Will they melt? Testing the resistance of flash memory chips

Firmware: the holy grail of most Internet of Things (IoT) security assessments! Sometimes, getting access to a device's firmware can be as easy as visiting the vendor's website. Other times, the only option is to dump it directly from the hardware, and this is where things get interesting. Some procedures used for dumping can expose … Continue reading Will they melt? Testing the resistance of flash memory chips

Malicious SYLK Files with MS Excel 4.0 Macros

Since about a week, we are seeing an increase of SYLK files submitted to VirusTotal. A SYLK file (SYmbolic LinK) is a pure text file format used to store Excel spreadsheets with extension .slk. Although SYLK files can't contain VBA macros, they can still contain executable code, for example DDE commands or MS Excel 4.0 … Continue reading Malicious SYLK Files with MS Excel 4.0 Macros

Optimizing Elasticsearch – Part 2: Index Lifecycle Management

In the previous blog post "Optimize Elasticsearch for log collection - Part 1: reduce the number of shards", we have seen one solution to recover a cluster suffering from the "too many shards syndrome" by merging indices that were too small. In this article, we'll see how we can rely on latest Elasticsearch feature to … Continue reading Optimizing Elasticsearch – Part 2: Index Lifecycle Management

Solving a CTF challenge: Exploiting a Buffer Overflow (video)

Capture The Flag (CTF) competitions are an entertaining way to practice and/or improve your skills. NVISO staff regularly participates in CTF competitions, in particular when the competition focuses on IT security. We produced a video with step-by-step analysis of a CTF executable containing a buffer overflow. This executable is running on a server, and by … Continue reading Solving a CTF challenge: Exploiting a Buffer Overflow (video)

Detecting and Analyzing Microsoft Office Online Video

A while ago, a new technique was developed to execute arbitrary code via a Word document: an online video is embedded and the HTML code for the embedded video is modified with JavaScript that launches a Windows executable. This technique does not rely on VBA macros and requires the use of the .docx format (for … Continue reading Detecting and Analyzing Microsoft Office Online Video