Mathieu Kerjouan

Posted on Aug 31

WeeklyReview#202635

#weekly #review #link #followup

Finally, someone said it loudly on a podcast, the open-source communities are full of f* goblin with a shitty mindset destroying the hobbyist fun and blocking the real innovation from hackers/engineers by forcing other people to be agree with their political point of view. It's refreshing to watch a short video on this topic, because it was one of the most important reason I did not participate anymore on Open-source projects, especially BSD systems. This guy is doing a great summary: we don't care of your sex, gender, political beliefs or your age. We are hobbyist, hackers, engineers. We are fixing problems by giving solutions. We are NOT involved in politic, and if it's the case, this is not the place to talk about it. In France, during family meeting, we are trying to avoid few topics: religion, politic and most of the controversial news. Why? By To avoid conflict(s) during a time where everyone can be there. It's rare. It's precious. It's called respect. Be respectable, and everything will be fine.

About my posts on this "public note pad". The first articles were focused on learning Dart and Flutter, they were kinda short, and based on documentation, tutorials, tests and examples. The next publications are way more complex, and will involve more knowledge and tests on my side. In fact, one of my project (and future product) was already delayed of one month due to the many - unexpected - things I did during July and August. Anyway, not a promise, just a quick note to explain my current situation.

About dev.to, a quick feedback. I'm now using it for all my technical publication and to be honest, it's not the best place to put your information. In 3 or 4 months, the service was down many time. When editing a long article, sometimes the modifications are not saved on the server side (happened to me many time, and it's... ANNOYING). How a service like that can host so many authors? Where is the reliability? I wanted to avoid doing my own servers, but I think that's what we got for a free service.

Coding

📝 Bringing Primary Constructors to Dart: after the 3.13 version, it will be now possible to use the new keyboard to define named/unnamed constructor as well as factory. Example:

class A {
  new();
  new create();
}

class B {
  factory () { }
  factory create() { }
}

📝 Introducing the Desktop Windowing API for Flutter: Learn about the design behind the new Desktop Windowing API and write your first multi-window Flutter application.

System

📝 net-tools to iproute cheat sheet: a nice way to remember the commands between ip and the legacy net-tools packages (including ifconfig) on Linux. The same should be done between Linux, BSDs and MacOS.

🏗️ MemProcFS: MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system.

🏗️ Beyla project: eBPF-based autoinstrumentation of web applications and network metrics. An interesting tool to collect metrics on web server using eBPF (so, linux-only), the documentation looks good as well. I was looking for something similar few years ago, to collect network metrics.

🏗️ The Goodmans Kernel project: Run unsigned kernel payloads in a signed kernel driver via wasm3. No JIT/W^x (HVCI/etc., compliant)

🏗️ kubectl x project: A kubectl plugin that runs commands against every context in your kubeconfig file in parallel.

🏗️ ipatool project: Command-line tool that allows searching and downloading app packages (known as ipa files) from the iOS App Store

📝 Reverse Engineering: How we bypassed CoreML and talked directly to the hardware: a series of article about Apple M1 CPU ANE graph execution engine, and how to bypass CoreML interface.

📝 How to Build Smaller Container Images: Docker Multi-Stage Builds: A tutorial to build small sized containers with docker multi stage, using node.js as example.

Network

🌐 Who Am I: another "what's my ip" service, displaying more information than usual. I like it.

Security

📝 Decrypting and analyzing HTTPS traffic without MITM: a way to decrypt HTTPS traffic using PCAP and BURP SUITE.

📝 How Easy Is It to Scan a Contactless Payment and Access Card?: a post about NFC scanning and cloning.

📝 Smart Glasses Can Record You – And Detecting Them Isn’t So Simple: those glasses can potentially be detected using bluetooth but it depends on the manufacturers (and the spec). When the glasses are connected, they are not broadcasting data anymore.

📝 Reversing TP-Link EX220 from A1: a quick article about reversing a firewall/router.

🏗️ PE-bear project: a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files. see also the author's blog.

📝 The Linux Kernel Is Approaching 2,000 CVEs Per Release: I don't really think the Linux kernel will be able to stay in the game with its current structure. The only good answer would have been to use a micro-kernel (Linux is a Minix-clone), it's simpler, easier to maintain and in fine, more isolated. What's scary here is the amount of unpatched old-Linux still running everywhere. I don't know what will happen in the future, but the old mantra "Linux is safer than Windows" is going to break.

📝 Vulnerability Research on Bitdefender's Antivirus Engine: the first part of a series of article about antivirus analysis and fuzzing. The last sections of this publication are talking about fuzzing BitDefender with honggfuzz. I'm waiting for the next part!

Security/Cryptography

📝 Time as a Key: Breaking Rhysida Ransomware with the Attacker’s Own Ciphertext: the story behind the Rhysida Ransomware. A X/twitter thread and a simplified version of the story by the author can be read. In short, the IV (initialization vector) and the keys are generated using the rand function (derived from srand function). Those functions are both linked to the time function, and when executed many times or in parallel, this function return the same value. If one knows the seed (the parameter passed to the srand function), then one is able to decipher encrypted files. The analysis from the paper, the blog post and the x/twitter thread is amazing. A must read.

🏗️ Crypto 101: the book: The source code of the Crypto101 book. Nothing to add, just a good reference.

📝 Blood MERIDIAN: LLM cryptanalysis of a blockcipher that is isn't a blockcipher: an interesting LLM session using GPT-5.6 Sol to break a "blockcipher" (MERIDIAN). No test vectors have been shared on the specification, and the LLM found an issue.

📝 Compromising Signal's Contact Discovery Enclave: V12 found two critical object-lifetime vulnerabilities that allow the untrusted host server to break the enclave boundary.

📝 Privacy Pools: Anatomy of a 53-bit Entropy Collapse: a type coercion bug reducing the entropy of master keys from 256 bits to 53 bits. interesting post-mortem and analysis.

📝 Into the Dark - DarkSword Kernel Exploit Writeup: a post about iOS DarkSword vulnerability (CVE-2025-43520). It uses an exploitable race condition in the virtual file system to allocate kernel memory. Really interesting, but a bit complex to follow on my side, I don't really know how iOS is working under the hood.

📑 Regev’s Attack on Hyperelliptic Cryptosystems: Hyperelliptic curves (yet another thing I don't know) are an alternative to ECC. I simply read the introduction, to know what a "hyperelliptic curve" was. It looks complex, like the elliptic curves.

Security/BlueTeam

🏗️ Sliver project: "an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys."

Security/RedTeam

📑 Tips and Scripts for Reconnaissance and Scanning: an old publication listing methods to scan hosts.

🌐 RatCTF: yet another capture the flag challenges website.

▶️ Hacking hardware security key into an air-gap-jumping worm: the hidden features of a YubiKey: using yubikeys as attack vector by using logical usage modification to propagate worms (or take control of devices). The full talk can be seen on Youtube.

📝 Web App Hacking: Six Tools for Bug Hunters: a list of tools to find bugs on web application, gospider (webcrawling/spider), SecretFinder (discover sensitive information), jsluice (javascript source code secret extractor), xnLinkFinder (discovering tool), Dalfox (XSS scanner), Caido (web audit tool).

🏗️ DFIR-LAB project: a compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting.

🏗️ InfraGuard project: Red team infrastructure tracker and C2 redirector -- a modern alternative to RedWarden. InfraGuard sits between the internet and your C2 teamserver, validating every inbound request against your malleable C2 profile and blocking anything that doesn't conform. Scanners, bots, and blue team probes get redirected to a decoy site while legitimate beacon traffic passes through to your teamserver.

🌐 KitPloit: Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

📝 Open Source Intelligence (OSINT): Using Osiris for Global Intelligence: an article on the open-source Osiris, a tool, used to collect global information (e.g. cctv, aircraft, critical infrastructure, dangerous zone...). Kinda interesting and can run locally.

Update/Upgrade

🔄 Unifi Security Advisory Bulletin 067: 22 critical security issues to patch, with CVSS score >8. Kudos for the one with a score of 10.

🔄 Announcing Dart 3.13, Bringing conciseness and simplicity to Dart codebases, tooling, and platforms.: Primary constructors, improvement of the dart formatter and much more.

🔄 Elixir v1.19.6 security release: this release patch the CVE-2026-75758, allowing an attacker to crash a node by memory exhaustion with the help of an unsanatized char list used in IO.inspect/1 function. This function is used by the Logger module (see translator.ex) to print Elixir/Erlang data-structure. It would be fun to try exploiting it in some way.

🔄 QSB-118: Dom0 arbitrary code execution in qvm-copy-to-vm error reporting: in short, a wrongly sanitized string from a compromised qube (domU) can be used to execute arbitrary code in dom0. The sanitizer is not removing the backtick character from the filename, leading to arbitrary code execution via the system() function. A dirty bug impacting all QubeOS version.

Embedded

📝 Baochip-1x: A Mostly-Open, 22nm SoC for High Assurance Applications: a security chip made by Bunnie, project created via the betrusted initiative.

📝 Redesigning my microkernel from the ground up: an experimental microkernel inspired by Sel4, called ares, which is a full rewrite of helios. This article also talks a bit about bunnix, an Unix-like OS implemented by the same author.

▶️ Extracting Firmware from Embedded Devices (SPI NOR Flash): a really great video about extracting firmware, using NOR Flash via SPI protocol bus with the help of a logical analyzer (saleae) and hydrabus. In short, this is a man in the middle attack by reading the data directly from the microcontroller to the memory.

📟 $299 Arduino Ventuno Q SBC combines Qualcomm Dragonwing IQ8 SoC and STM32H5 MCU: Quick introduction to the Arduino Ventuno Q, Octa-core Kryo Gen 6, Adreno A623, 16GB LPDDR5, 64GB eMMC flash, M.2 socket for NVMe Gen4 SSD, 2.5GbE RJ45 port.

📟 AT LoRa USB Dongle: USB device that lets you send and receive LoRa wireless data using simple AT commands. No coding needed. Good for testing and development.

🌐 Free RF Tools for Engineers, Radio Amateurs & Students: A long list of tools to help with calculations, design and so on for RF engineers and radio amateurs.

📝 Building A Headless Game Boy Emulator: great project with an ESP32! the ESP32 here is used as server, offering an access to the emulator on Wifi. Other people can also play as well.

Misc

📝 The end of IPFS at Shipyard: P2P distributed storage is hard to maintain, I know this by experience with one of my last mission. The infrastructure cost is huge, even more if no one knows how to deploy really low-cost distributed systems around the world. IPFS is impacted as well by those issues, and when one partner is leaving, it will be hard to continue. I hope IPFS will not shutdown because of that, it's a great technology and it would be really sad to see it disappears.

📟 noah5b motherboard: I wanted to upgrade my firewall (an old PC ENGINE APU2) and just learnt PC Engine will not produce them anymore. Instead, Broachlink will offer similar motherboards called Noah. This is looking great, and are not so expensive ¹
² ³ ⁴ (between €300 and €400). Linux drivers are available on Github.

📝 Crypto ATM operator Bitcoin Depot files for bankruptcy: the world largest cryptocurrency ATM is filed with bankruptcy due to fraud allegations (hundred millions of dollars annually). $389 millions dollars lost due to scams, involving Bitcoin Depot machines. In 2025, $1.5 million scams transactions had passed through hundred of ATMs.

🏗️ GTA 6 Leaks & Cyberleek Investigation Report: a repository containing the complete investigation of the GTA 6 leaks.

📟 Openterface KeyMod, Pocket USB multi-tool bridge for tech, professionals and gaming: interesting concept to transform a smartphone into many different input device.

📝 Two Alleged ‘TeamPCP’ Hackers Arrested in Australia: arrested due to multiple information leaks from SpyCloud, RaidForums, Nulled, and a gmail address used on many other website. Being anonymous on the web is nearly impossible, even for the scammers and criminals. A Risky Business podcast is talking about this story.

🌐 privatekeys.info: a "game" to crack bitcoin and ethereum private key. Pick a number between 1 and pow(2, 256) and voilà, you are now rich and famous!

🏗️ trustmebro project: Bypass llm guardrails by confusing it with fabricated tool output.

Legend:

symbol	usage	example
▶️	video	youtube
🏗️	project	git repository
📝	informal publication	blog post
🎥	live	twitch
🏛️	definition	wikipedia
🌐	regular website	-
📑	academic or scientific publication	arxiv
🔄	software new release, update or ugprade	-
📟	device	embedded hardware

Cover Image by Didier VEILLON on Unsplash

DEV Community