricks and delivery methods to bypass common detection.
👉 blog.quarkslab.com/technical-di...
(promise this one is legit 👀)

We completed our 2nd audit of Allbrige's Estrela, a decentralized exchange built on the Soroban platform.
Our audit was focused on the 3-token pool implementation and no critical vulnerabilities were found.
The summary and full report can be read here
blog.quarkslab.com/audit-of-all...

An AI generated picture depicting exploitation kungfu against SOplanning. We guess they did not plan for that.

ICYMI: 5 vulnerabilities in SOPlanning, an open source project management application used by major consulting services providers.
In part 2 of "Pwn Everything, Bounce Everywhere, all at once" Mathieu Farrell tells you how to chain them for unautheticated RCE

blog.quarkslab.com/pwn-everythi...

A Plan to Pwn: Reviving a 17 year old bug or winning a race against Project Management? We've got both.

Mathieu Farrell shows you how in the "Pwn Everything, Bounce Everywhere, all at once" blog post series.
blog.quarkslab.com/pwn-everythi...