stacksmashing

Finally managed, through some patches & lots of hacking, to emulate the RFID card for a parking space. A week later I get the letter that they're switching to license plate recognition. 🥲

Yes, social media is at fault for amplifying the fact that you put - and are still putting - us all at great risk. It's totally out of proportion that everyone now wants to know the details of your operation. Delusional.

The new update on their website is ALSO not really true. A ton of people have issued certificates, and millions of devices are still vulnerable to MITM thanks to them.

Received some video evidence of the eMudhra key generation ceremony

The sad thing is: I'd immediately believe if someone told me this was an HSM bug.

And they said RSA would need a bignum library. uint8_t was enough all along! Great performance optimization by eMudhra.

So the private-key for the eMudhra (revoked) intermediate was apparently 4. How is the root still trusted? How broken are your processes if this can happen? And honestly: How have we (as an industry) not noticed earlier :(

(Not just 4, but 4, 56, 66, 115, 155, 156, 230, 237)

I doubt it.

I got the original, unmodified Commander Keen running on the Pico 2 😀 This uses Frank-x86, a new ILI9341 driver, and (ab)uses the flash on the Pico 2 as swap RAM (which I'm sure is great for it's longevity - sorry, didn't have a PSRAM at hand) Next: Input support!

How it feels to miss a very obvious bug🥲

> You're right, and I own this: I ran erase/program sequences I had not validated against a scope, on your hardware, and it bricked the chip. That was the wrong call 🥲

18 Aug

Found a Supermicro BMC vulnerability yesterday and now getting Supermicro ads all day 🤡

18 Aug

Impatient? Me? Never!!

16 Aug

I don't know what to do with this information, so just sharing it here: Apparently Stern Pinball game-code updates are encrypted LUKS containers 😀

15 Aug

At DEF CON I had the idea to look at a particular subsystem of iOS & macOS. When I came back I started reversing - and found exactly the type of bug I was looking for 😀

14 Aug

Google releases their own AirTag. Also Google: Let's make sure it ALSO does not attach to a key.

5 Aug

Does someone happen to have one of the vulnerable COLDCARDS and would sell it to me at DEFCON?🙏

31 July

If there's one hardware wallet I always told people not to trust it's COLDCARD. Not surprised in the slightest by the recent events. (They messed up their RNG in multiple ways, leading to - so far - user losses above $38 million USD.)

31 July

Hacking random companies is totally okay if I claim my GPU did it?!

28 July

Did KiCAD get compromised? Or some over-eager AI-scraping prevention?!

28 July

(It works on some browsers but not in others)

22 July

If the sandbox escape was so advanced then publish the details.

11 June

My DEF CON talk "Hacking jetskis - from Sea-Don't to Sea-Doo" got accepted 🥳 We'll be having some good fun - such as bypassing the immobilizer using a custom Flipper Zero app, building a custom diagnostic adapter, and some big plot-twists 🛥️

16 May

Opposite of solder-pr0n: Messed up the stencil solder application and was hoping for surface tension to fix it for me 🥲 The expired paste probably didn't help either

8 May

This guy doesn’t even use AI for bug hunting 🙄

6 May

Non-technical teams are now shipping production vulns

4 Apr

Told someone their "vulnerability report" is bs (result of an automatic scanner that has a false positive...) This was the response 😑

30 Mar

Sometimes it’s nice to go back to basics: Built firmware that’s just 246 bytes, uses no RAM at all, and runs parasitically from a 1-wire bus at just 0.2 mA. Yet it emulates a full jetski key! You can see voltage rising until the chip starts running based on the BOD threshold.

25 Mar

If you ever lose the keys to your older Sea-Doo Jetski you might find these bytes useful when talking to the ECU😇 95 BC 2F 02 04 A4 75 BE

25 Mar

Option A: Upgrade iPhone to iOS26 and have to use liquid glass Option B: Get pwned by DarkSword malware I don't know which one is worse

stacksmashing reposted

Banda Bassotti

@orpach.neocities.org

Replying to @stacksmashing.bsky.social

Put that thing on a pole and call it the BLE swiffer.

Sometimes, you simply need Bluetooth HIGH Energy📡

If the datasheet says to use tantalum capacitors - then use tantalum capacitors! Blue = Ceramics Yellow = Tantalum

8 Mar

Simple age check for Linux: Just have the shell ask the user to check the host IP on first boot. If they type ifconfig they are old enough, if they type ip addr they deserve to be restricted from their computer 😇

6 Mar

Things I didn’t see coming: apparently I own a Game Boy signed by a Eurovision contestant?! 😆 youtu.be/8XR2RvfZ-68

5 Mar

No JLC, component placement is not correct 😂

28 Feb

Won today’s bet of “Do I really have no oil pressure, or is the gauge just broken?” 😅

27 Feb

Wow, used Yamaha 01V96 are a steal - and 17 motor faders are a lot of fun 😀

27 Feb

If you find one where some channels don’t move: In 90% of cases it’s just the transistors that are broken. Simple to change and readily available at Digikey & co. Replaced all on mine just to be sure.

20 Feb

Yes VSCode, I obviously want to use the color-picker to edit the address offsets in Arm assembly 😂

20 Feb

Memory Tagging Extension checking my pointer

5 Feb

Fancy, the board-house sent me x-rays of my PCBs!

raspberrypi.comRP2350 Hacking Challenge 2: Less randomisation, more correlation - Raspberry PiOur second RP2350 Hacking Challenge has evolved, with prize money still up for grabs.

3 Feb

My first post on the RaspberryPi Blog 😍 We've extended the RP2350 side-channel hacking challenge to April 30 - and even better: To make attacks for the challenge easier, we decided to disable the random chaffing and some more mitigations! www.raspberrypi.com/news/rp2350-...