Welcome to BFS Labs
Here you will be presented with the latest and most exciting security research activities undertaken by the Blue Frost Security research team. You will find whitepapers, tools, advisories and blog posts.
Advisories
-
Microsoft Hyper-V: Multiple Vulnerabilities in vmswitch.sys
Multiple bugs are present in WPP code when handling set OID requests, one of them allowing to dereference (read access) an attacker controlled pointer, and the rest causing out of bounds read accesses
-
Microsoft Hyper-V Type Confusion leading to Arbitrary Memory Dereference
A bug present in the Hyper-V (hvix64) hash-table implementation allows to dereference memory near (or belonging to) the hash-table struct object.
-
Microsoft Hyper-V NULL Pointer Dereference Denial of Service
A bug present in Hyper-V's (hvix64) emulation handler for VMLAUNCH/VMRESUME allows a malicious L2 hypervisor to trigger a NULL pointer dereference in the L1 hypervisor.
-
Microsoft Hyper-V Stack Overflow Denial of Service
A bug present in the hvix64 module (hypervisor) causes infinite recursion, leading to a stack overflow.
Publications
-
A bug collision tale
The inside story of our CVE-2019-2025 exploit
-
TEE Exploitation
Exploiting Trusted Apps on Samsung’s TEE
-
Abusing GDI for Ring0 Exploit Primitives: Evolution
Windows 10 kernel exploitation techniques based on the latest Windows 10 RS3 insider preview
-
Look Mom! I Don’t Use Shellcode
A Browser Exploitation Case Study for Internet Explorer 11
-
Exploiting CVE-2014-4113 on Windows 8.1
Analysis of the Windows kernel vulnerability CVE-2014-4113, demonstrating how it can successfully be exploited on Windows 8.1.
Blog
-
BFS Ekoparty 2022 Exploitation Challenges
Show us your skills, to get a free invite to the BFS VIP dinner/party as well as an opportunity to join our team!
-
Windows Segment Heap: Attacking the VS Allocator
Abusing the Windows segment heap metadata to turn a heap overflow into an overlapping chunk allocation
-
BFS Hiring Challenge
Show us your skills, and get an opportunity to join BFS!
-
Meltdown Reloaded: Breaking Windows KASLR by Leaking KVA Shadow Mappings
This blogpost explains how Meltdown can still be used to leak some specific kernel data and break Windows KASLR in the latest Windows versions, including "Windows 10" 20H1, despite the KVA Shadow mechanism introduced to mitigate Meltdown.
-
Exploiting CVE-2020-0041 - Part 2: Escalating to root
Exploiting the kernel with CVE-2020-0041 to achieve root privileges
RT @tykawaii98: Smashing another Windows exploitation challenge from BFS. Thank @bluefrostsec for a cool challenge. Love it! Here i… https://t.co/UajbNfpwq5
2 weeks, 4 days ago
RT @Rewzilla: @tykawaii98 @bluefrostsec Nice work, and great write-up! :) I solved this one as well. Was waiting to publish to a… https://t.co/5o2yEvAZ09
2 weeks, 4 days ago
RT @bugwhale: I didn't know there was such a challenge. This challenge is cool, clear and concise. #eko2022 @bluefrostsec https://t.co/hjS7wbt5SM
2 weeks, 4 days ago
RT @LukasHermannBFS: Hey, I am having a great time at POC2022 :) Ping me if you want to hear more about our full time VR positions… https://t.co/YIBq9U66yI
3 weeks, 4 days ago
RT @ergot86: Thanks @bluefrostsec for throwing such awesome party. Had to leave early but so happy to see again many old friends… https://t.co/AquaCoN0po
1 month ago