Auditorías de seguridad prácticas, divulgaciones responsables de vulnerabilidades y publicaciones científicas revisadas en criptoanálisis y sistemas de código abierto.
Operational review of UEFI Secure Boot and measured boot on ARM64 servers, including vendor signature handling and firmware update chain trust.
Documented practical weaknesses in ARM64 server boot-chain signing and platform certificate management observed during audits.
Measurement-driven analysis of address space layout randomization entropy in 32-bit embedded Linux targets, including the impact on exploit reliability.
Quantified usable ASLR entropy on 32-bit targets and framed expectations for embedded defenders evaluating exploit mitigation strength.
Formal research publication on statistical entropy anomalies, bit distribution variance, and checksum constraints within BIP39 24-word deterministic cryptocurrency key derivation.
Provided cryptographic analysis of entropy distribution constraints in high-length mnemonic seed phrases used across hardware and software wallets.
Comparative review of constant-time implementations for EC scalar multiplication and practical detection of residual secret-dependent branches.
Offered a pragmatic branching-audit methodology for reviewing EC implementations against timing leakage.
Cross-CA analysis of certificate transparency log submission latency and its effect on phishing-window detection.
Quantified CT observation latency across major CAs and provided monitoring tuning guidance for defenders.
Engineering study of attaching long-lived eBPF policies to systemd services to enforce syscall, network, and file-access boundaries at the kernel.
Demonstrated a practical eBPF policy layer that complements seccomp and LSM defaults without requiring application changes.
Operational research outlining a verified offline procedure for rotating asymmetric keys inside legacy HSM partitions when the standard management interface is unavailable.
Provided a recoverable, auditable key-rotation methodology for constrained hardware security modules, reducing lockout risk during incident response.
Comprehensive investigation into non-uniform entropy sampling, bias in word selection algorithms, and real-world attack vectors in cryptocurrency wallet generation systems.
Demonstrated real-world entropy degradation scenarios when client-side wallet generators fail to enforce true hardware entropy gathering.
Security audit and responsible disclosure of a critical CTDB socket handling vulnerability in Samba affecting clustered database deployments, IPC synchronization, and privilege boundaries.
Demonstrated socket descriptor mismanagement in clustered Samba environments that could lead to IPC desynchronization and potential privilege escalation.
Demonstrative systems research on constructing strict seccomp-BPF syscall allowlists for headless containerized services, with measurable reductions in kernel attack surface.
Offered practical guidance for reducing kernel syscall exposure in containerized daemons, complementing existing runtime security defaults.
Analysis of cross-thread observation windows on SMT processors and practical strategies for time-slicing-sensitive workloads.
Provided workload-level guidance on co-location risks when shared hardware threads execute security-sensitive code.
Threat-modeling note on tire pressure monitoring system (TPMS) firmware updates, covering unsigned flash regions and sensor spoofing during over-the-air patches.
Highlighted firmware integrity gaps in a consumer automotive component class, with mitigations applicable before vendor action.
Vulnerability analysis of expandable UEFI capsule update flows, focusing on unsigned optional payloads and the integrity gaps they introduce during the update chain.
Documented a practical integrity weakness class in UEFI capsule update pipelines that can be mitigated without vendor firmware changes.
Vulnerability-class description of watchdog timeouts being disabled through clock configuration changes on managed devices.
Documented an availability-impacting weakness class in managed devices where watchdog effectiveness depends on unauthenticated clock configuration.
GUIARX se adhiere estrictamente a los estándares de divulgación responsable de vulnerabilidades. Cuando se identifican fallos en proyectos upstream, se otorga un plazo adecuado a los desarrolladores para su corrección antes de publicar cualquier aviso público.
Para coordinadores de seguridad que requieran verificación o reportes cifrados, contáctenos mediante nuestros canales verificados.
