团队动态

盘古团队在2016 Black Hat Europe黑帽大会演讲

盘古团队在11月4日举办的Black Hat Europe 2016会议上分享了”USE-AFTER-USE-AFTER-FREE: EXPLOIT UAF BY GENERATING YOUR OWN”的议题,议题主要介绍了Flash中现有的缓解措施们和一种在现有缓解措施下仍然可用的 use-after-free 的利用方法。

会议相关PPT下载:Black Hat Slide下载

盘古实验室报告七个Flash安全漏洞获Adobe致谢

apsb16-18

6月17日, Adobe发布安全更新APSB16-18,修复了Adobe Flash Player中的多处安全漏洞,Adobe官网同时发布公告致谢发现并报告这些漏洞的安全研究人员,盘古实验室的研究员Wen Guanxing获得了7个致谢:CVE-2016-4150,CVE-2016-4151,CVE-2016-4152,CVE-2016-4153,CVE-2016-4154,CVE-2016-4155,CVE-2016-4156

(更多…)

盘古实验室报告四个Flash安全漏洞获Adobe致谢

Flash

5月12日,全球软件巨头Adobe发布安全更新APSB16-15,修复了Adobe Flash Player中的多处安全漏洞,Adobe官网同时发布公告致谢发现并报告这些漏洞的安全研究人员,盘古实验室的研究员获得了4个致谢

CVE编号是CVE-2016-1097,CVE-2016-1098, CVE-2016-1099, CVE-2016-1100。 (更多…)

Janus(移动应用安全分析社区化平台) BlackHat Asia 2016 首秀

盘古团队的移动应用安全分析社区化平台Janus的想法是很好的。任何自动化分析平台都无法对抗性能、漏报、误报的问题。引入人工审计不可避免,如何能更好的结合人与机器,Janus探索了一条社区化的道路。

— 来自BlackHat ARSENAL 的现场反馈

盘古团队因为多次发布iOS完美越狱工具而被大家所熟悉,很多人希望盘古团队能不断的发布越狱工具,但这只是盘古团队的一个研究方向,盘古团队的研究并非仅局限于iOS安全研究。在这个万物互联的时代,盘古团队希望将丰富的系统攻防之道用于保障每台移动设备的安全和隐私。 (更多…)

盘古将再次带来移动安全新产品,Black Hat Asia 2016见!

640

盘古团队将于3月30号在新加坡举办的Black Hat上展示移动应用安全分析的社区化平台。

移动设备上的恶意代码也像当年PC上的恶意代码一样正在快速发展,不同的是,移动设备相当于每个人的外部器官,感染恶意代码的移动设备带来威胁比PC更大,攻击者的手法也在不断进化,利用真实车辆违章记录,知道车主的姓名、车牌、违章地点从而构造出一个可信度极高的场景,发短信通知车主去下载安装攻击者好心提供的“应用”,除此之外,航班、快递、送餐等等我们每天接触到的衣食住行都可能有诈,从攻击背后的产业化合作、大规模利用都可以看出隐藏在恶意代码背后另一个活跃且繁荣的地下产业。

(更多…)

2015中国互联网安全大会(ISC)演讲&培训

中国互联网安全大会将于2015.9.29-30号于北京国家会议中心举办,盘古团队首席科学家王铁磊作为智能移动终端攻防论坛主席将会分享“iOS安全体系演进过程及漏洞分析”的议题。同时在9.28号的安全训练营中盘古团队首次提供面向安全研究人员的培训,具体培训信息:

培训主题:
iOS用户态漏洞挖掘与利用

培训内容:
首先介绍iOS系统上的各种安全机制,讲解iOS沙盒、地址随机化、代码签名等机制的实现原理和常见对抗策略。随后结合真机操作,进一步介绍越狱环境下的开发调试手段。在漏洞挖掘和利用方面,重点讲解iOS平台上进程间通信漏洞的挖掘及POC分析方法,最后结合一个iOS8.2下的真实漏洞案例讲解如何编写漏洞利用的Exploit。

(更多…)

Black Hat & XCon

盘古团队于上周8月6日在拉斯维加斯举办的Black Hat USA 2015会议上分享了”Review and Exploit Neglected Attack Surfaces in iOS 8″的议题。该议题分析了iOS系统中一些不被注意的攻击面,针对内核层讨论了IOKit Fuzz的改进,针对用户层则重点介绍了XPC Fuzz。
错过该议题的同学也可以在下周举办的XCon 2015上听到该议题的分享。

Black Hat Slide下载

xKungFoo演讲

盘古团队在本周四(4.23)举办的xKungFoo2015会议上分享了”iOS内核漏洞挖掘–fuzz&代码审计”的议题,详细介绍如何挖掘iOS内核漏洞并给出几个内核漏洞的具体分析。

会议相关PPT下载:iOS内核漏洞挖掘

Let the Truth Speak for Itself

After the release of our blogpost, it is very funny to see Mr. Stefan continues to post unwarranted and spiteful conjectures on Twitter and his blogpost. We suggest the reader refer to our blogpost as well as his blogpost to understand the backgroud.

Among his numerous discriminations and accusations against us (such as calling us thieves and criminals), the main one is that he claims that we have been trying to buy/acquire vulnerabilities to achieve jailbreaks. The “horribly” strong evidence is a piece of chat history between him and @windknown, a member of our team. Although we think it is immoral to post private messages to the public, we do not mind showing the full chat history, and let the truth speak for itself.

(更多…)

Jailbreak Should not Tolerate Regional Discrimination

Since the first release of our untethered jailbreak tool Pangu 7 in June 2014, there have been many ridiculous rumors, discriminations, and vilifications on our team, especially from Stefan Esser (‏@i0n1c). As a team of “nerds”, we did not want to waste time on responding such useless things and hoped that eventually these things would stop after a while. We put 100% efforts on developing new jailbreaks for iOS 8 and successfully released Pangu 8 roughly a month after iOS 8 was released.

We could ignore the increasingly unfunny and ridiculous comments on our team, but cannot bear the racist comments from Stefan Esser in his recent talk at Syscan, which deliberately separate the jailbreak community with “Chinese” and “Western” labels and are full of morbid imaginations. In fact, many well-known iOS “Western” hackers including comex and P0sixninja are visiting Beijing, China today for a mobile security summit.

Apparently, the Pangu team cannot represent all Chinese jailbreak developers. We hereby just want to clarify the rumors, discriminations, and vilifications on our team.

The financial sponsorship of the Pangu team is mainly used to cover the cost of developing jailbreak tools

The “1 million USD” rumor was first posted when evasi0n 7 was released.

For us, our sponsorship is mainly used to support the development of jailbreak tools, cover the cost of software testing, and facility the download servers, etc. Note that, to make our untethered jailbreak tool reliable, we need to test all hardware models from iPhone 4s to iPhone 6 Plus, from iPad 2 to iPad Air, all iOS versions from 7.1 to 8.1. The sponsorship is also used to purchase all kinds of iOS devices for the testing purpose. But anyway, we are also wondering where the “1 million USD” is, LOL.

The Pangu team does not buy vulnerabilities, never and ever

(更多…)