Top all-time · #437
Quarkslab's blog
Company blog · blog.quarkslab.comsecuritysystems
Quarkslab's blog is the company blog at blog.quarkslab.com, writing about security and systems. Since 2013, 129 different Hacker News readers have linked it 167 times, most often “iMessage Privacy”. It is still writing: the last post was on 2026-10-26, and you can follow it by feed.
Quarkslab's blog
Most-linked posts?
- iMessage Privacy8 people · 10 mentions · first linked 2013-10-17
- Reverse-engineering Broadcom wireless chipsets6 people · 6 mentions · first linked 2019-04-17
- Overview of Intel SGX – Part 1, SGX Internals5 people · 5 mentions · first linked 2018-07-05
- Digging into Linux namespaces – part 14 people · 5 mentions · first linked 2021-11-17
- Playing around with the Fuchsia operating system4 people · 4 mentions · first linked 2020-06-09
- Attacking Titan M with Only One Byte4 people · 4 mentions · first linked 2022-08-12
- Easy::jit: Just-In-Time compilation for C++3 people · 3 mentions · first linked 2018-07-11
- /deobfuscation-recovering-an-ollvm-protected-program.html3 people · 3 mentions · first linked 2019-05-21
- Clang hardening cheat sheet, ten years later3 people · 3 mentions · first linked 2026-01-08
- DJI – The ART of obfuscation3 people · 3 mentions · first linked 2024-02-13
What Hacker News says?
I don't think so. What I can find on this topic with a quick search points to it being outright UB. https://stackoverflow.com/a/47622343/ https://stackoverflow.com/a/28895321/ https://blog.quarkslab.com/unaligned-accesses-in-cc-what-why...
Comment linking /unaligned-accesses-in-cc-what-why-and-solutions-to-do-it-properly.html
on “Do svidaniya, Igor, and thank you for Nginx”Submitted Playing around with the Fuchsia operating system as a story · 372 points
HN discussionThe problem is that if the user tears the card away from the reader in the middle of an update, that card can end up with corrupted data. This makes implementing the increment-only counters more complicated. For instance, the straightforward approach might hold 00 FF in two bytes. If you increment the counter by updating the low-order byte first, but the card gets torn away before you update the high-order byte, you…
Comment linking /rfid-monotonic-counter-anti-tearing-defeated.html
on “The tiny chip that powers Montreal subway tickets”Submitted DJI – The ART of obfuscation as a story · 233 points
HN discussionYour message, through several layers of indirection, relies on a security conference paper from 7 years ago[0] + the assumption that Apple haven't updated the protocol in 7 those years. [0] https://blog.quarkslab.com/imessage-privacy.html
Comment linking /imessage-privacy.html
on “SpaceX bans Zoom over privacy concerns”Submitted Attacking Titan M with Only One Byte as a story · 175 points
HN discussionWe spin our own build of Linux...We are using an ARM-based SoC from NXP. Okay, so that narrows it down to the i.MX family. We chose this to ensure that the device can only run signed, trusted code by implementing secure boot and signature verification of software updates. Maybe read this? https://blog.quarkslab.com/vulnerabilities-in-high-assurance...
Comment linking /vulnerabilities-in-high-assurance-boot-of-nxp-imx-microprocessors.html
on “Helm: Personal Email Server”Submitted A kernel stack use-after-free: Exploiting Nvidia's GPU Linux drivers as a story · 172 points
HN discussionThe author seems to have done no actual research beyond skimming the code. E.g., "none of these libraries have had security audits" When in fact there has been a review, and probably more internal audits that haven't been published: https://blog.quarkslab.com/security-audit-of-dalek-libraries...
Comment linking /security-audit-of-dalek-libraries.html
on “Facebook Libra Is Architecturally Unsound”Submitted PixieFail: Nine Vulnerabilities UEFI Implementations as a story · 152 points
HN discussionThe article also incorrectly claims that curve25519-dalek has never had security audits. It's had at least two by reputable cryptography auditing firms (Quarkslab and NCC), the former of which is public (the NCC audit was done at the request of my former employer and is private, but like the Quarkslab audit only found minor issues): https://blog.quarkslab.com/security-audit-of-dalek-libraries...
Comment linking /security-audit-of-dalek-libraries.html
on “Facebook Libra Is Architecturally Unsound”Submitted Digging into Linux namespaces – part 1 as a story · 141 points
HN discussionI'm gonna write about this in pt. 2. Basically you can use symbolic execution to recover the CFG[1] (using something like miasm), you can eliminate dead code, restore dynamic lib calls with an emulation, and whatever else. But the point is that it would take an incredible amount of work and co-operation between tools, and then you wouldn't have even begun understanding anything about the binary, which is a whole ano…
Comment linking /deobfuscation-recovering-an-ollvm-protected-program.html
on “Reverse Engineering Snapchat: Obfuscation Techniques”Submitted TCP backdoor 32764 – how we could patch the Internet (or part of it) as a story · 113 points
HN discussionI looked for a long time, but to no avail. Broadcom are notoriously tight-lipped when it comes to their intellectual property. Some have attempted to reverse-engineer... This was a good read: https://blog.quarkslab.com/reverse-engineering-broadcom-wire...
Comment linking /reverse-engineering-broadcom-wireless-chipsets.html
on “Writing a “bare metal” operating system for Raspberry Pi 4”Submitted Xen exploitation part 2: XSA-148, from guest to host as a story · 87 points
HN discussion- _e · 2017-10-23
Yes, Qubes is only as secure as Xen which, itself, has had some pretty big security flaws pop up [1]. At the end of the day one has to decide what kind of trade offs they are willing to make in order to balance simple UX and security. [1] https://blog.quarkslab.com/xen-exploitation-part-2-xsa-148-f...
Comment linking /xen-exploitation-part-2-xsa-148-from-guest-to-host.html
on “Why ProtonMail is more secure than Gmail” Submitted Xen exploitation part 3: XSA-182, Qubes escape as a story · 81 points
HN discussionAnd also: https://blog.quarkslab.com/dji-the-art-of-obfuscation.html Discussed at length here: https://news.ycombinator.com/item?id=39438842
Comment linking /dji-the-art-of-obfuscation.html
on “DJI ban passes the House and moves on to the Senate”Submitted Overview of Intel SGX – Part 1, SGX Internals as a story · 70 points
HN discussionNo, the messages are encrypted device-to-device with Apple providing a key directory service. Apple must be complicit to read messages without physical or backdoor access to the device. http://blog.quarkslab.com/imessage-privacy.html
Comment linking /imessage-privacy.html
on “Free, Worldwide, Encrypted Phone Calls for iPhone”Submitted Xen exploitation part 1: XSA-105, from nobody to root as a story · 61 points
HN discussionIndeed, all commonly-used hypervisors have had host escape vulnerabilities reported over the years, including Xen as used in Qubes - see e.g. http://blog.quarkslab.com/xen-exploitation-part-3-xsa-182-qu... Of relevance to Edge exploitation, Microsoft are currently working on a Qubes-like sandboxing model for Edge, based on Hyper-V (though it looks like it'll be aimed towards enterprise customers rather than consumer…
Comment linking /xen-exploitation-part-3-xsa-182-qubes-escape.html
on “Virtual machine escape fetches $100k at Pwn2Own hacking contest”Submitted Defeating eBPF Uprobe Monitoring as a story · 60 points
HN discussionYou can make the code more robust. For example, instead of a yes/no check, make the check come up with a symmetric crypto key to decrypt the next chunk of code (if it also passes a hash check). Glitches will end up generating garbage, and even if you successfully glitch the hash check, you're executing random garbage. Of course, the challenge there is that you've merely eliminated one glitching candidate. Stuxnet ha…
Comment linking /bradley-hash-and-decrypt-gauss-a-brief-history-of-armored-malware-and-malicious-crypto.html
on “The hacking of Starlink terminals has begun”Submitted Android data encryption in depth as a story · 59 points
HN discussionI'm playing Devil's Advocate here because I sympathize with your point, but isn't there a way you can squint and look at this weird that it's true of pretty much everything else? IBM makes tons of money off of Linux, for example. iXsystems profits off of FreeBSD. Facebook profits off of their wildly popular C++ libraries. I think we really need to divorce "profit" from "open source". OSS is great because we can cont…
Comment linking /playing-around-with-the-fuchsia-operating-system.html
on “Expanding Fuchsia's open source model”Submitted Secure Messaging Apps and Group Protocols, Part 2 as a story · 56 points
HN discussion> In Fuschia's case it will be like that but the exploitation either gives you access to that driver's capabilities, or simply that driver is giving out handles with permissions insufficiently removed from them Yes, and then you would have to own a component in some route that received the driver exposed capability. Either way, the tight sandoxing and compartmentalization of functionality make things difficult. Ther…
Comment linking /playing-around-with-the-fuchsia-operating-system.html
on “Expanding Fuchsia's open source model”Submitted Heap Overflow in OpenBSD's Slaacd via Router Advertisement as a story · 55 points
HN discussion
