This year I again participated in the Insomni'hack conference held in Geneva, Switzerland. The conference started off with workshops, including mine on Android malware reversing - provided at cost. The workshop's virtual environment for reversing can be downloaded here from github. [Read More]
by RSS Axelle Apvrille  |  Apr 02, 2017  |  Filed in: Industry Trends & News
I'm back from Hacktivity 2015, a big hacking and industrial event in Budapest (Hungary), where I was presenting an update of my research on the Fitbit Flex tracker (slides). It seems several people in the audience were wearing a sports wristband ;) Fitness Trackers at my talk at Hacktivity For your information, I will be presenting on the same topic at next week, but let's say 70% of the presentation will be *different* as I am not focusing on the same aspects. Tamas Szakaly - Shall we play a game? Tamas gave an interesting... [Read More]
by RSS Axelle Apvrille  |  Oct 14, 2015  |  Filed in: Security Research
It was my first time at Hack in Paris, with a single track of talks, but definetely good ones. I'll be highlighting below what struck me the most. You don't hear me but your phones voice interface does (José Lopes Esteves, Chaouki Kasmi) It is possible to inject signal to voice control systems on a phone. That signal, although it won't sound like a voice to human beings - will be interpreted by the voice control system and can be used to remotely command the phone. The authors showed a video where the injected signal... [Read More]
by RSS Axelle Apvrille  |  Jun 24, 2015  |  Filed in: Security Research
This year again, I was happy to participate to Insomni'hack, in Geneva. As in all other editions, questions at the end of my Symbian / Android talks had invariably been 'are there malware on iOS?', I decided it was time I specifically addressed the question. I think I made my point that malware for iOS do exist, even on non jailbroken phones, but they are rare. And the latest PawnStorm iOS malware we reversed (live during the talk ;) has something strange about it: partially works on stock iPhone but looks like it was implemented... [Read More]
by RSS Axelle Apvrille  |  Mar 23, 2015  |  Filed in: Security Research
If you have any interest in Android packers, or how to reverse mobile malware that use such packers, please don't miss Ruchna's upcoming talk at Hacktivity . Android Packers: Separating from the Pack - 11. October 2014. 11:20 - 12:05 If you feel like reading on this topic before, I suggest: our joint paper in Virus Bulletin : "Obfuscation in Android malware and how to fight back" (July 2014). With tools and tips to reverse obfuscated samples. Rowland Yu, "Android Packers: Facing the Challenges, Building the Solutions" at Virus Bulletin Conference,... [Read More]
by RSS Axelle Apvrille  |  Oct 09, 2014  |  Filed in: Security Research
Razvan Benchea and Dragos Gavrilut in the middle of their presentation I am very happy to have been at VB 2013 once again. The talks were quite interesting. If you were not able to attend, here's the write-up of some presentations I went to. This post is the first in a three part series. Click here for Part 2 and here for Part 3 Andrew Lee - Ethics and the AV industry in the age of WikiLeaks (Keynote) Andrew showed that surveillance programs were not new (the FISA Act dates back to 1978) and that they exist in numerous countries (not only the... [Read More]
by RSS Axelle Apvrille  |  Oct 10, 2013  |  Filed in: Security Research
Insomni'hack 2013 took place last week at Geneva and I had the opportunity to attend. Insomni'hack DAY 1 consisted of one day workshops on subjects ranging from "Linux exploitation" to "How to make sure your Pentest Report is never empty". I had the chance to attend a workshop on "Practical ARM exploitation" given by black Steve (@s7ephen) and white Steve (Stephen Lawler). We initially had trouble getting the Gumstix we were supposed to work on running due to the difference in voltage levels between the US and Europe (it's about time the world... [Read More]
by RSS Ruchna Nigam  |  Mar 25, 2013  |  Filed in: Security Research
I enjoyed the Hashdays conference very much. For those who missed my talk, read this blog post. And now, more about other talks. Christien Rioux (@dildog) opened the conference with an interesting and unusual keynote about how hackers evolve (or not) through years. He illustrated his talk with his own experience, a lot of hacking at first, then improving his hacks and finally managing his own teams and company. He went through a few golden rules to be a good manager (such as how to earn respect from one's team). I guess everybody has different... [Read More]
by RSS Axelle Apvrille  |  Nov 07, 2012  |  Filed in: Security Research
I am back from Hashdays. For the (very) unfortunate ones ;) who missed my talk, you can download my slides from here, and also view my demo there. Click to download the slides Hashdays video of my demo Shortly, I think the key topics to my talk were: an Androguard-based script to disassemble DEX files at any offset dexrehash: a tool to re-checksum and re-hash hacked DEX files hooking system properties to evade Android emulator detection, and why you can't hook all properties at a single spot Next time, don't skip my talk :D --... [Read More]
by RSS Axelle Apvrille  |  Nov 05, 2012  |  Filed in: Security Research
As I was following the tweets of IEEE S&P, one of the top academic conferences on security, I saw they had created a special application for the people attending the conference, with the agenda, paper abstracts and a few news. Figure 1. IEEE Security & Privacy Android application Curious, I downloaded the application for Android ( and ran it through my automated analysis scripts. When the following warnings popped up, I initially wondered if I hadn't downloaded a Trojan: Tue May 21 07:19:02 2013... [Read More]
by RSS Axelle Apvrille  |  Jul 30, 2012  |  Filed in: Security Research