Inside UNC6671's Browser Implant
Source analysis of UNC6671's Chrome implant: DevTools control, keylogging, storage theft, camera capture, and durable detection.
Kevin Pham / deoxy
Sometimes it's a protocol, sometimes a radio, sometimes production security. The write-ups keep the measurements and the parts that failed.
Read the latest notes↓
######$$
*$#$#*!!;
!#$$#$#***!=
##$$$ ###*!=;
*##$ ## *! =:!;
!*# # ** ! :*=
#$$#!#*!** !!!*;~,!
*#$$$$#!!=!!!*=;;~,!
!### #*!=:;;;;:::-**
+!;;!*!*!==~~-------
!=;;;+;*;=:=;:~,-
!;=+=;++;+*;;;;,~-
*+;;!!;;;;;*;;++;
;; +;;;**;**;;;*;
+;!!;+ !;;;*;;+;+;
*!; ;;;;;+;+!;;**; ;+
+;+;=*;== +;;;; *;*;;
=;;=;;+===+;!====+*+ ++;*;;
! =+ =*=;; **;+= ; *;*;; ;;
! ; = = ; ;;*; ;; ;;;;;;+
; +; ; ;+ !=;+ ;;+*;;
; ; = ;; === ;;;; +;
; ; *; *; ;;
;; ;;;;
; ++ ;
;;; !
== +;
;
;
;
;
;
++
;*;
;
;;
$$$$$$#
###**!!$$$# #
=#$$$###**==$$$$
=#$ $$$$##**!=;
##$$$$$$ !!=;
!;=**# $ $$$##***!!==
! #;$#*!#~#$$ *!!!=;:
#$$$$$ **#: ###### ==;:
=! !! !+ ! ; ==!+!!!!!+!!!!==+===*$$$$$ #!**### !!!= :~
! !!;! +!!; =!+!!!! = == ==!+=! +!!!*#$!### *!=:-, ****** ;;~- *=
! !!!!+=+!!!!=!=!+!!!!!+!!!=!!+=!===*#*###!!=!!*** ==;:-##!-
!!!!+!!!!!=!!! + ===!!!+!!!==!!!!!!=*!!! ;;==!!!!!!!=##:-,*!!*
====!! !!!+!!!! +==+=!!++====:,; ;;- --;;; ~!**#;:--***#
!!!!!=+!=!!+!!!!!+!===!+===== ======+ ,,~, , ,~;;;;;;---#**#
== !!! = =+== === ~~~~-,#####
!! +=== ==+ ==== =+=
!!!+ !! ===+== ====
=!+!! ++!+===== =!+=
==!! !! ====!+!!!
= === !+==
!!!!!+= =!!
!!
!
!+
!
!!
+=
= !==
!!
##
$##*=#
#$$$#**!:
*#$###*!;
#*###***!;-;
*$$$#!**!!;;~!
!####*;=;===~,*
!+=;;;;=!!=~-----
+;;;;;+*;;;;~-,
;;;+;;;+;+;;;
!;;;;+;+;+;;+;;
=;;;+;=;;!=+;;;;;;;
!=== =+=;;= *;+==+;;*;;;+
;;; +; ;;;; !+;;;;;;;
;; =;; ==+;;++;
*;;;;;;
;*;;;;
==; ;
;+
;;
*;
*+
;;; $##
;; ##*!!$$$$
*$$$##*!;$$
*$$$$$##*!=;
*$$$$$$#**!=:
!$$#**#$$ ##**!=;
*$$$$#**#### !!=;:
!!!!!!+!!!!+!!##$$#=**!****** =;~#=~
== =!!+!!!!!+!!!= =====!=+!!!!!=+!!!==!*##!!;=== !!!=::-*!
!!!==+!!!!=!!==!=+====+==;=;;;;-:;!!!*;;:-**#
= =+==!!!+!!=======+== -~,-,, ~;;;---#*#
!!!!+!=!+!!!+!!!== =+==== ##
; =====+ +=== =+
!!!=!!====+ =+==
==+==+= =======
== == !=++
!!!+ =!!
!!
!+
!!
+==
=!===
!
2 entries, newest first02entries · newest first
Source analysis of UNC6671's Chrome implant: DevTools control, keylogging, storage theft, camera capture, and durable detection.
A from-scratch OFDM modem in Rust: almost 28.8k over a 30-foot guitar cable, plus a checksum-valid TCP/IP link over virtual audio.