IoT Hacker, Cybersecurity Researcher, Lockpicker
Boston
Joined May 2018
- Tweets205
- Following67
- Followers1.8K
- Likes168
I am doing my "Hands-on IoT firmware extraction and forensics" workshop this year again at @defcon (Fri@9am) and @HacksInTaiwan. Seats for DC are limited. Registration for #DEFCON34 workshops opens tomorrow (14.07) noon PDT. You can find an overview here: defcon.org/html/defcon-34/dc…
Dennis Giese retweeted
What's inside the #MediaTekchips powering your Wi-Fi?
🤔 At #NullconBerlin2025, Daniel Wegemer & Edoardo Mantovani reveal how they reverse engineered the firmware, cracked hidden security, and discovered secret features like ICAP & CSI
👉 nullcon.net/berlin-2025/spea…
#chipsecurity
Quick reminder: The #DEFCON workshop sale goes online in ~5 minutes (noon PDT). Our IoT forensic workshop with BGA soldering will be on Sunday 9am. Good luck :) Alternatively, you can also come to our hardwear.io or HITCON edition (mid-August). #defcon33
Hardwear.io US in Santa Clara is coming up next week, with the #HardPWN hardware hacking contest (everyone with a conf. ticket can participate). I am organizing it again this year. Feel free to pm me. schedule, targets and info: hardwear.io/usa-2025/hardpwn… #hw_ioUSA2025
ALT X-Ray of Meta Rayban glasses for hardpwn hackers
The cyberdog and I will be next week at @hardwear_io NL 2024 in Amsterdam. It's one of my favorite hardware security conference. I will participate with other researchers at the #hardPwn contest and try to find vulns in @Xiaomi devices. Feel free to say "hi" :) #IoT #Security
ALT Blue elephant on cyberdog at Hardwear.io USA
This @hardwear_io NL also marks one year after we found a real "bug" (fruit fly), that was squished under a eMMC chip of a Google device. Not all bugs are relevant for security and we sadly did not get a bug bounty for finding it. #IoT #hardPwn
ALT Showing off the eMMC chip with squished fruit fly found while hacking at #hardPwn (Hardwear.io NL 2023)
The @ECOVACS remote racist slur incident and press coverage: I received many questions and there is some confusion. The BLE RCE was not used, but they got initial access thru "credential stuffing". The "pin bypass" vuln might have been used afterwards. abc.net.au/news/2024-10-11/r…
We mentioned the OAUTH token issue in our CCC talk. We noticed that the token remained valid (a few days) even if we delete the account. At that time, we did not see it as a big security issue, as one still needs to get access to the account. But "credential stuffing" happened...
I would have expected that all these things would have been caught in the @tuvcom_cert certification. Then we would not have this unfortunate situation. That said, other robot companies had similar and sometimes worse problems in the past (from China, USA and South Korea).
Dennis Giese retweeted
I also want to point out that this BLE exploit, as well as the HTTP one in previous models, is fundamentally about sloppy programming. They pass parameters
from external protocols directly into a shell without proper sanitization.
This hardly shows a commitment to security.
Dennis Giese retweeted
NEW: Hackers could abuse flaws in Ecovacs robot vacuums and lawn mowers to turn on their microphones and cameras, researchers found.
Ecovacs has not answered to their (nor our) messages. So the vulnerabilities are likely to not have been patched yet.
techcrunch.com/2024/08/09/ec…
Dennis Giese retweeted
Finally, Ecovacs responds to the researchers' findings, saying it won't fix the bugs.
"Users can rest assured that they do not need to worry excessively about this," Ecovacs said in a statement. (Including the whole statement here.)
techcrunch.com/2024/08/09/ec…
We heard that @ecovacsrobotics made some claims about our @DEFCON and upcoming @HacksInTaiwan talk, claiming it being a hard attack (we don't agree). @0xHexHijinx also found it also independently and reported it (March '24). A playlist with our demos: youtube.com/playlist?list=PL…
Finally, Ecovacs responds to the researchers' findings, saying it won't fix the bugs.
"Users can rest assured that they do not need to worry excessively about this," Ecovacs said in a statement. (Including the whole statement here.)
techcrunch.com/2024/08/09/ec…
In regard to our talk: Someone was messing with our presentation pc at @DEFCON, so part was messy. We did not show a working BLE payload. Hopes are that @ecovacsrobotics will patch it now. An updated talk at @HacksInTaiwan next week will publish some tools+test payloads for BLE.
I uploaded my @DEFCON slides here: dontvacuum.me/talks/
There you find our talks about smart locker locks (Open sesame) and Ecovacs robots. We had some last minute changes and annotations, so you find there the latest versions. Many thanks to everyone attending our talks!
Dennis Giese retweeted
Check it out! RL's very own @paulfroberts spoke with @doctorow, @tarah, @WeldPond & @dgi_DE in this @defcon 32 panel "Bricked and Abandoned." Follow @securesilient to stay up to date with efforts related to building secure tech ecosystems.
Our @DEFCON talk "Open Sesame-or how secure is your stuff in electronic lockers" should happen as planned on Sunday (08/11) at 11:30am in Track 4. Many thanks to the @EFF and @kurtopsahl for all their help. And to @doctorow and @tarah for connecting us so quickly.
Don't be confused by the "schedule banners" that are everywhere in the DEFCON venue. They were not updated. But the official online schedule reflects the correct time.
info.defcon.org/event/?id=54…