Vulnerability Research on THALIUM

Don't judge an audiobook by its cover: taking over your Amazon account with a Kindle

Tue, 16 Dec 2025 08:00:00 +0000

Although Kindle e-readers are a prime target in modding and jailbreaking communities, there is little public work about vulnerability research in remote code execution scenarios.

In this post, we give technical details about a chain of vulnerabilities we identified that can be triggered by downloading a malicious Audible audiobook, allowing to take full control of the device and its registered Amazon account.

Achieving Remote Code Execution in Steam: a journey into the Remote Play protocol

Mon, 04 Dec 2023 08:00:00 +0000

Remote Play Together, developed by Valve, allows sharing local multi-player games with friends over the network through streaming. The associated protocol is elaborate enough to shelter a valuable attack surface that has scarcely been ventured into in the past.

This post covers the reverse engineering of the protocol and client/server implementations inside Steam, before presenting a dedicated fuzzer that unveiled a few critical vulnerabilities.

Rooting Xiaomi WiFi Routers

Mon, 25 Sep 2023 00:00:00 +0000

In this article, we discuss our research approach for investigating Xiaomi routers. We discovered multiple vulnerabilities allowing Remote Code Execution (RCE) on several models, through both LAN and WAN interfaces. This work led to the publication of four CVEs specifically targeting Xiaomi routers.

Leveraging Android Permissions: A Solver Approach

Tue, 20 Jun 2023 00:00:00 +0000

The Android permission management system has already suffered from several vulnerabilities in the past. Such weaknesses can grant dangerous permissions to a malevolent application, an example being CALL_LOG, which gives access to all incoming and outgoing calls.

This post dives into the Android permission system and how a solver was leveraged to find new vulnerabilities. With this approach, a privilege escalation was identified, which was fixed and assigned CVE-2023-20947 by Google.

kSMBd: a quick overview

Fri, 12 May 2023 12:00:00 +0000

In this blogpost, we introduce the analysis of one SMB implementation: kSMBd. It will be followed up by a talk at OffensiveCon 2023 named “Abusing Linux in-kernel SMB server to gain kernel remote code execution”.

The Fuzzing Guide to the Galaxy: An Attempt with Android System Services

Thu, 20 Apr 2023 00:00:00 +0000

Although the Android base is open source, many different constructors customize it with their own UIs and APIs. All these additions represent an extra attack surface that can change from one phone model to another. We tried to automatically fuzz the closed-source system services powering these modifications, discovering CVE-2022-39907 and CVE-2022-39908 along the way.

ARM TrustZone: pivoting to the secure world

Fri, 24 Mar 2023 13:37:00 +0000

Discovery of two vulnerabilities in secure world components
Exploitation to get code execution in a trusted driver, while not having a debugger for this obscure environment
Leverage of aarch32 T32 instruction set to find nice stack pivots
Turning an arbitrary write into an arbitrary code execution

Fuzzing RDPEGFX with "what the fuzz"

Fri, 14 Oct 2022 00:00:00 +0000

Microsoft’s Remote Desktop Protocol (RDP) client was fuzzed by various teams in the past few years, it thus seemed like a good target to try a recent snapshot fuzzer: what the fuzz (wtf) (of which we are only users). In this companion post to our Hexacon 2022 talk (slides, video) we’ll show how we took advantage of wtf flexibility in order to efficiently fuzz the RDPEGFX channel of Microsoft RDP client and uncover CVE-2022-30221.

Remote Deserialization Bug in Microsoft's RDP Client through Smart Card Extension (CVE-2021-38666)

Fri, 10 Dec 2021 06:00:01 +0100

This is the third installment in my three-part series of articles on fuzzing Microsoft’s RDP client, where I explain a bug I found by fuzzing the smart card extension.

Remote ASLR Leak in Microsoft's RDP Client through Printer Cache Registry (CVE-2021-38665)

Fri, 10 Dec 2021 06:00:00 +0100

This is the second installment in my three-part series of articles on fuzzing Microsoft’s RDP client. I will explain a bug I found by fuzzing the printer sub-protocol, and how I exploited it.

Fuzzing Microsoft's RDP Client using Virtual Channels: Overview & Methodology

Wed, 10 Nov 2021 12:00:00 +0000

This article begins my three-part series on fuzzing Microsoft’s RDP client. In this first installment, I set up a methodology for fuzzing Virtual Channels using WinAFL and share some of my findings.