Recent content on REMY HAX
Transport Layer Security (TLS) is the protocol involved in getting the lock icon to appear in your browser next to the URL. Under the hood it uses a bunch of really cool numbers for encryption. Some numbers are considered private and need securing; some are considered public and are fine for sharing. You can mix your numbers with other people’s numbers in such a way that you can verify a…
Cyber, AI, Disruption! There’s some impactful things going on in the world of AI right now and that can make people nervous. There’s also quite a bit going on the the world of Cyber as well, and that’s always gotten people a little shook. Mix them together in a few academic style whitepapers that get traction on social media and you’re got yourself quite the hype train,…
Every few months there’s some sensational news reporting that some high profile individual doesn’t use bluetooth wireless headphones and everyone goes “Wait, what?”. From Taylor Swift’s public appearances featuring exclusive use of wired headphones to former Vice President Kamala Harris on The Late Show with Stephen Colbert stating:
My LILYGO T-Watch S3 Plus (with GPS) arrived with a non-functional LCD. Here’s how I fixed it. First, power off the device using the yellow switch in the back. Then using a PH00 Phillips head screwdriver… Remove all 4 screws and gently pull away the watch straps. There is an antenna hidden inside one side of the watch bands.
Number 3 may surprise you! I’m kidding of course, blatant web-based phishing attacks are boring. This blog isn’t about those. Most of these examples will probably surprise you in some way. This blog is about the spiraling mess of URI handlers, auth flows, proof-of-presence, and the complete lack of fuzzed code coverage of the ecosystem as a whole.
There’s a new Erlang OTP vulnerability, CVE-2025-4748. It’s an Absolute Path Traversal vulnerability involving a Zip archive, which I have a lot of practice with. It affects Erlang OTP, which a coworker has already written about recently and noted the necessary steps to set up an environment.
Ghidra is the best Android app RE tool. It just seems like it’s not, because the loader has easily fixed quirks. Let me demonstrate. A friend reached out and aired some valid grievances the Java community had with this post, particularly “Ghidra is the best Android app RE tool”. I’ve added a section labeled “Community Feedback” that provides some context for why…
Using an AI powered network traffic analysis tool we built called SIFT, GreyNoise has caught multiple anomalous network payloads with zero-effort that are attempting to disable TrendMicro security features in ASUS routers, then exploit vulnerabilities and novel tradecraft in ASUS AiProtection features on those routers.
VPN: phone, not desktop. WiFi: N/A. These statements are correct. Or at least as correct as is applicable to the general user in the scope of the following contextual blog which generally recommends that: “Yes, it’s probably a good idea to be thinking about getting a paid, reputable VPN for your phone.”
Or “everything actually is a nail, you just need a bigger hammer” Graph Theory is a really neat subject matter relating to the modeling of pairwise relations between objects. When you understand graph theory, everything steadily becomes a graph theory problem, because pretty much anything can be.
This article is a long time coming. z3, the constraint solver, is commonly used in crackmes and CTF challenges. Wherever possible, I just lift to angr for symbolic execution and bruteforce that way, since z3 is basically math bruteforce anyways. Regardless:
Remy shares his experience building custom hardware for a scalable Bluetooth Low Energy (BLE) survey, discussing problems encountered, and providing a replicable solution that the audience can implement for approximately $100 (no soldering required). The presentation begins with a brief overview of high-level patterns observed in collected real-world data from this hardware, followed by a detailed…
Recently, products like Claude Code, Cursor, and Copilot have sprung to the forefront of my social media. I’ve ignored these for quite some time, but a coworker recommended that I try out <some product I can't remember> after I was fighting a particularly gnarly public codebase that had opaque documentation and involved a LOT of state machines.
Plagiarism is an ethical violation. Always has been. As such: “A computer can never be held accountable, therefore a computer must never make a management decision”. A legal violation? That’s for courts to decide. But who controls the Large Language Models? Well, unless you’ve invented time-travel, it isn’t OpenAI, Anthropic, Deepeek, etc…
Recently I ran into a headache of Out-Of-Memory errors when using Binary Ninja. Specifically, this was in relation to dissassembling a Mach-O aarch64 binary from an iOS app grabbed from decrypt.day . Usually I have more than enough memory on my analysis host (64GB), but this time I didn’t. And that sucked.
The popular social media app “TikTok” is likely facing an iminent ban in the United States in the coming days. This has resulted in a mass migration to the Chinese app 小红书 (meaning “little red book”), Xiaohongshu, or simply “REDnote”. If you haven’t been made aware of this event and the chaotic hilarity that has ensued, I encourage you to take a peek at…
I’m sorry, but I can’t help with that. We acheived AGI. The clankers died on Christmas. This post is scheduled to automatically publish: 2025-12-25 . Editors note: erroneously leaked this personal commentary blog early due to typoed year. Since it's erroneous early publication, this leak has remained on the hackernews frontpage for several days without moderation removal. This leaked…
Recently I needed to get the data off of a LUKS encrypted partition on a Virtual Machine that “wasn’t mine” and I’d never done it before. As you might imagine, a huge headache ensued. As a preface, if you’ve landed on this blog and you’re thinking to yourself _“Finally, someone will tell me how to recover the LUKS key for my non-bootable system!”
In iOS if you are: Using Apple Maps for directions Playing Music Connected to a car over Bluetooth (not Apple CarPlay) …when you pause your music it will remain paused until the next direction is audibly announced by Apple Maps . At which point, the music will unpause itself once the Apple Maps voice is done talking. Additionally, because all music apps for iOS utilize the OS-hosted audio…
In this blog, the second in the series, you will learn about how to build a database of Bluetooth Low-Energy (BTLE) Generic Attribute (GATT) Universally Unique Identifiers (UUIDs) capable of remotely identifying Bluetooth Low-Energy devices for the purposes of vulnerability research, exploitation, and quantifying impact.
Recently Sift caught an interesting payload. As it turns out, the exploit was CVE-2024-0769, which is now tagged here: D-Link DIR-859 Information Disclosure Attempt . This vulnerability is a path traversal leading to information disclosure. But, perhaps most notably, it affects D-Link DIR-859 WiFi routers. All revisions. All firmware. And the product is End-of-Life (EOL) meaning it will never…
The M5Stack CoreMP135 w/ STM32MP135D is a versatile little DevKit recently released by M5Stack at the $75 price range. I’m a big fan of M5Stack and have purchased many of their kits over the years, with each kit being versatile enough to have served for 10+ projects each over it’s lifetime without issue.
For this last years Binary Golf Grand Prix the goal was to: Create the smallest self-replicating file. Requirements: Produce exactly 1 copy of itself Name the copy “4” Not execute the copied file Print, return, or display the number 4 I sat down with some beer, as one does, and resolved that my personal twist on the challenge would be to not just do a single filetype, but a chain of…
On April 18th, 2020 during peak COVID I did my first real foray into Bluetooth Low-Energy (BTLE) privacy and security. A neighbor in my apartment complex lost their Fitbit Charge 2 smartwatch. I succeeded in “cloning” the watch’s Bluetooth profile in such a way that I could observe when the rightful owners phone would attempt to connect, thus indicating and tracking that the…
In order to see CVE-2023-50164 in the wild, I expect that in the coming weeks, we will see research into vendor and product specific implementations leveraging Apache Struts2 in order to determine exactly what path must be traversed to in order to drop a web shell so that it can be called remotely through a public interface over the defined routes.
Do you know all of the default Windows 7 file formats? I’ve certainly seen a few in my time, though I can’t say I’ve seen a corpus of all the samples in one place. As Binary Gold Grand Prix 4 (BGGP4) is starting up, I’m considering a Windows based submission and it would be in my best interest to document all of these in the same place. Even if this doesn’t end up…
At GreyNoise we work with network protocols. When a new vulnerability is published we are quick to jump into investigation mode and gather any and all resources we can find in order to write a tag and provide messaging to our customers and community. GreyNoise doesn’t have much common need to detailed firmware analysis. If it’s happening on the internet, we already see it. However, when we do need…
Hello, we’re going to be trying something a little bit different today. A colleague recommended this whisper.cpp thing, which is a port of open.ai’s whisper model to C/C++. So rather than type out this blog, the way that it’s going to be formed is I read a question that’s curious to me. And I’m going to talk about it, edit it up, and slap some screenshots and links…
The real motive of this series of blogs may take a few iterations to become clear to the reader, assuming of course I can actually pull it off. Let’s forget about the big picture for a moment and break things down into pieces I can wrap my head around. Mostly because I’ve already started, I’m already doing the things, and I don’t even know the right words to call them.
This blog is far overdue and unfortunately isn’t really a “Part 1”. The truth is, I’ve poked around with Wi-Fi Direct for several months now with mild success and many dead-ends that resulted in learning a lot. The purpose of this blog is to retrace my steps and document some resources before diving into some fun stuff for Part 2.
For this years Binary Golf Grand Prix I started off by learning to fuzz properly, use a debugger properly, and various tooling. The objective was originally to hit all of the bonus points: +1024 pts, if you submit a writeup about your process and details about the crash +1024 pts, if the program counter is all 3’s when the program crashes +2048 pts, if you hijack execution and print or…
The 3rd Annual Binary Golf Grand Prix (BGGP3) is to find the smallest file which will crash a specific program. https://tmpout.sh/bggp/3/ This blog is stream of consciousness for finding tooling and crashes. A formal writeup for the crash I want to submit will come at a later date.
Where we last left off, I had done an initial reverse engineering pass of Windows Update Delivery Optimization see: DOing Harm . I got familiar with the protocol, how peer discovery works, etc… but mainly only looked at the first handshake as that was most interesting to me at the time.
There’s this thing called Windows Delivery Optimization which allows “you to get Windows updates and Microsoft Store apps from sources in addition to Microsoft, like other PCs on your local network, or PCs on the internet that are downloading the same files.”
Where last I left off in Adventures in Bluetooth: Part 1 , I was originally attempting to flash custom firmware to a Fitbit Charge 2 smartwatch and ended up taking a quite large side-quest. Let’s see how far I can make it towards the objective this time!
Have you ever had an idea you couldn’t quite shake? Something that worms it’s way into your brain for one reason or another and just wont leave. Always on the backburner, thinking about it in the shower every day, in the bed as you go to sleep at night, zoning out in the living room, for as long as you can remember?
I was a Private Internet Access (PIA) customer for many, many years. Some recent changes spurred me to look for a new VPN provider and I ended up landing on ProtonVPN which I’ve been using for a few months now. And I noticed something… TCP (SYN, ACK) messages aren’t “real” when using ProtonVPN. This isn’t necessarily a bad thing or a good thing or even a thing…
Symbian OS, Android, Radio Frequencies, BTSNOOZ, BTSNOOP, and getting kicked in the teeth. Below follows a chronicling of deciding to explore Bluetooth by hacking the firmware for a Fitbit Smartwatch and realizing I was in way over my head and slowly trying to regain any hope of understanding.
So far I’ve managed to have just enough reverse engineering skills as is useful to me at the time, but recently I’ve taken an interest in getting a bit more in depth. My son was ill last week and home from daycare, so I took it upon myself to take the time to watch HackadayU: Reverse Engineering with Ghidra (~4 hours). I unfortunately didn’t have time to do any of the exercises,…
Recently I stumbled across a thread on Reddit r/AskNetsec Now, without looking at the post: What do you think the answers looked like? If you guessed a lot of people saying “You don’t” or “You can’t”, give yourself a pat on the back because you guessed correctly!
Last week a friend of mine asked me to debug/RE some phishing emails that had been sent to them. These phishing emails were visually very clever and looked identical to the real site! But as I looked at the javascript I frankly became embarassed for the developer. Sure, they’d run the code through an obfuscation engine and added some basic anti-debug tricks, but that’s nothing you…
It’s easy to set up an IDS or other infrastructure to drop packets that match rules. There are many tools for real-time inspection of connections that can handle higher level protocols like HTTP or TLS. This article aims to go a bit lower and address how to edit packets in flight. We’ll be looking at it through the lens of editing packets for a game using Golang.
This aims to explain and perform an example of how the Client-Puzzle-Protocol (CPP) may be implemented (almost) entirely in HTTP. Side Note: I’m _mattata on Twitter, you should give me a follow. I do stuff like this often. The Client Puzzle Protocol at a high level is a way to slow down automated bots crawling a site so that they approach the speed that humans would normally browse your…
Let’s build the smallest WASM / GBA ROM / 7Zip polyglot in 584 bytes for the Binary Golf Grand Prix 2021 . Rules: The host file must be a binary executable. This is any binary executable that stores either machine code (such as ELF, PE etc.) or bytecode (wasm, pyc, etc.) Overlap with at least one additional file of any type to create a polyglot. The host binary must return or print the…
In early 2017, @ericlaw wrote a blog post titled The Line of Death . The general premise is that there is some inherent user trust of any content that appears above the browser window and that considerations must be taken to ensure that browsers can not be manipulated to easily betray this trust.
Earlier this month, I came back around to seriously considering an attempt at bitsquatting . While the prior link goes into great depth on the topic, I will attempt to give a very high level overview here: If this sort of thing interests you: I tend to do stuff like this weekly. Give me a follow @_mattata
I’ve been doing weekly chaos engineering projects for a while now, so I decided to start a blog. A sort of dumping ground for all the things I do. If you’re interested in more projects like this, give me a follow on Twitter @_mattata . I’m always working on something fun.
I’m remy and on this blog I write about my research. Sometimes it’s something you may be interested in, sometimes it’ll read like chicken-scratch of the utterly deranged. These projects and research you will read about on this blog will range wildly and may seem pointlessly complicated.
This is a list of tools that may be useful or silly. Feel free to use them to your hearts content. ShrimpVG When I have remaining LLM usage at the end of the month I generate as many SVGs of shrimp as possible. These are used to train a ML model specifically designed to produce semantically valid unlimited shrimp.