Principal Lead @ MSFT Ex Senior RE @ FLARE (Mandiant/Google).
Israel
Joined November 2015
- Tweets2.1K
- Following375
- Followers4.3K
- Likes10.2K
Mark retweeted
Check out our latest report covering Ivanti CSA vulnerability with complete root cause analysis, detailed breakdown of ITW exploitation, overview of worldwide targets alongside comprehensive IoCs & detection rules 👇🏻
harfanglab.io/insidethelab/i…
Mark retweeted
In case if you wonder what broke #ProcessHollowing on Windows 11 24H2, I have something for you: hshrzd.wordpress.com/2025/01…
Mark retweeted
Read “Behind Hacking-Team’s vector-edk“ on Medium: medium.com/@wolfcod/behind-h…
My old keybase is dead, if you want to reach me on keybase use this one.
Verifying myself: I am marklechtik on Keybase.io. 9RMVFje1UmWmrBeffCo6c69DF6sjVQ_FGpMI / keybase.io/marklechtik/sigs/…
Verifying myself: I am marklechtik on Keybase.io. 9RMVFje1UmWmrBeffCo6c69DF6sjVQ_FGpMI / keybase.io/marklechtik/sigs/…
Mark retweeted
Writing an IDA processor module for the PigletVM
youtu.be/JfPU31HLHrc
Mark retweeted
Frequent freeloader part II: After co-opting the tools and infrastructure of another nation-state threat actor to facilitate espionage activities, Secret Blizzard used those tools and infrastructure to compromise targets in Ukraine. These campaigns consistently led to the download of Secret Blizzard’s custom malware, with the #Tavdig backdoor creating the foothold to install their #Kazuar V2 backdoor.
#SecretBlizzard
microsoft.com/en-us/security…
Mark retweeted
Excited to be able to publicly share the research I've been focusing on (and off) for the past several months! ~ lookout.com/threat-intellige…
Mark retweeted
#FlareOn11 is over, so I published the repository with all my source codes: github.com/hasherezade/flare…. Write-ups coming soon!
Mark retweeted
tldw;
For #flareon11 challenge #10 by @_marklech_, here's the approach I took:
1. Use UEFI Tool to extract the Shell app from the bios file
2. Use efiXplorer and Lumina to bring it as many symbols as possible
3. Use the angr framework to solve flag #1 and flag #2
4. For flag #3, full RE of the virtual machine
5. Implement a VM disassembler
6. Implement a VM decompiler: bytecode -> x64 assembly -> Hex-Rays decompiler -> C pseudocode
7. For fun, solve flag #1 and flag #2 again but with KLEE (on the decompiled bytecode which is now VM interpreter free and in clean C form)
8. Solve flag #3 with a bit of bruteforce
The most fun part was converting the bytecode back to pseudocode (going through x64 assembly first) and taking the blackbox approach with both angr and KLEE.
All files are online here: github.com/allthingsida/allt… (fully documented IDB, KLEE adapated bytecode, angr driver, and bytecode decompiler via x64asm, etc.).
Mark retweeted
Solving (and Pwning) Flare-On Level 10
jro.sg/flareon11/solving10.h…
#flareon11
Mark retweeted
My solution for the 10-th task: hshrzd.wordpress.com/2024/10… #FlareOn11
Mark retweeted
Flare-On 11's CatBert CTF challenge walkthrough
youtu.be/B1hE2z5JmLo
#flareon11
Earlier this year, before leaving Mandiant, I had the opportunity to create Challenge #10 for the #FlareOn11 CTF! Here’s a quick rundown of the challenge. 🧵⬇️
In crafting my solution, I opted for a straightforward approach. For more advanced techniques, I often look to @allthingsida’s content. This year, he shared his own solution in a fantastic video that you can check here 🎥 :youtu.be/B1hE2z5JmLo?si=OT9E…
I hope you enjoyed tackling this year’s challenge! Looking forward to reading everyone’s solutions and learning from the unique approaches. #flareon11
Props to Sophos for bravely addressing what many shy away from—that our edge device security posture is complete shait. Even more respect for them actually taking action, which resulted in this stellar research.
news.sophos.com/en-us/2024/1…
