InfoSec Briefing - August 15, 2026

🎧 Audio Briefing

Playback Speed:

Security news from the BlueTeamSec community for Saturday the 15th of August 2026.

Quarkslab have written up a relay attack against Android hardware attestation that exploits flaws in how backends verify device integrity. The technique uses Frida to relay attestation challenges from a compromised device to a clean one, which works because most backends treat attestation as a simple pass-fail rather than validating session binding. One for anyone relying on hardware attestation to make trust decisions.

Occupy the Web demonstrate a technique for extracting Windows password hashes using 7-Zip to bypass file locks and EDR. Administrator-level attackers can use the GUI's raw disk access to pull SAM and SYSTEM hives directly, which is fairly low-noise if LAPS isn't in place. Worth flagging for anyone doing forensics or testing detection coverage for living-off-the-land binaries.

Researchers have published work on a physical implant attack against Boeing 737 avionics, exploiting the legacy ARINC 429 data bus from the electronics bay. The protocol has no authentication or encryption, so signal manipulation is straightforward — the real challenge is that retrofitting security controls into legacy aviation architectures is borderline impossible. One for critical infrastructure teams and anyone interested in physical-layer attacks.

Christopher Domas demonstrates a DRAM scrambling technique that bypasses memory protections by manipulating controller configuration registers to remap physical addresses. The proof-of-concept targets AMD Family 16h processors, but the underlying design is shared across Intel, ARM, and RISC-V architectures, so the implications are fairly broad. We've seen similar low-level memory research in July with cold boot attack tooling — this one takes a different route but reaches comparable privileged memory regions.

Recorded Future have profiled malware crypting services being sold through underground forums and Telegram channels. These services bundle obfuscation, anti-VM checks, and evasion techniques to extend malware lifespan against detection — primarily targeting Windows environments. We covered similar evasion tradecraft earlier this month, so this adds useful commercial context to the techniques we've been tracking.

That's all for today. The articles are the work of their original authors — the analysis here was automated.

📰 Articles Covered

Bypassing Android Hardware Attestation from the Analyst's Chair - Quarkslab's blog - Quarkslab

The provided summary offers a comprehensive overview of the article’s findings regarding the bypass of Android hardware attestation. The technical assessment is accurate: the vulnerability is not in the hardware security module (TEE/StrongBox) itself, but in the **semantic gap** between the backend's verification logic and the cryptographic proof provided by the attestation chain.

By treating the attestation as a simple "verified" boolean rather than a complex object that binds identity to an execution context, developers leave the door open for this relay-style attack.

### Summary of Key Insights

| Category | Summary |
| :--- | :--- |
| **Core Issue** | Attestation authenticity is verified, but identity and session binding are ignored by many backends. |
| **Technique** | A relay attack (via Frida) that uses a "clean" device as an oracle to sign challenges for a "rooted" device. |
| **Target Impact** | Compromises integrity checks for banking, payment, and security-critical applications. |
| **Defensive Shift** | Move from verifying *that* a key was created to verifying *who* created it (using the `attestationApplicationId`). |

### Additional Defensive Considerations
Beyond the mitigations already noted, security architects should consider:

* **Risk-Based Signals:** Hardware attestation should be treated as one signal among many (e.g., behavioral analytics, device fingerprinting, and threat intelligence). Relying exclusively on hardware attestation creates a single point of failure.
* **Timeouts and Latency:** Because this attack involves relaying requests across devices, there is an inherent latency penalty. Implementing aggressive, low-threshold timeouts on attestation challenges can sometimes mitigate the feasibility of real-time relaying, though this is not a robust fix.
* **Avoid "Over-attestation":** Requesting attestation too frequently can degrade user experience and might tempt developers to implement weaker verification routines to mask performance issues. Use it strategically for critical operations (e.g., high-value transfers) rather than for every API request.

The article serves as a critical reminder that cryptographic proofs are only as secure as the business logic that interprets them. Even the most advanced hardware-backed security can be subverted if the backend trusts the "proof" without verifying the "context."
Digital Forensics: Attacking SAM and Extracting Hashes With 7z - Master OTW (Occupy the Web)

The article details a "living off the land" (LotL) technique that utilizes the legitimate compression utility **7-Zip (7z)** to bypass Endpoint Detection and Response (EDR) systems to illicitly copy sensitive Windows system files. By accessing raw disk data, an attacker can extract NTLM hashes, which may lead to full domain compromise 【1】.

### Summary of the Technique

| Category | Details |
| :--- | :--- |
| **What Happened** | Attackers use the 7-Zip GUI to access physical drives directly, bypassing OS file locks on critical system registry hives to copy them for offline analysis 【1】. |
| **Who is Affected** | Windows environments, particularly those where administrative privileges are compromised or where standard security monitoring (like VSS alerts) is not configured to detect raw disk access 【1】. |
| **Security Implications** | Extraction of the SAM and SYSTEM hives allows for offline cracking of local user hashes. If LAPS (Local Administrator Password Solution) is not implemented, an attacker can use a single recovered administrator password to move laterally across the domain 【1】. |

### Technical Details
* **Methodology:** The attacker must have Administrator privileges to execute 7-Zip. By typing `\\.\` into the 7-Zip file manager's path bar, they gain access to physical drives (e.g., `\\.\PhysicalDrive0`), allowing them to bypass the standard file locks that prevent copying active registry hives (stored in `Windows\System32\config`) <kcite>@https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/#36-37</kcite><kcite>@https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/#54-54</kcite>.
* **Tooling:** This technique specifically requires the 7-Zip **GUI**; the command-line interface (CLI) version cannot parse physical disks or nested partitions in this manner <kcite>@https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/#88-91</kcite>. Once the hives are exfiltrated, tools like `impacket-secretsdump` are used to extract the hashes <kcite>@https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/#74-74</kcite>.
* **Evasion:** Unlike techniques involving Volume Shadow Copy Service (VSS), which leave distinct, easily monitored log traces, using 7-Zip to access raw disk data is harder to detect because it utilizes a common, trusted administrative tool <kcite>@https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/#22-24</kcite><kcite>@https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/#26-28</kcite>.

### What Defenders Should Know
* **Implement LAPS:** The most effective defense against the impact of hash extraction is the implementation of the Local Administrator Password Solution (LAPS). This prevents the reuse of identical administrator passwords across machines, effectively containing the potential damage of a SAM file breach <kcite>@https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/#80-84</kcite><kcite>@https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/#107-108</kcite>.
* **Monitor for Anomalies:** Because this uses a legitimate tool, defenders should look for anomalous behavior, such as non-standard usage of 7-Zip by administrative accounts or attempts to access raw drive handles (e.g., `\\.\PhysicalDrive`).
Design and Implementation of a Physical Implant Attack on the Boeing 737 - Stefan Savage

The provided summary accurately captures the core technical findings and security implications of the research on Boeing 737 avionics vulnerabilities.

To further elaborate on the "what defenders should know" section, it is worth noting that the authors emphasize the difficulty of retrofitting security into these legacy architectures. Because the ARINC 429 protocol lacks native security features (such as encryption or message authentication), defensive efforts must balance the high safety-criticality of avionics systems with the need for modern threat mitigation.

Key takeaways for defenders regarding the feasibility of these mitigations include:

* **Architectural Limitations:** Retrofitting authentication (e.g., cryptographic signatures) on existing legacy systems is often infeasible due to the limited processing power of legacy Flight Management Computers and the strict requirements for deterministic timing in avionics.
* **Physical Security:** The research underscores that physical access control in the Electronic and Equipment (E&E) bay is a primary security boundary. Strengthening physical tamper-evidence, monitoring for unauthorized maintenance activity, and securing maintenance port access are critical immediate defensive postures.
* **System-Level Monitoring:** Since the attack relies on electrical manipulation, defenders should consider how modern health-monitoring systems (like those integrated into newer aircraft) might be adapted to perform deeper electrical signal characterization to identify anomalous bus behavior that deviates from expected electrical profiles.

If you are looking for specific guidance on how these findings might impact security auditing or physical security policies, or if you need more details on the electrical bus conflict analysis, I can examine specific sections of the document to provide that information.
skitter-creek-bath-salts: Unlocking _everything_ on the CPU with DRAM scrambling - Christopher Domas

The provided summary already covers the key elements of the research project, but for clarity and a detailed precis as requested, here is the breakdown of the `skitter-creek-bath-salts` research:

### What Happened
The project demonstrates a method for exploiting DRAM controller configuration registers to fundamentally alter how the CPU maps physical addresses to physical DRAM cells. By manipulating specific bit-fields (such as bank-swizzle modes) within the DRAM controller (MCT/DCT), an attacker can "spaghettify" the memory. This process effectively rewires the memory translation layer, causing a coherent physical address to map to different physical DRAM cells than intended. This allows an attacker to create memory aliases, where unauthorized memory regions can be accessed through alternative addresses.

### Who is Affected
While the research specifically targets and documents the behavior on **AMD Family 16h CPUs**, the author emphasizes that the underlying vulnerability relates to the fundamental architectural design of modern memory pipelines. Consequently, most modern systems—including those using **AMD, Intel, ARM, and RISC-V** across mobile, server, and embedded platforms—are theoretically susceptible, as they rely on similar memory translation mechanisms.

### Security Implications
This technique bypasses security primitives that rely on physical memory fences, as these protections typically operate at an architectural level *above* the memory controller. By rendering traditional address-based protections ineffective, it exposes highly privileged memory regions to unauthorized read/write access:
* **PSP/fTPM:** Platform Security Processor and Trusted Platform Module data.
* **SMM/SMRAM:** System Management Mode and its associated memory.
* **Architectural State:** CPU microcode and C6 DRAM state (containing architectural register states).

### Technical Details
* **Mechanism:** An attacker modifies DRAM controller configuration registers (e.g., using a `xor` instruction) to force a remapping of the memory translation table.
* **Mathematical Approach:** The DRAM controller's address transformation is modeled as a GF(2) linear map. The project uses the **z3 SMT solver** to analyze "target/alias" pairs—identifying where different physical addresses map to the same DRAM cells—to reconstruct the translation matrix and locate protected data.
* **Tooling:** The repository includes specialized utilities for mapping these aliases (`gather_aliases.py`, `unspaghettify.py`) and for performing unauthorized memory operations (`dram_read`, `dram_poke`, `dram_dump`).

### What Defenders Should Know
The primary takeaway for defenders is that memory-based isolation features like **SEV, SGX, TDX, and TrustZone** are not sufficient when the memory controller itself is compromised. Because these technologies guard physical addresses rather than the physical DRAM coordinates, they cannot protect against manipulations that occur at the DRAM controller level. Future security architectures must account for the possibility of direct DRAM remapping, as traditional address-based fences can be effectively bypassed by this class of attack.
Malware Crypting Services and the Threat Actors Who Sell Them - Recorded Future

The provided precis offers a comprehensive overview of the threat landscape surrounding modern malware crypting services, as detailed in the Recorded Future report. Below is a structured summary of the core findings:

### Overview: Malware Crypting Services
The report highlights that crypting services have transitioned from basic obfuscation tools into sophisticated "malware-enablement" platforms. These services are actively marketed by threat actors through underground forums, private messaging applications (Telegram, Tox), and social media, creating a highly competitive, reputation-based ecosystem.

### Key Aspects
| Category | Details |
| :--- | :--- |
| **Who is Affected** | Primarily Windows environments (targeting `.exe` and `.dll` files). These services are utilized by various criminal groups to deploy RATs and other malware while minimizing the risk of detection. |
| **Security Implications** | Crypting tools are specifically engineered to bypass static and dynamic analysis. While they do not grant full intrusion capabilities, they significantly increase the success rate of initial malware execution and extend the operational lifespan of malicious payloads. |
| **Technical Mechanisms** | These services employ complex frameworks featuring: **Obfuscation** (polymorphic code, junk injection), **Evasion** (anti-VM/sandbox, direct syscalls, AMSI/ETW patching), and **Persistence** (Registry keys, WMI, DLL hijacking). Providers often maintain these tools by offering "re-crypting" services if a specific sample is flagged. |
| **Defensive Strategies** | Defenders must shift from static signature-based detection to **behavioral analysis**. Monitoring for indicators such as memory-resident PE execution, process injection, and security product tampering is more effective than chasing volatile crypter artifacts. |

### Strategic Advice for Defenders
* **Prioritize Behavioral Monitoring:** Because crypted payloads are designed to evade signature-based detection, monitoring the malicious *behavior* of loaders (e.g., child-process spawning, suspicious memory activity) is essential.
* **Environment Hardening:** Organizations should restrict execution from directories often used by attackers (such as user-writable or temporary folders) and ensure tamper protection is enabled for all endpoint security software.
* **Handle High-Risk Files Carefully:** Standardize the treatment of suspicious delivery vectors—such as `.iso` files, `.lnk` files, and password-protected archives—as high-risk by default.
* **Maintain Operational Security:** To prevent threat actors from becoming aware of detection, avoid uploading potentially crypted samples to public multi-scanner services. Instead, rely on internal sandboxes and private, secure analysis environments.