Salvador Mendoza

Security researcher

[Salvador Mendoza @Netxing]

I created a space to learn about payment systems: https://t.co/GsR8nS2NsA

[Salvador Mendoza @Netxing]

Agregué 6 nuevos capítulos en audio para el curso de sistemas de pagos en la academia: https://t.co/GsR8nS2NsA!

[Salvador Mendoza @Netxing]

Repository: https://t.co/5zYFwEQEP7
Technical details: https://t.co/L4BSvfeH9g
Academy: https://t.co/GsR8nS2NsA

[Salvador Mendoza @Netxing]

I’ve been working on ATRIUM, a research workbench for EMV payment systems.

It helps researchers observe APDUs, fingerprint cards, apply controlled mutations, and analyze contact, contactless, and ISO 8583 behavior.

It’s also used in SM Academy for hands-on payments.

[Salvador Mendoza @Netxing]

Hey @samykamkar, all these years later, I’m still telling people about you!

[Salvador Mendoza @Netxing]

Now you can listen the modules 1 and 2 instead of reading them. Still editing the training, some updates:

- Finished editing Module 1 and 2 in English and Spanish (including audio)
- Added the VM for the training in module 2
- Still working on content: https://t.co/C003zLFQQ2

[Pablo Corona Fraga @pcoronaf]

Acabo de crear algo que siempre quise: un software de recuperación de archivos borrados, gratuito, open sorce, facil de usar, que no dependa de que alguien sepa usar linea de comandos:
PhoinixDR · Open Source Data Recovery
https://t.co/MMo06w3tSx

[Salvador Mendoza @Netxing]

New blog post SIMtrace2 T-1 Research Project: https://t.co/wrFSr58yZY

[Salvador Mendoza @Netxing]

If you want to have more technical details of this adventure that took more than 5 years: https://t.co/b0xy2nWM5u

[Salvador Mendoza @Netxing]

I created a space to learn about payment systems: https://t.co/GsR8nS2NsA

[Salvador Mendoza @Netxing]

It is been a long time since this https://t.co/0gCQVdVlRg

So decided to built the ISO 7816-3 T=1 support into Osmocom's SIMtrace2 card emulator, hardware-verified EMV transactions, two terminal configs, three silent defects hunted down: https://t.co/mFCZ8zWNGn

[Salvador Mendoza @Netxing]

Caption this...

[Salvador Mendoza @Netxing]

𝗧𝗵𝗲 𝗔𝗺𝗼𝘂𝗻𝘁 𝗧𝗿𝗮𝘃𝗲𝗹𝘀 𝗧𝘄𝗶𝗰𝗲

A payment carries the amount twice: the copy the network approves, and the copy the card signs.

Nothing obliges anyone to compare them.

New series, chapter 1: https://t.co/o6S3HSmUM8

[Salvador Mendoza @Netxing]

I recall discussing this topic back in 2018... This is just the tip of the iceberg. The relay attack will expand to multiple nodes, & we are already seeing relays involving EMV contact data...

The implementations used by authorizers and gateways will be put to the test.

[The Hacker News @TheHackersNews]

🚨 WindRelay turns Android phones into live contactless payment proxies.

Attackers use SpyNote access to silently install the NFC relay malware. When victims tap a physical card on the infected phone, WindRelay streams its NFC data in real time to a fraudster's device, enabling fraudulent payments.

Read how it works: https://t.co/tmqCQsKjEc

[Enno Rey @Enno_Insinuator]

#TROOPERS26 videos published:
https://t.co/Va14UVCSpj

[Salvador Mendoza @Netxing]

Let's catch up!

[Salvador Mendoza @Netxing]

Hi @WEareTROOPERS

[Iceman @herrmann1001]

This is it.

The Proxmark5 promotional video is LIVE.

Wireless. Modular. UHF-ready. Built from 10+ years of real-world RFID research.

This isn’t just another tool, it’s the one you’ve been waiting for.

Watch it. Then pledge. It's never gonna be this cheap again.

👇
https://t.co/4eSfDurkLM

#Proxmark5 #RFID #NFC #HardwareHacking

[Iceman @herrmann1001]

Everything in the Proxmark3 Iceman firmware.
Every iCLASS, SEOS, Mifare, UL-AES, FeliCa update.
Every late night debugging session.

None of it is sponsored. All of it is open source.

If it has saved you time or taught you something, consider buying me a coffee.

Patreon this week: promo code 82409 for a discount.

https://t.co/jNaIDBOAHd

#Proxmark3 #RFID #OpenSource #InfoSec

[Salvador Mendoza @Netxing]

Any plans for training sessions during or before the event @_TROPICON ?

[TROPICON @_TROPICON]

+15 years in the making.
Now it’s real: Tropicon, April 17–18, 2026 — Cozumel.
Escape the noise, secure the future. #TROPICON

[Salvador Mendoza @Netxing]

@liran_tal Thank you!

[Salvador Mendoza @Netxing]

See you in Vegas?