Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
shakedown.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
A community for live music fans with roots in the jam scene. Shakedown Social is run by a team of volunteers (led by @clifff and @sethadam1) and funded by donations.

Administered by:

Server stats:

286
active users

shakedown.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.4

#pwn2own

0 posts0 participants0 posts today
Public *
Trend Zero Day Initiative

Building an electric vehicle simulator to research EVSEs: At #Pwn2Own Automotive, we built a custom device to let the EV chargers "charge". ZDI researcher Thanos Kaliyanakis explains how to put one together for your research. zerodayinitiative.com/blog/202

Zero Day InitiativeZero Day Initiative — Building an electric vehicle simulator to research EVSEsResearching and reverse engineering Level 2 Electric Vehicle Supply Equipment (EVSE or loosely “charger”) efforts might require the equipment to be placed beyond the idle state. The idle state is straightforward and usually involves nothing more than powering up the charger. Indeed, this is a very u
Public *
Kevin Karhan :verified:

@marcan nodds in agreement #Apple doesn't need to have backdoors in Hardware when their entire #iCould is backdoored and can be weaponized to brick devices.

  • OFC similar functionality can be achieved with #CompuTrace on #amd64-based #Laptops (i.e. #ThinkPads) and compared to that, #AMT + #ManagmentEngine is trivial to #exploit and should be considered real #backdoors (abeit "well meaning" in the sense of remote provisioning of entire fleets of devices, but still allowing to bypass the OS and offering DMA access to the CPU, so basically "#pwned")...

Either way, these are not inherent to the used #Silicon, but entirely #Firmware-based.

  • AMT for example requires a "#Intel #vPro" configuration with Intel-made Ethernet NICs (i.e. i2xx & i3xx - Series) with a Q- or C-series Chipset & supporting #UEFI, so most Systems with cheap #Realtek-NICs aren't exploitable straight-away, and even then it requires certain settings to work, so not an easy "#Pwn2Own" style exploitability...
YouTubeHow Tim Cook Surrendered Apple to the Chinese GovernmentBy The Hated One
#intel#vpro#uefi
Public *
Sector 7

We have published the 2nd writeup about the EV vulnerabilities we exploited for #Pwn2Own Automotive: the JuiceBox 40.

Despite what the @thezdi advisories say, these bugs were NOT fixed by the vendor! SiLabs has declared the product EOL and won't fix it.

sector7.computest.nl/post/2024

Sector 7 · Pwn2Own Automotive 2024: Hacking the JuiceBox 40During Pwn2Own Automotive 2024 in Tokyo, we demonstrated exploits against three different EV chargers: the Autel MaxiCharger (MAXI US AC W12-L-4G), the ChargePoint Home Flex and the JuiceBox 40 Smart EV Charging Station with WiFi. This is our writeup of the research that we performed on the JuiceBox 40 Smart EV Charging Station. We discovered one vulnerability which has, since the event, been assigned CVE-2024-23938. During the competition, we were able to exploit CVE-2024-23938 to execute arbitrary code on the charger while requiring only network access for practical reasons at the event. However, being within Bluetooth range of the device is sufficient with a few extra steps.
Public
Space Rogue

I don’t usually post work stuff but #ibm #xforce doesnt have a Mastodon presence so once in a while I have to post the important stuff.

Congratulations to @chompie1337 who scored a win in the Windows 11 LPE category! Her exploit circumvents the latest Virtualization Based Security mitigations. She becomes the first solo female competitor to score a full win at #Pwn2Own, the world’s most prestigious hacking competition.

(Only links I have are to Xitter and I won’t post those)

Public
happygeek :unverified: + :verified: = $0

New by me at Forbes, a round-up of the #Pwn2Own Toronto 2022 #hacking event. Some 63 #zeroday vulns successfully exploited in the allotted time, earning payouts from #ZDI of very nearly [Professor Evil] One Million Dollars [/Professor Evil] in total.

#infosec #news

forbes.com/sites/daveywinder/2

ForbesElite Hackers Made Almost $1 Million Last Week, Here’s HowBy Davey Winder
ExploreLive feeds
About