Cafe Security

Google I/O 2008 - Anatomy and Physiology of an Android https://www.youtube.com/watch?v=G-36noTCaiA&t=13s #android #internals @cafe_security

Bypass Azure Admin Approval Mode for User Consent Workflow When Enumerating https://pgj11.com/posts/Bypass-Azure-Admin-Approval-Mode-Enumeration/ @cafe_security

A 0-click exploit chain for the Pixel 9 https://projectzero.google/2026/01/pixel-0-click-part-1.html #android @cafe_security

Chasing Shadows: Chronicles of Counter-Intelligence from the Citizen Lab https://youtu.be/frmGzgBvGdg?si=sfnvy8Ah-6A1dAYV #nso #Citizen_Lab #spyware @cafe_security

Introducing Kernel Data Protection, a new platform security technology for preventing data corruption https://www.microsoft.com/en-us/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/ #KDP #data_corruption #BYOVD @cafe_security

[  42.1337] #security: EXAM: Exploiting Exclusive System-Level Cache in Apple M-Series SoCs for Enhanced Cache Occupancy Attacks https://arxiv.org/html/2504.13385v1 Apparently the shared cache inside Apple M chips (the System Level Cache that both CPU and GPU use) can accidentally act like a little "activity meter" for the whole system. If you measure how busy or full it gets, you can infer what other parts of the chip are doing even if you're running somewhere else. The authors use that signal for things people don't expect a cache to reveal, like guessing which websites are being loaded from the pattern alone and even getting rough clues about what's on screen based on how the GPU renders frames. It wraps up with an "add noise" style mitigation that tries to blur the leak without much overhead.

ROP the ROM: Exploiting a Stack Buffer Overflow on STM32H5 in Multiple Ways https://www.errno.fr/Overflowing_STM32H5.html @cafe_security

Black Hat USA 2025 | Shade BIOS: Unleashing the Full Stealth of UEFI Malware https://www.youtube.com/watch?v=t17YEHymwE4 @cafe_security

RIP RegPwn https://www.mdsec.co.uk/2026/03/rip-regpwn/ @cafe_security

DCOMIllusionist - Windows fileless latteral movement technique. https://github.com/synacktiv/DCOMIllusionist @cafe_security