IoT camera vulnerability research / 2024
Operation Big Brother
- CVE-2023-41610
- CVE-2023-41611
- CVE-2023-41612
From an SPI flash dump to proprietary network protocols: firmware and binary analysis of the Victure PC420 uncovered a hardcoded root password, weak encryption, and code execution from micro-SD media. The work includes a Wireshark decoder and coordinated disclosure.
Attacks, detection & a vulnerable lab / 2024
Active Directory Certificate Services
Exploring ADCS attack methods and defenses through talks and Damn-Vulnerable-ADCS, a PowerShell lab setup for testing NTLM relay vulnerabilities. Used in Iowa State University's Cyber Defense Competition.
Binary reverse engineering / 2024
LockBit 3.0 decryptor breakdown
Reverse engineering the recovery tool's decryption-ID checker with Ghidra: unpacking Nuitka output and tracing how SHA-256 hashes are compared against a lookup table.
Hardware & radio protocols / 2023
Garage door RF security
Investigating garage-door radio protocols with accessible hardware. Research notes, a Python implementation for decoding Security+ 2.0 transmissions, and a practical walkthrough presented at SecDSM.
Embedded hardware exploration / 2020
DLink Movienite
Finding an exposed serial interface, gaining a root shell, and exploring the embedded Linux filesystem of a streaming device. A two-part hardware investigation.