"Seeing Through the Invisible" - research materials

Seeing Through the Invisible: Radiation Spikes Detected in Chernobyl During the Russian Invasion Show Possible Evidence of Fabrication

After many months of intense research, I'm finally releasing the paper that contains full technical details and collected evidence. I presented this research at BlackHat USA 2023 a few days ago.

Kim Zetter published on Wired a fascinating story about this research. She also wrote a piece on her Substack that brings additional details.

I really appreciate the interest this research has generated among different people, also outside the security world. Hopefully, some day we will eventually see an official investigation into these events, which is what everyone is asking for.

Paper

(PDF) https://drive.google.com/file/d/1Sxg7Do9DVs6xquv-j8gBUgN4RUZkMG2N/view?usp=sharing

SHA256 c143a35f7f6c43a80b21883dabe2e96edc1a724ac1b8c1061c1e318abd0dda38

(Preview is not possible due to the size of the file)

Reversing 'France Identité': the new French digital ID.

-------------- Update from 06/10/2023 : following my publication, I’ve been in contact with France Identité CISO and they could provide more information on the measures they have taken in the light of these findings: We would like to thank you for your in-depth technical research work on “France Identite” app that was launched in beta a year ago and for which you were rewarded. As you know, the app is now generally available on iOS and Android through their respective app stores. Your work, alongside French cybersecurity agency (ANSSI) research, made us update and modify deeply the E2EE Secure Channel used between the app and our backend. It is now mostly based on TLS1.3. Those modifications were released only a few weeks after you submitted your work through our private BugBounty program with YesWeHack. That released version also fixes the three other vulnerabilities you submitted. From the beginning of “France Identite” program, it was decided to implicate cybersecurity community,

Finding vulnerabilities in Swiss Post’s future e-voting system - Part 1

In September '21, I came across this story "Swiss Post Offers up to €230,000 for Critical Vulnerabilities in e-Voting System" while catching up with the security news. The headline certainly caught my attention as it looked like an outlier from the regular bug bounty programs or well-known exploit contests, not only for the announced rewards but mainly because of the target. So essentially Swiss Post , the national postal service of Switzerland, was opening to the general public a bug bounty program, using the YesWeHack platform, intended to uncover vulnerabilities in its future e-voting system. The first part of this blog post series will detail the approach used to analyze the Swiss Post e-voting system, as well as the first round of vulnerabilities that I reported during September/October '21. Index Introduction Approach Attack Surface Vulnerabilities 1. Insecure USB file handling during 'importOperation' 2. Insecure 'ReturnCodeGenerationI

SATCOM terminals under attack in Europe: a plausible analysis.

------ Update 03/12/2022 Reuters has published new information on this incident, which initially matches the proposed scenario. You can find the update at the bottom of this post. ------ February 24th: at the same time Russia initiated a full-scale attack on Ukraine, tens of thousands of KA-SAT SATCOM terminals suddenly stopped working in several european countries: Germany, Ukraine, Greece, Hungary, Poland...Germany's Enercon moved forward and acknowledged that approximately 5800 of its wind turbines, presumably those remotely operated via a SATCOM link in central Europe, had lost contact with their SCADA server . In the affected countries, a significant part of the customers of Eutelsat's domestic broadband service were also unable to access Internet. From the very beginning Eutelsat and its parent company Viasat, stated that the issue was being investigated as a cyberattack. Since then, details have been scarcely provided but few days ago I came across a really inter

Reversemode

Search This Blog