ITSEC Newsletter 2024-11-14

Today’s code will be the most challenging yet in the series, so fair warning. There’s a lot going on but I think you’ll do just fine.

All the binaries from this year’s challenge are now posted on the Flare-On website. Here are the solutions written by each challenge author.

In early 2023, we published a blog entry on campaigns targeting governments and the tech industry from Earth Estries (aka Salt Typhoon), a high-level threat actor that has been active since at least 2020. In this report, we analyze two distinct attack chains by the group that demonstrates the varied tactics, techniques, and tools that they use to compromise targeted systems.

I will focus on the voltage glitching part, as it is one of the most approachable techniques with limited hardware. The basic concept is that we “deprive” the chip of power, making it "unstable".