Researcher

Arnold Morales

Bio

Desde los 12 años, me he dedicado a la informática con un enfoque especial en la seguridad. Actualmente, a mis 22 años, sigo explorando este mundo con la misma pasión, impulsado por la constante evolución de la tecnología y su interminable curva de aprendizaje. Cuento con una carrera en Cómputo Forense y Ciberseguridad, actualmente curso una maestría en Inteligencia Artificial y Ciberseguridad. Certificaciones: CWEE | CAPE |CPTS | EWPTX | CRTO | eMAPT | OSCP | OSCP+ |CEH V13 | EJPT| HTB prolabs Hades - Cybernetics - Zephyr - APTlabs | MDK

Index

Research — 3 entries

August 8, 2026 Workshop Offensive Security Red Team Village — DEF CON 2026 Evading EDR in ATM

ATMs in the end are a computer with windows.

I will talk about EDRs and how parent-child process inheritance works.

The Windows boot process, known as the boot process, is divided into several phases as we have already seen: PreBoot (initialization of BIOS/UEFI firmware and POST), Boot Manager (loading of bootmgr or bootmgfw.efi), OS Loader (execution of winload.exe to load the kernel), and Kernel Initialization (loading of ntoskrnl.exe and hal.dll, initialization of drivers and services). Finally, winlogon.exe is started to present the user interface. This process enables the transition from a powered-off state to a functional operating system through a hierarchical and verified sequence.

Regarding kernel-based EDRs (Endpoint Detection and Response), they operate in kernel mode, the most privileged level of the system (some also operate at the UEFI level), which allows them to monitor low-level activities such as system calls, memory manipulation, driver loading, and file access. By running in this mode, EDRs can detect and block advanced threats such as rootkits or persistent malware that attempt to evade user-mode protections. Their deep integration with the kernel enables real-time monitoring, behavioral analysis, and immediate response to suspicious activities during and after the boot process.

EDRs are typically located in the kernel, but as mentioned, some also operate at the UEFI level. If we recall how Windows works, beneath UEFI lies SMM (System Management Mode), making this an even more complex layer to analyze and operate within.

This talk is intended for individuals interested not only in ATMs and simple cash dispensing, but in going beyond that—focusing on deeper analysis and the full experience gained when confronting these systems.

Presented at Red Team Village — DEF CON 2026

View official session DMA Introduction (write-up) Telemetry Bypass (write-up)
August 7, 2026 Talk Offensive Security Payment Village — DEF CON 2026 Breaking BIOS in ATMs
The analysis begins at Ring -3, advancing toward the positive rings. Starting from the on-screen user perspective imposes too many limitations. The shift in approach was deliberate: rather than assuming a conventional attack vector such as connecting an external device or performing a kiosk-level bypass, the decision was made to start from the deepest layers of the system. This compromise is detected for the following reason:
- DMA protection exists at the BIOS level.
The goal of this compromise is to activate PCI/PCIe through BIOS in order to perform a DMA. This section will be referred to as "BIOS Unprotection."

How was this achieved? Two methods were identified:
- A bridge was found that triggers a BIOS configuration reset.
- BIOS duplication with encryption validation bypass (enables both Downgrade and Upgrade).
DMA or complete chain will not be shown since it is a delicate topic, but BIOS research will be deepened since it does not only apply to ATMs.

Presented at Payment Village — DEF CON 2026

View official session
August 7, 2026 Talk Offensive Security La Villa Hacker — DEF CON 2026 Jackpoting? Bypass de EDR? - Hacking ATM

En muchas ocasiones cómo pentesters nos aferramos a la idea de buscar multiples técnicas de ataque de manera "virtual", buscando software especializado o creando scripts que nos ayuden a identificar una vulnerabilidad para acceder a un programa o dispositivo en el que nos enfoquemos, pasamos tanto tiempo enfrente de nuestra pantalla, lanzando comandos a lo bastardo hasta ver que podemos encontrar que a veces ignoramos que existen soluciones alternativas y no simplemente de manera virtual, sino de una manera en que podemos tocar, armar y desarmar (esto suele ser menos buscado por pentester, entonces tambien hay menos documentacion).

El proceso de arranque de Windows, conocido como boot process, se divide en varias fases como ya lo vimos: PreBoot (inicialización del firmware BIOS/UEFI y POST), Boot Manager (carga de bootmgr o bootmgfw.efi), OS Loader (ejecución de winload.exe para cargar el kernel) y Kernel Initialization (carga de ntoskrnl.exe y hal.dll, inicialización de controladores y servicios). Finalmente, se inicia winlogon.exe para presentar la interfaz de usuario. Este proceso permite pasar de un estado apagado a un sistema operativo funcional mediante una secuencia jerárquica y verificada.

Respecto a los EDR (Endpoint Detection and Response) basados en el kernel, operan en modo kernel, el nivel más privilegiado del sistema (algunos juegan en UEFI), lo que les permite supervisar actividades de bajo nivel como llamadas al sistema, manipulación de memoria, carga de controladores y acceso a archivos. Al ejecutarse en este modo, los EDR pueden detectar y bloquear amenazas avanzadas como rootkits o malware persistente que intentan eludir las protecciones del modo usuario. Su integración profunda con el kernel les permite realizar monitoreo en tiempo real, análisis de comportamiento y respuesta inmediata ante actividades sospechosas durante y después del arranque.

Normalmente los EDRs se encuentran en KERNEL pero como lo mencione, existen otros que se encuentran en UEFI y si recordamos como funciona windows atrás de UEFI esta SMM entonces es algo un poco mas dicil.

Esta charla es pensada para personas interesadas no solo en ATMs y una simple dispensación si no la vista mas alla, el análisis y toda la experiencia adquirida cuando te enfrentas a ellos.

Presented at La Villa Hacker — DEF CON 2026

View official session