🔥Telegram İfşa

I am doubly excited to announce that I will also be speaking at DEF CON #DEFCON31, again talking about physical attacks against Android smartphones, hope to see you all in Vegas!

Looking at #DEFCON31 line up this year for some FOMO and some of my mates have incredible slots! Absolutely go see Vangelis tix Stykas (on Sunday) and Iskuri & CCob🏴󠁧󠁢󠁷󠁬󠁳󠁿 (on Saturday)and their amazing work!

#BHUSA Briefing "Physical Attacks Against Smartphones" aims to demonstrate vulnerabilities in modern Android smartphones that are still viable, despite the mitigations in place. Register now >> bit.ly/47aoQUw

Hello Vegas! #BHUSA

Same goes for blackhat.com/us-23/briefing… a very interesting cloud talk!

Finished my first in-person Blackhat talk! It was an amazing crowd and had some great questions! #BHUSA

As the DEF CON media server has uploaded my slides, I can confirm that the talk I am doing tomorrow will be a two parter, with the second part being a secure boot compromise of Exynos-based Samsung smartphonss!

Both my DEF CON and Black Hat talks went really well! It has been a fantastic week!

I massively enjoyed doing this talk at both conferences, there was great feedback and met some interesting people! Feel free to give the slides a read!

My DEF CON talk for this year is now on the media server: media.defcon.org/DEF%20CON%2031…

youtube.com/watch?v=31xrNu…

One of my favourite bug bounty programs from the past year!

CVE-2024-22012 In TBD of TBD, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution pr… cve.org/CVERecord?id=C…

Wrote an article about turning a ThinkPad X1 Carbon 6th Gen laptop into a programmable USB device by enabling the xDCI controller 😯 Now I can emulate USB devices from the laptop without external hardware, including via Raw Gadget or even Facedancer 😁 xairy.io/articles/think…

PSA: If you do fuzzing research, don't even bother trying to beat AFL++. Just start your evaluation when the ensemble of other existing fuzzers has thoroughly plateaued (I.e. 100h+). Go find problems that can't be solved rn. Don't try to get another 1% gain in the first 48h.