Windows Task Scheduler has an entry (under COMODO group), COMODO Telemetry {18AD3DFA-30C0-4B5F-84F7-F1870B1A4921}

Located in:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\COMODO\COMODO Telemetry {18AD3DFA-30C0-4B5F-84F7-F1870B1A4921}

AND the actual setting is @

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0270F065-4692-4A79-A84D-4743DFF07213}

... So, we have to disable it in Task Sheduler right-click and "Disable" which will change the "Hash" REG_BINARY value in the Registry.

Next in order for it to stick, take ownership of that Registry f. KEY https://superuser.com/questions/1682239/get-permission-for-registry-key and remove the "Full Control" entry for SYSTEM

... Leaving it as Read (Only); meaning that on next system reboot, COMODO Telemetry will remain Disabled. :)

#ShutUpAndDance
#EOF
w00t! 🙂

Happy to share the public release of a PoC for Carbonara, a 2023 MediaTek DA1 exploit that has been used by multiple tools over the past few years but never before had a public release / information / reference.

The PoC is called penumbra, and it was fully developed from scratch by shomy! Make sure to check it out: https://github.com/shomykohai/penumbra! It also includes a great documentation.

She reverse engineered a paid GSM tool and, with a bit of help from me to understand the exploit mechanics, produced both the PoC and clear documentation explaining how the exploit works.

As a bonus, here's an MTKClient pull request that adds support for Carbonara, making the exploit available to other SoCs that aren't currently supported by penumbra.

Once again, huge thanks to shomy for the original research and implementation!