CPR Publications

Here I will keep an up-to-date list of my publications, as they were published on the research blog of Check Point Research (CPR). The list is ordered by research topics, in a chronological order, meaning that all RDP blog post parts are listed one after the other, instead of by their chronological order.

As some of the research projects were also presented in conferences (Black Hat USA, DEFCON, CCC, etc.), here is the link to the GitHub repo which contains all of the conference slides + demo videos: conference presentations.

Publications list:

• Check Point Responds to AMD Flaws (backup)
• MMap Vulnerabilities – Linux Kernel (backup)
• What The FAX?! (backup) – Conference Talk
• Reverse RDP Attack – Part I: Code Execution on RDP Clients (backup) – Conference Talk
• Reverse RDP Attack – Part II: The Hyper-V Connection (backup) – Conference Talk
• Reverse RDP Attack – Part III: The Path Not Taken (backup)
• Karta – Matching Open Sources in Binaries (backup) – Conference Talk
• Thumbs Up: Using Machine Learning to Improve IDA’s Analysis (backup)
• The NSO WhatsApp Vulnerability – This is How It Happened (backup)
• Say Cheese: Ransomware-ing a DSLR Camera (backup) – Conference Talk
• OptOut – Compiler Undefined Behavior Optimizations (backup)
• Safe-Linking – Eliminating a 20 year-old malloc() exploit primitive (backup)
• Would you like some RCE with your Guacamole? (backup)
• Don’t be silly – It’s only a lightbulb (backup) – Conference Talk
• Graphology of an Exploit – Hunting for exploits by looking for the author’s fingerprints (backup) – Conference Talk
• Graphology of an Exploit – The Story of PlayBit (backup)
• Game On – Finding vulnerabilities in Valve’s “Steam Sockets” (backup)

Blog Updates

On February 2018 I started working on the vulnerability research team at Check Point. This means that my blog posts (such as Linux Kernel MMap Vulnerabilities, and Check Point Responds to AMD Flaws) are now published in our group’s research blog. Although my personal research blog won’t be updated in the near future, I can guaranty that we have some very interesting research results that are waiting to be published, and so subscribing to the group’s blog is highly recommended.

Faxploit Update:

As I promised, we had a very interesting research underway, and it is now published. We were able to remotely exploit all-in-one printers using only a phone line! By sending a malicious FAX we took over a target printer and managed to spread through the network it is connected to. Here is the link to our research.

For more updates, check out the group’s blog.

Thanks for visiting,  @Eyalitkin