TFW a manufacturer uses an obscure init value for their proprietary RS485 protocol CRC16 thinking that will slow you down.... There are only 65,535 possible values, and reveng is scriptable 😏

the xz sshd backdoor rabbithole goes quite a bit deeper. I was just able to trigger some harder to reach functionality of the backdoor. there's still more to explore.. 1/n

When you are writing a malware loader and it is lunch time but you need to think of an XOR key to hide your strings:

I am dealing with VMWare licensing renewals right now, and I feel like this sums up Broadcom:

Today at 15:15 (local time Las Vegas), we are talking about how we reverse engineered and hacked Ecovacs robots. Find us at the Creator Stage 3 @DEFCON ! We will demonstrate a BLE RCE, too. info.defcon.org/event/?id=54998

I've always wanted to see something like this put into a SFP form factor for network security testing. You'd have power, possible network connectivity to the switch/router device and it would be well-disguised. It would be a great way for nation-states to tap networks too...

"What person alive today is most like a Bond Villain?" Grok says Elon Musk. I guess I can't really argue with its logic. x.com/i/grok/share/3…

DEFCON Finally posted the video of Dennis Giese and Braelynn's talk on Ecovacs robots from this year. The section on the robotic lawn mower is particularly interesting. youtube.com/watch?v=_wUsM0…

I should be able to do some interesting things with this...

Signal matching a ceiling fan remote transmitter with an Arduino to bypass their cloud app for remote control.

A little bit of reverse engineering a cheap digital caliper serial protocol for an Arduino integration.

One of my least favorite things to see when I am trying to RE a device.

That looks like a problem to me...

Why does it feel like I spend a significant portion of my work day clicking through and declining various "Try this feature!" screens while trying to get work done?