2 ms·
It seems to be a dump of a git "wiki" that is shared between a bunch of devs within the agency. The content mostly centers around typical wiki style documents
by socmag 10y ago
It seems to be a dump of a git "wiki" that is shared between a bunch of devs within the agency.
The content mostly centers around typical wiki style documents where developers are chatting between each other and leaving useful snippets of code and discussing different attack vectors and approaches. It's organized into folders relating to different technologies, platforms and tools.
There isn't a "use me to gain root on an iPhone" program anywhere that I can see, although there are some hints that those things actually exist in the main git repo.
In general there seems to be a lot of information on performing pre-cursor work to get devices into a state where they can be compromised via firmware rewrites etc.
There is quite a lot of interesting information that I'm sure will be of use in hardening systems in years to come, so it isn't all bad news.
It reads as kind of a "Book of tips and tricks" mainly as well as the results of various attack attempts.
Linux seems very low on the list in priorities for attack development. I did see something about opening a side channel inside an SSH session, but it doesn't seem to be a focus.
"X capability that injects a pthread into an OpenSSH client process creating a surreptitious sub-channel to the remote computer."
Certainly looks like they are having a lot of fun attacking Windows boxes and Apple phones mainly, plus Android devices and a smattering of common routers and other gear.
They also seem to have a great sense of humor. Some of the comments are hilarious, as are their project code-names. I laughed at the code sample for a Windows keyboard logger using DirectInput. Does that thing really work? :-)