Blog
Research, vulnerability disclosures, and CTF write-ups from the lab.
-
sod: SSH Logins with Touch ID and the Secure Enclave
Our Secure-Enclave-backed SSH agent for macOS: the private key never leaves the enclave, and every login asks for a fingerprint.
-
Trial by Fire (2): Escaping a Sandbox to Light the Campfire Blue
Part two of the BlueHat 2026 Trial by Fire challenge: a custom Linux sandbox, and the chain of namespace quirks and monitor flaws that escapes it.
-
Trial by Fire (1): Taking Over the Campfire
From Go template injection to remote code execution — the full exploit chain behind BlueHat 2026’s Trial by Fire challenge.
-
Hack the Moon: A Multi-Agent Prompt Injection Challenge
A harmless-looking multi-agent AI system manipulated through indirect prompt injection — the challenge we built for BlueHat 2026, and what it teaches about agent-to-agent communication.
-
CVE-2025-8556 — Cryptographic Issues in Cloudflare’s CIRCL FourQ Implementation
The vulnerabilities we found in CIRCL’s FourQ curve: invalid-point attacks, Edwards-curve edge cases, and the disclosure that fixed them.
-
Hacking eBPF & LLVM for Fun and Profit
Extending LLVM to get past practical eBPF limits: custom compiler passes, eBPF internals, and the groundwork for automatically splitting oversized programs with tail calls.
-
Unraveling the Bluetooth Enigma: Extracting the Flag from BSides TLV 2022 CTF ‘Handsfree’
A forensics challenge built around recovering usable audio from an over-the-air Bluetooth capture — the complete write-up, from protocol analysis to the flag.
-
Decoding the 90s: A Journey into Reverse Engineering and Cryptography in Early Software Development
Commissioned to recover a cache of locked QText documents from the mid-90s, we reverse engineered a DOS-era word processor and its encryption scheme.