Quick evaluation on the current status of fingerprinting resistance between vanilla Mozilla Firefox and the Tor Browser (OWASP Saitama MTG #12, talk #1)
With our recent work, asynchronous super parallel grabber, we show how one should work with networks that have very high RTTs -- the dark web for example. We then look how well it applies for the mass-scraping of clear/dark web services, getting some impressive results -- all of the scraping works done from the dark web as a bonus. (Hacker's Party 2019 The Conference talk) #hackersparty
Describing various attack methods on Android/iOS apps. This time I decided to take a quick dive into actual analysis session on the a-bit-hardened InsecureBankV2 with Trueseeing (for OWASP Sendai Meetup #29.) Roughly the same content with the talk I gave in #kyusec18.
Describing various attack methods on Android/iOS apps. This time I decided to take a quick dive into actual analysis session on the a-bit-hardened InsecureBankV2 with Trueseeing (for #kyusec, Kyushu Security Conference 2018)
Trueseeing: Effective Dataflow Analysis over Dalvik OpcodesTakahiro Yoshimura
?
This document describes Trueseeing, a static dataflow analysis tool for analyzing Android Dalvik bytecode without using decompilers. Trueseeing marks up constants, invocations, and stored values in SQLite databases during disassembly. It then traces dataflow statically by matching getter/setter calls and instance field accesses to solve constants. This allows Trueseeing to analyze the dataflow and identify potential vulnerabilities in applications related to most of the OWASP top 10 mobile risks without suffering from the problems of dynamic analysis or dependency on decompilers.