Computest Sector 7

We have published the third and final writeup of our #Pwn2Own EV charger exploits: the Autel MaxiCharger! Unlike the other two, this one had authentication on the Bluetooth functionality! …but that had a “backdoor”. 😅 https://lnkd.in/eER_J6EJ

We have published the third and final writeup of our #Pwn2Own EV charger exploits: the Autel MaxiCharger! Unlike the other two, this one had authentication on the Bluetooth functionality! …but that had a “backdoor”. 😅 https://lnkd.in/eER_J6EJ

We have published the 2nd writeup about the EV vulnerabilities we exploited for #Pwn2Own Automotive: the JuiceBox 40. For this charger, the vulnerability we exploited was NOT fixed! SiLabs, the developer of the OS used by the charger, has declared the product EOL and won't fix it. https://lnkd.in/edf9WaP2

We have published the 2nd writeup about the EV vulnerabilities we exploited for #Pwn2Own Automotive: the JuiceBox 40. For this charger, the vulnerability we exploited was NOT fixed! SiLabs, the developer of the OS used by the charger, has declared the product EOL and won't fix it. https://lnkd.in/edf9WaP2

Having given our talk on hacking EV-chargers at #BHUSA yesterday, we have just published the first writeup with the vulnerabilities we found in the ChargePoint Home Flex. Including how we accidentally hacked their entire cloud infrastructure. 😄 https://lnkd.in/ekbmH3Zr

We assisted Team High Tech Crime from the Dutch police by writing a decryptor for the #DoNex (and #DarkRace) ransomware. Its encryption method had a flaw that makes it possible to recover all files without knowing the key. Our decryptor has now been published on No More Ransom. https://lnkd.in/eH9NRZFM

We've published our writeup of CVE-2024-20693, a vulnerability in Windows that allowed spoofing the code signature of binaries by placing them on an SMB share. This research originally was about something different, but we ran into a signature check... https://lnkd.in/ezCDVeQC

We are very happy to announce that our session "Low Energy to High Energy: Hacking Nearby EV-Chargers Over Bluetooth" got accepted for Black Hat USA! We're going to talk about our research into EV chargers for #Pwn2Own Automotive. https://lnkd.in/ehyjhusK

On Friday, Thijs Alkemade is giving the presentation “Don’t Talk All at Once! Elevating Privileges on macOS by Audit Token Spoofing” at the Objective by the Sea conference in Marbella (Spain). This talk will describe how XPC connections are implemented on macOS and how a design issue could be exploited to elevate privileges on macOS to root. For more info, see https://lnkd.in/eGGDgTBM A live stream should be available on: https://lnkd.in/eVSY_Z3y #OBTS #OBTSv6 #macOS