> dmcdonald.net / writing > ───────────────────────
Writing
collected from where I've worked over the years (NCC, Cryptic Red, AmberWolf). Each entry links to the canonical version, usually on the original venue. Local copies appear only where the venue has gone away or is winding down.
── 2026 ──────────────────────────────────────
Dell BIOS Passwords: Weak XOR Encryption Allows Recovery from SPI Flash (CVE-2026-40639)
Dell client platform BIOS stores the administrator and user passwords XOR-encrypted in the SPI flash rather than as a one-way hash. A length mismatch between the password field and the key leaks the key alongside the ciphertext, so the password is recovered deterministically from a flash dump, no brute force, no known plaintext. Joint research with Craig S. Blackie of MDSec. Full write-up on the AmberWolf blog.
── 2025 ──────────────────────────────────────
ThinOS: Unencrypted Memory Dumps (CVE-2025-32752)
Dell ThinOS claimed full disk encryption, but kernel memory dumps landed unencrypted on disk, exposing process memory to anyone with physical access. Found on a client build review by reaching for screwdrivers rather than a checklist. Full write-up on the AmberWolf blog.
── 2022 ──────────────────────────────────────
Defending your Phishing Page Against EOP and Safe-Links: A Blacklist Approach
Red team tradecraft for bypassing Microsoft Office 365 phishing protections (Exchange Online Protection, Safe Links). Practical techniques developed during engagement work: serve different content based on IP, user-agent, identifier presence, HTTP method, and cloud-provider netblock analysis.
── 2021 ──────────────────────────────────────
rtp-red-cap: RTP Bleed for Poor People
Practical RTP Bleed exploitation for pentesters without budget for proprietary VoIP testing tools. Uses rtpnatscan, Wireshark, and a custom scapy script to extract audio from hijacked RTP streams. Foundation for what later became voipire.
Sniffing BitLocker Keys on the SPI Bus
Practical BitLocker recovery by sniffing the SPI bus between a discrete TPM and the CPU during early boot. Saleae logic analyser on the SPI flash, pattern recognition on the captured traffic to identify the Virtual Master Key as it transits to the TPM. Physical-access attack against a Dell Latitude E5470 with a dedicated TPM chip, demonstrating that the attack class is accessible at around £500 of hardware and a day of work.
── 2016 ──────────────────────────────────────
Rolling Back Rolling Codes
SDR teardown of a consumer garage door opener marketed as "rolling code secure." ASK/OOK demodulation in GNURadio Companion, Python decoder, packet structure analysis. Two captured codes played alternately bypass the anti-replay protection because out-of-sequence valid codes reset the device's position in the rolling sequence. Later republished on the Cryptic Red blog in 2024.
── 2013 ──────────────────────────────────────
The Pentester's Guide to Akamai
White paper on offensive testing of Akamai-fronted web applications. Covers Edge server identification, origin server discovery, request-smuggling and host-header attacks against the CDN edge, and the Distributed Destination DDoS framing for amplification through Akamai's distribution network. Solo authorship at NCC Group. Featured in NCC's 20-year research retrospective.