Loading story…
Security researchers have demonstrated new hardware-based techniques to extract sensitive data from devices previously considered secure, including smartwatches and confidential computing servers. In one case, analysts revived the 'Blinkenlights' technique, adapting it to modern TFT screens to extract firmware from a budget smartwatch by exploiting a dial parser vulnerability. This allowed arbitrary memory content to be displayed on the device's screen, which was then captured using a high-speed Raspberry Pi Pico setup. The smartwatch, which contained fake health sensors and used a JieLi AC6958C6 system-on-chip, was found to have weak authentication and a flawed firmware parser, enabling the out-of-bounds read attack.
Separately, researchers from KU Leuven University presented a low-cost hardware attack called 'Battering RAM' at Black Hat Europe 2025, which targets secure CPU enclaves such as Intel SGX and AMD SEV. By using a $50 DDR4 interposer, the researchers manipulated memory address mapping at runtime, bypassing firmware mitigations and gaining unauthorized access to encrypted memory. This allowed them to extract platform provisioning keys, forge attestation reports, and implant persistent backdoors on protected virtual machines, raising concerns about the security of cloud infrastructures relying on these technologies.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Researchers at Quarkslab adapted the historic Blinkenlights technique to dump firmware from a low-cost smartwatch built on a JieLi AC6958C6 chip. They exploited a dial parser out-of-bounds read flaw to force arbitrary memory contents onto the display, then captured and reconstructed the firmware using inexpensive hardware and Python tooling.
Following disclosure of the Battering RAM findings, Intel and AMD stated that the attack falls outside their security scope because it depends on physical hardware manipulation. The response underscored that current software and firmware defenses do not detect this class of attack.
Security researchers from KU Leuven University showed that a custom $50 DDR4 interposer can manipulate memory address mapping at runtime and break confidential-computing protections in systems using Intel SGX and AMD SEV. The attack enabled plaintext memory read/write access, SGX provisioning key extraction, forged attestation reports, and persistent backdoors on AMD SEV virtual machines while bypassing existing firmware mitigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Academic researchers from Georgia Tech, Purdue University, and Synkhronix have developed a side-channel attack named **TEE.Fail** that enables the extraction of secrets from trusted execution environments (TEEs) in modern CPUs, including Intel's SGX and TDX, AMD's SEV-SNP, and even Nvidia's GPU Confidential Computing. The attack leverages a memory-bus interposition technique on DDR5 systems, using off-the-shelf equipment costing under $1,000, to physically intercept and analyze encrypted memory traffic. This method allows attackers with physical access and root privileges to extract cryptographic keys and forge attestation, undermining the security guarantees of confidential computing environments. TEE.Fail is the first attack demonstrated against DDR5-based TEEs, extending previous DDR4-focused research such as WireTap and BatteringRAM. The researchers found that architectural changes in recent server-grade CPUs, specifically the adoption of deterministic AES-XTS encryption without memory integrity and replay protections, have introduced exploitable weaknesses. The attack's success highlights significant risks for organizations relying on hardware-based confidential computing, as it enables the compromise of sensitive data and secure workloads even on fully updated, trusted systems.
Jun 29, 2026
Researchers reported that **Rowhammer** remains a practical hardware security threat, with the newer **Phoenix** technique showing that **DDR5** memory can still be manipulated despite built-in protections. The attack revives a flaw first highlighted by Google Project Zero, which demonstrated that repeatedly accessing DRAM rows could trigger adjacent bit flips and be weaponized for **privilege escalation** on x86 systems, including a Linux kernel exploit that altered page table entries and a sandbox escape from **Google Native Client**. The newer findings indicate that DDR5 mitigations have not eliminated the underlying risk, extending concerns that began with widespread **DDR3** exposure across tested laptop models. Earlier research had already shown Rowhammer was more than a reliability issue, and the latest reports suggest modern memory modules remain susceptible to carefully engineered disturbance attacks that can undermine isolation boundaries and system integrity, renewing pressure on hardware vendors to disclose affected products and strengthen defenses.
Jun 29, 2026
Researchers disclosed the **Meltdown** and **Spectre** hardware flaws, showing that speculative execution in modern processors could let attackers read sensitive data across security boundaries on affected devices. Reuters reported that **Meltdown** primarily affected Intel processors by breaking memory isolation, while **Spectre** impacted Intel, AMD, and ARM chips by tricking applications into leaking secrets such as passwords and other protected data. CERT/CC later summarized the broader issue as cache side-channel attacks against CPU hardware using speculative execution, underscoring that the weakness was architectural rather than limited to a single product line. Major vendors and cloud providers moved to contain the fallout with software, firmware, and microcode mitigations, including Microsoft Azure protections for hosted customers and public advisories from manufacturers such as Huawei. Subsequent research showed the problem persisted beyond the initial disclosures: the **ZombieLoad** attacks demonstrated additional Intel data-leakage paths tied to speculative execution, and a later **TSX Asynchronous Abort (TAA)** variant affected some processors previously thought to be resistant. Intel issued microcode updates, but researchers and vendors warned that mitigations reduced rather than eliminated risk, that exploitation generally required local code execution, and that fully disabling the underlying CPU behavior would carry significant performance costs.
Jun 29, 2026