Messing with Zigbee at Pwn2Own

Synacktiv@synacktiv.com · 3mo ago

Make it blink! Our latest article explains how @mtalbi.bsky.social & Matthieu achieved an over-the-air exploitation of the #PhilipsHue Bridge via a #Zigbee flaw. Includes technical details and their #Pwn2Own Cork 2025 demo 👇 www.synacktiv.com/en/publicati...

Mozilla says Mythos helped identify 271 vulnerabilities in Firefox 150. I went through the commits, CVEs, and bug links to see what that number really means. My takeaway: relax folks. xark.es/b/mythos-fir...

A quick look at Mythos run on Firefox: too much hype?

A closer look at Mozilla's Firefox 150

xark.es

The fuzzer that found project-zero.issues.chromium.org/issues?q=com... (and a number of issues prior to that as well) is now open-source: crrev.com/c/7580844 It uses pkeys, trap-handling and single-stepping to intercept and mutate in-sandbox reads (see trap-fuzzer.h). Definitely had fun writing it!

Two weeks ago, Google published a paper proving in zero-knowledge that they had an efficient implementation of Shor's algorithm. Today, Trail of Bits can prove that we have an even better implementation which beats Google's on all metrics! 🫢 blog.trailofbits.com/2026/04/17/w...

My #Hexacon talk with Etienne on exploiting the Bluetooth stack (fluoride) is now available on YouTube youtu.be/wYulofbUDqY?...

HEXACON 2025 - Paint it Blue: Attacking the Bluetooth stack by Mehdi Talbi & Etienne Helluy-Lafont

YouTube video by Hexacon

youtu.be

New Blog Post: Seth Jenkins broke kASLR by doing … nothing 😩 googleprojectzero.blogspot.com/2025/11/defe...

Defeating KASLR by Doing Nothing at All

Posted by Seth Jenkins, Project Zero Introduction I've recently been researching Pixel kernel exploitation and as part of this research I ...

googleprojectzero.blogspot.com

🎥 Eyes wide shut! David Berard of @synacktiv.com just breached the @Ubiquiti AI Pro surveillance system at #Pwn2Own. He also serenaded us with round of "Baby Shark" played through the speaker. He's off to the disclosure room with an ear worm and the details.

Confirmed! The team from @synacktiv.com used a buffer overflow to exploit the Phillips Hue Bridge. Their unique bug earns them $20,000 and 4 Master of Pwn points. #Pwn2Own

New blog post: Exploiting the Synology TC500 at Pwn2Own Ireland 2024 We built a format string exploit for the TC500 smart cam. It didn’t get used, but it made for a fun case study. blog.infosectcbr.com.au/2025/08/01/e...

Exploiting the Synology TC500 at Pwn2Own Ireland 2024

Introduction In October 2024, InfoSect participated in Pwn2Own – a bug bounty competition against embedded devices such as cameras, NAS’, and smart speakers. In this blog, I’ll di…

blog.infosectcbr.com.au

Documented instructions for setting up KGDB on Pixel 8. Including getting kernel log over UART via USB-Cereal, building/flashing custom kernel, breaking into KGDB via /proc/sysrq-trigger or by sending SysRq-G over serial, dealing with watchdogs, etc. xairy.io/articles/pix...

📲 Debugging the Pixel 8 kernel via KGDB

Instructions for getting kernel log, building custom kernel, and enabling KGDB on Pixel 8

xairy.io

Dumping firmware from JieLi chips JieLi chips are fairly common in Bluetooth audio devices, but they are also becoming more common in miscellaneous devices. Fortunately, retrieving the firmware is mostly straightforward.

On the anniversary of the sinking of the Titanic, we thought we'd answer a question that's often asked, "If they raised the Mary Rose, why not raise the Titanic?" Allow our scaled diagram to explain...

I grew up on a diet of Scary Stories to Tell in the Dark... I swear these vines covering a lamppost in Wroclaw, Poland are straight out of my childhood nightmares.

v happy to finally share my slides for my @reconmtl.bsky.social 2024 talk “GOP Complex: Image parsing bugs, EBC polymorphic engines and the Deus ex machina of UEFI exploit dev.” Really proud of this talk + v grateful to the amazing REcon team for another incredible con 🖤 github.com/ic3qu33n/REc...

GitHub - ic3qu33n/REcon2024-GOP-Complex: REcon 2024 Repo, slides for talk "GOP Complex: Image parsing bugs, EBC polymorphic engines and the Deus ex machina of UEFI exploit dev""

REcon 2024 Repo, slides for talk "GOP Complex: Image parsing bugs, EBC polymorphic engines and the Deus ex machina of UEFI exploit dev"" - ic3qu33n/REcon2024-GOP-Complex

github.com

This is fake but if we boost it enough someone from the administration will claim it’s true during the congressional hearings so you know what to do

nixCraft@cyberciti.biz · last yr.

Lmao 🤣 savages

We heard you needed some more time, so we wanted to let you cook. We decided to push the Phrack 72 CFP deadline back until June 15th. Stay tuned for upcoming Phrack events. Print this flyer out and give it to someone IRL!!

For $20,000/month, I will personally google stuff and paraphrase it for you into mostly-accurate answers.

Techmeme@techmeme.com · last yr.

Source: OpenAI executives have told some investors about plans for a $2,000/month agent, a $10,000/month agent for coding, and a $20,000/month PhD-level agent (The Information) Main Link | Techmeme Permalink

Pumpkin (@u1f383 on X) does cool work. Here is another cool read about an interesting race condition involving signal handling u1f383.github.io/linux/2025/0...

Alex Plaskett@alexplaskett.bsky.social · 2y ago

Linux kernel exploitation slides from Pumpkin. He exploited a stack out-of-bounds write bug in the traffic control subsystem. u1f383.github.io/slides/talks...

Announcing #Pwn2Own Berlin! We're moving our enterprise-focused event to @offensivecon.bsky.social and introducing an AI category. More than $1,000,000 in cash & prizes (Incl. a Tesla) are available to win. Check out the details at www.zerodayinitiative.com/blog/2025/2/...

Zero Day Initiative — Announce Pwn2Own Berlin and Introducing an AI Category

If you just want to read the contest rules, click here . Willkommen, meine Damen und Herren, zu unserem ersten Wettbewerb in Berlin! That’s correct (if Google translate didn’t steer me wrong). ...

zerodayinitiative.com

I made an ImHex pattern file for the ftab file format used for Apple C1 firmware and Apple accessories gist.github.com/matteyeux/d1...

OpenSSH 9.9p2 has just been released with fixes for two security problems reported by the Qualys Security Advisory Team: a denial-of-service in the default configuration and a host impersonation by on-path attackers when VerifyHostKeyDNS is enabled (off by default). www.openssh.com/releasenotes...

Microsoft's own research confirms something that was already pretty obvious: relying on a text generating machine to come up with answers erodes critical thinking, and is a method favoured by those who never liked doing critical thinking in the first place advait.org/files/lee_20...

They found a way to litter from space

Kelsey Johnson@profkelsey.bsky.social · last yr.

Something else to thank EM for. "The sustained rate of daily reentries is unprecedented," says Jonathan McDowell, an astronomer at the Harvard Center for Astrophysics who tracks satellites. "They are retiring and incinerating about 4 or 5 Starlinks every day." @planet4589.bsky.social #astronomy

for anyone interested in linux kernel or android security research, i'm experimenting with a custom feed here bsky.app/profile/did:...

Earlier this year, I used a 1day to exploit the kernelCTF VRP LTS instance. I then used the same bug to write a universal exploit that worked against up-to-date mainstream distros for approximately 2 months. osec.io/blog/2024-11...

New platform, who dis? It me, and @johnnyspandex.bsky.social dropping some VPN client exploit freshness! 🌮🔒 Today, we're releasing NachoVPN, our VPN client exploitation tool, as presented at SANS HackFest Hollywood. Get it on the @amberwolfsec.bsky.social blog: blog.amberwolf.com/blog/2024/no...

Interesting paper by Erin Avllazagaj to automatically find Linux kernel objects being potentially useful for privilege escalation, tool is called SCAVY. www.usenix.org/system/files...

Qualys is at it again: https://seclists.org/oss-sec/2024/q4/108 LPEs in needrestart (CVE-2024-48990, CVE-2024-48991, CVE-2024-48992, CVE-2024-10224, and CVE-2024-11003) Original post

Touching grass What else to remain sane?