eShard | Hardware & Software Security

We're at @POC_Crew Conference in Seoul 📍 Come by our booth with whatever you’re trying to figure out, and see how Epoch, our time travel debugger for full systems, can trace it back for you.

Getting ready to go on the road for the last time this year. Find us at @POC_Crew, @codeblue_jp and @hardwear_io 🔥

The last session of the year runs November 17-18, and seats are filling up. 🚨 Last chance: eventbrite.fr/e/post-quantum…

A single 2-byte instruction skip bypasses secure boot verification in the boot ROM of a widely deployed ARM router SoC, despite a constant-time compare and redundant verdict encodings. Full write-up 👇 eshard.com/blog/one-faulty-s…

Testing each part of a drone separately can miss the real weakness. This is why its hardware, firmware and radio link should be tested as one attack surface. #drone #embeddedsecurity eshard.com/blog/drone-hardwa…

Want to see how physical attacks on post-quantum cryptography work in practice? The last session of the year runs November 17-18, and seats are filling up. 🔗 Register here: eventbrite.fr/e/pqc-physical… #pqc #postquantum

From firmware binary to security evidence: efficiently investigate firmware security, identify potential weaknesses and produce evidence that others can review. eshard.com/blog/firmware-ana…

Part 4 of our Android kernel exploit chain: CVE-2023-20938, a Binder use-after-free on a Pixel 6 running Android 12. Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address. 👉 eshard.com/blog/kernel-uaf-4… #android #cve

We’re publishing a full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12. 👉 Start part 1: eshard.com/blog/kernel-uaf-1…

Can SLH-DSA-SHAKE implementations resist differential side-channel attacks? Our researchers developed a differential side-channel attack methodology and demonstrated secret seed recovery on an STM32F4 microcontroller. 📄 eprint.iacr.org/2026/2584 #pqc #sca #nist

Kernel UaF to Root, part 3: Turning the address we leaked in part 2 into a kernel write, on a Pixel 6 running Android 12. 🔗Read: eshard.com/blog/kernel-uaf-t…

Next in our drone security series: having the right security mechanisms doesn't always mean they'll withstand a physical attack. From encryption to secure boot and readout protection, we explore why testing the actual implementation matters. eshard.com/blog/drone-securi…

Next week! 🔥 #PQC

Part 2 of our Android kernel exploit chain (CVE-2023-20938): the stale read returns garbage until you control what reclaims the freed slot. Land the right object there and it hands back a live kernel pointer instead. That’s your KASLR bypass. eshard.com/blog/kernel-uaf-2…

In case you missed it: we started publishing a full Android kernel exploit chain built on CVE-2023-20938. Part 2 is coming soon. eshard.com/blog/kernel-uaf-1…

Live from Paris at @hexacon_fr 🔵 We’re here with the team until tomorrow, come say hi! If you want something to dig into, our Android kernel UaF series is live, and you can explore the trace at ttd.eshard.com

We’re publishing a full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12. 🔗 eshard.com/blog/kernel-uaf-1…

Recording a malware sample used to be a long list of manual steps. Now one sentence to an LLM connected to Epoch covers it all, from a clean isolated VM to a verified, indexed trace. eshard.com/blog/record-malwa…